urlscan.io logo urlscan.io
SecurityTrails logo

aptitude.thetopmainplacesetnowcontentsnewlist.trade Open in urlscan Pro
51.15.157.194  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.greatestapps.mobi/?sl=1429571-30165&data1=Track1&data2=Track2&tag={External_ID_from_traffic_source}&website={subID...
Effective URL: https://aptitude.thetopmainplacesetnowcontentsnewlist.trade/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&ci...
Submission: On August 07 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 6 countries across 8 domains to perform 6 HTTP transactions. The main IP is 51.15.157.194, located in France and belongs to AS12876, FR. The main domain is aptitude.thetopmainplacesetnowcontentsnewlist.trade.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 5th 2018. Valid for: 3 months.
This is the only time aptitude.thetopmainplacesetnowcontentsnewlist.trade was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fake Flash Update

Domain & IP information

IP Address AS Autonomous System
1 1 52.28.126.132 16509 (AMAZON-02)
1 3 62.212.87.141 60781 (LEASEWEB-...)
1 54.76.45.150 16509 (AMAZON-02)
1 2 109.123.118.67 13213 (UK2NET-AS)
1 212.32.250.1 60781 (LEASEWEB-...)
1 1 34.236.254.103 14618 (AMAZON-AES)
1 1 54.172.2.149 14618 (AMAZON-AES)
1 51.15.157.194 12876 (AS12876)
6 6
1    52.28.126.132 (Frankfurt, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-28-126-132.eu-central-1.compute.amazonaws.com
www.greatestapps.mobi
3    62.212.87.141 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
sharktraff.com
1    54.76.45.150 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-76-45-150.eu-west-1.compute.amazonaws.com
traffic.tc-clicks.com
2    109.123.118.67 (United Kingdom)

ASN13213 (UK2NET-AS, GB)
PTR: 118-67.topstaffsolutions.com
pnr2712.brucelead.com
1    212.32.250.1 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
tracking.pluscpi.mobi
1    34.236.254.103 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-236-254-103.compute-1.amazonaws.com
vip.adpiano.com
1    54.172.2.149 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-172-2-149.compute-1.amazonaws.com
www.downloadcross.stream
1    51.15.157.194 (France)

ASN12876 (AS12876, FR)
PTR: 51-15-157-194.rev.poneytelecom.eu
aptitude.thetopmainplacesetnowcontentsnewlist.trade
Domain Requested by
3 sharktraff.com 1 redirects sharktraff.com
2 pnr2712.brucelead.com 1 redirects
1 aptitude.thetopmainplacesetnowcontentsnewlist.trade
1 www.downloadcross.stream 1 redirects
1 vip.adpiano.com 1 redirects
1 tracking.pluscpi.mobi pnr2712.brucelead.com
1 traffic.tc-clicks.com sharktraff.com
1 www.greatestapps.mobi 1 redirects
6 8

This site contains links to these domains. Also see Links.

Domain
static.updflashcycle.win
Subject Issuer Validity Valid
trk.billysrv.com
Let's Encrypt Authority X3		 2018-06-12 -
2018-09-10		 3 months crt.sh
*.pluscpi.mobi
RapidSSL RSA CA 2018		 2018-06-28 -
2019-06-28		 a year crt.sh
aptitude.thetopmainplacesetnowcontentsnewlist.trade
Let's Encrypt Authority X3		 2018-07-05 -
2018-10-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://aptitude.thetopmainplacesetnowcontentsnewlist.trade/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b69daff9125fb000199d9a2&sub=1001_UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU=&v_id=vdI-kyOffjxkjh4OIjNlvfcbuhMbWFHjIR0eK5wTSN8.
Frame ID: 0F20849DFDFDB86387940F577383553E
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://www.greatestapps.mobi/?sl=1429571-30165&data1=Track1&data2=Track2&tag={External_ID_from_traffic_so... HTTP 302
    https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606 Page URL
  2. https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606&... HTTP 302
    https://sharktraff.com/gw?sub=9019700101153139030-201808-5a81b6684a&source=34606&url=http%3A%2F%2Ft... Page URL
  3. http://traffic.tc-clicks.com/?p=2827&media_type=mainstream&click_id=bmconv_20180807194639_270db10e_9ed3_4... Page URL
  4. http://pnr2712.brucelead.com/ck.php?line_item_id=4245&subid_spx=2827&tracker=e7pmqlpwvns4wgkoc4w80cggc,13... Page URL
  5. http://pnr2712.brucelead.com/ck_jump?id=cz0xMjQ0OTkxMDczMDI5ODc4JnQ9MTUzMzY2Mzk5OSZoPTExNDY4MTM5MzU=&__if... HTTP 302
    https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU%3D... Page URL
  6. https://vip.adpiano.com/pljas/msnrop/?utm_source=17256&utm_campaign=616748&clck=5b69daff9125fb000199... HTTP 302
    https://www.downloadcross.stream/?gea=ZLmJ6g4DY3rlfFeDQN2ED9YLPWPLefUWPUADV0HP1T4.&cid=5b69daff9125fb000199d9... HTTP 302
    https://aptitude.thetopmainplacesetnowcontentsnewlist.trade/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzop... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 50%
Detected patterns
  • env /^head$/i

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

6
IPs

6
Countries

481 kB
Transfer

1045 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.greatestapps.mobi/?sl=1429571-30165&data1=Track1&data2=Track2&tag={External_ID_from_traffic_source}&website={subID}&placement={sub_subID} HTTP 302
    https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606 Page URL
  2. https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606&code=VVCoFjDias2tb3Sb6B7Sf1HPVtip7jrcz8KtHQ3cRXW9CNZgRvpsaKKwQqwQJzwNgZJQZo9x75GP1xniRfb9NKFS98Y3YyL1s3h42fWPtfuNeVtvCj9aFszvevPnMwcaF8ZFFzHZeWhJziYTvqKRXcTVHDJVWf1CDTAssn9UdWF2tFYujg2HnpHG3vGT4653ACr87ojUSjQ1U6FBz2aq1Sr7c5ZEacA6SCMmzmVDDgV3dnXt8JWYHdDvLb9imwsah8bFz3XnMo2UVbbBaEThkHmpU6YtJ67hUReND3yhmhDoy3DavK9mUbjYnLmK88GwtDtk3DUPrdVTxjAiXKYeReGp9hSkF4zvKp1GD86rh1YFHfaHxZVZEDxTrtP4pdt6WzHTQP1DKsGQjKoSPtWZSEtK12mNY3NL4sVQwtop9FM9ykUnV3x24JEpkabzktbWfdkWaNTT7tkmvfNUtumURZkcwGV75U3JKUSsR8Gm9A1PvU1jNaAV2KgSuWhFDvB4oSmFakCkXbhvBkQKNEH6vMpt3dMq3vh1bnyiM5X6zEzCx5tWryqGYsyB4oDXaTjBkfi5tHPnFMDbB59qxwm5vsmJgF5PoUvc9XPXj7o25jdZwqVq4cEFogX3kBYnGRwkFeLv2e5TeCAZ47QtcbCsURexNfhs98PkRqVeWfJHjhVaZNDMnBvnKF5B9d4PF6ky3pejFAC2nfKALxYuc1AwoY5RknV1JRTakN5VzWNZxQGNzGVNCiqeBgmmvJtyWYG6UHhLyHbD8M7oFniT3ZMDo1U7pwehoTybNiR5ggsriCbUVTejbgYfPmKGe3D3k9qz2vVy7jcu6nhLNg8JHJk9xLhDAd7vfpSVYaQdixxUzqWvsfGSE8E4w3YwcF44K8cV7eENABBTtFwiQz9bkeDzGkUPCjzKBzZq98VQWDqq6P7r4vqhVVASKDXuWDQWvUnC HTTP 302
    https://sharktraff.com/gw?sub=9019700101153139030-201808-5a81b6684a&source=34606&url=http%3A%2F%2Ftraffic.tc-clicks.com%2F%3Fp%3D2827%26media_type%3Dmainstream%26click_id%3Dbmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68%26sub_id%3D567_34606&vId=bmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68&hash=642685809ea32be499&ete=true Page URL
  3. http://traffic.tc-clicks.com/?p=2827&media_type=mainstream&click_id=bmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68&sub_id=567_34606 Page URL
  4. http://pnr2712.brucelead.com/ck.php?line_item_id=4245&subid_spx=2827&tracker=e7pmqlpwvns4wgkoc4w80cggc,13057484,5,2827&ctrack=1533663999.1261854848 Page URL
  5. http://pnr2712.brucelead.com/ck_jump?id=cz0xMjQ0OTkxMDczMDI5ODc4JnQ9MTUzMzY2Mzk5OSZoPTExNDY4MTM5MzU=&__if=0&__type=unknown&__deviceid= HTTP 302
    https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU%3D&sub1=20180807_d6adfb86-9a69-11e8-8bf4-25a81ea5390c Page URL
  6. https://vip.adpiano.com/pljas/msnrop/?utm_source=17256&utm_campaign=616748&clck=5b69daff9125fb000199d9a2&sid=1001_UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU= HTTP 302
    https://www.downloadcross.stream/?gea=ZLmJ6g4DY3rlfFeDQN2ED9YLPWPLefUWPUADV0HP1T4.&cid=5b69daff9125fb000199d9a2&sub=1001_UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU= HTTP 302
    https://aptitude.thetopmainplacesetnowcontentsnewlist.trade/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b69daff9125fb000199d9a2&sub=1001_UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU=&v_id=vdI-kyOffjxkjh4OIjNlvfcbuhMbWFHjIR0eK5wTSN8. Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www.greatestapps.mobi/?sl=1429571-30165&data1=Track1&data2=Track2&tag={External_ID_from_traffic_source}&website={subID}&placement={sub_subID} HTTP 302
  • https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606
Request Chain 1
  • https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606&code=VVCoFjDias2tb3Sb6B7Sf1HPVtip7jrcz8KtHQ3cRXW9CNZgRvpsaKKwQqwQJzwNgZJQZo9x75GP1xniRfb9NKFS98Y3YyL1s3h42fWPtfuNeVtvCj9aFszvevPnMwcaF8ZFFzHZeWhJziYTvqKRXcTVHDJVWf1CDTAssn9UdWF2tFYujg2HnpHG3vGT4653ACr87ojUSjQ1U6FBz2aq1Sr7c5ZEacA6SCMmzmVDDgV3dnXt8JWYHdDvLb9imwsah8bFz3XnMo2UVbbBaEThkHmpU6YtJ67hUReND3yhmhDoy3DavK9mUbjYnLmK88GwtDtk3DUPrdVTxjAiXKYeReGp9hSkF4zvKp1GD86rh1YFHfaHxZVZEDxTrtP4pdt6WzHTQP1DKsGQjKoSPtWZSEtK12mNY3NL4sVQwtop9FM9ykUnV3x24JEpkabzktbWfdkWaNTT7tkmvfNUtumURZkcwGV75U3JKUSsR8Gm9A1PvU1jNaAV2KgSuWhFDvB4oSmFakCkXbhvBkQKNEH6vMpt3dMq3vh1bnyiM5X6zEzCx5tWryqGYsyB4oDXaTjBkfi5tHPnFMDbB59qxwm5vsmJgF5PoUvc9XPXj7o25jdZwqVq4cEFogX3kBYnGRwkFeLv2e5TeCAZ47QtcbCsURexNfhs98PkRqVeWfJHjhVaZNDMnBvnKF5B9d4PF6ky3pejFAC2nfKALxYuc1AwoY5RknV1JRTakN5VzWNZxQGNzGVNCiqeBgmmvJtyWYG6UHhLyHbD8M7oFniT3ZMDo1U7pwehoTybNiR5ggsriCbUVTejbgYfPmKGe3D3k9qz2vVy7jcu6nhLNg8JHJk9xLhDAd7vfpSVYaQdixxUzqWvsfGSE8E4w3YwcF44K8cV7eENABBTtFwiQz9bkeDzGkUPCjzKBzZq98VQWDqq6P7r4vqhVVASKDXuWDQWvUnC HTTP 302
  • https://sharktraff.com/gw?sub=9019700101153139030-201808-5a81b6684a&source=34606&url=http%3A%2F%2Ftraffic.tc-clicks.com%2F%3Fp%3D2827%26media_type%3Dmainstream%26click_id%3Dbmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68%26sub_id%3D567_34606&vId=bmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68&hash=642685809ea32be499&ete=true
Request Chain 4
  • http://pnr2712.brucelead.com/ck_jump?id=cz0xMjQ0OTkxMDczMDI5ODc4JnQ9MTUzMzY2Mzk5OSZoPTExNDY4MTM5MzU=&__if=0&__type=unknown&__deviceid= HTTP 302
  • https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU%3D&sub1=20180807_d6adfb86-9a69-11e8-8bf4-25a81ea5390c

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
642685809ea32be499
sharktraff.com/l/
Redirect Chain
  • http://www.greatestapps.mobi/?sl=1429571-30165&data1=Track1&data2=Track2&tag={External_ID_from_traffic_source}&website={subID}&placement={sub_subID}
  • https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606
25 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.212.87.141 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
2f0f2931a3a9f0866073a99be33295d76e0ecc2084918b4e11e006e4b6c834e7

Request headers

Host
sharktraff.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
0F20849DFDFDB86387940F577383553E

Response headers

Server
nginx
Date
Tue, 07 Aug 2018 17:46:39 GMT
Content-Type
text/html
Last-Modified
Wed, 18 Jul 2018 09:44:14 GMT
Transfer-Encoding
chunked
ETag
W/"5b4f0bee-6290"
Expires
Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control
max-age=315360000
Content-Encoding
gzip

Redirect headers

Date
Tue, 07 Aug 2018 17:46:39 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
AWSALB=LjoUXcKXeu92aKg1bsAInFRCu7lBGV88H9UqSQAkqdA3VDEsu6fXV7RSLqCI4yWG4sLATgGkDF+R113VSKzdwu+mtqt+N4KacYy64fdTOmSHvuWwQ2C7ebzlAbrd; Expires=Tue, 14 Aug 2018 17:46:39 GMT; Path=/ vidf=czo2NDoiMzVhMzk4ZDQ0MDkzYzAwZWM1NjkwN2I5N2FhNzU2M2JkZDc1ZjZmMmI1YmVjOGZhMThmMmM1OWJmNGVhNjlmNyI7; expires=Mon, 05-Nov-2018 18:46:39 GMT; Max-Age=7779600; path=/; domain=www.greatestapps.mobi vt=868779-1533663999; expires=Wed, 08-Aug-2018 17:46:39 GMT; Max-Age=86400; path=/; domain=greatestapps.mobi _s=1429571; expires=Wed, 08-Aug-2018 17:46:39 GMT; Max-Age=86400; path=/; domain=greatestapps.mobi rd=YjoxOw%3D%3D; expires=Wed, 08-Aug-2018 17:46:39 GMT; Max-Age=86400; path=/; domain=www.greatestapps.mobi
Server
nginx
Location
https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606
Referrer-Policy
no-referrer
gw
sharktraff.com/
Redirect Chain
  • https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606&code=VVCoFjDias2tb3Sb6B7Sf1HPVtip7jrcz8KtHQ3cRXW9CNZgRvpsaKKwQqwQJzwNgZJQZo9x75GP1xniRfb9NKFS98Y3Y...
  • https://sharktraff.com/gw?sub=9019700101153139030-201808-5a81b6684a&source=34606&url=http%3A%2F%2Ftraffic.tc-clicks.com%2F%3Fp%3D2827%26media_type%3Dmainstream%26click_id%3Dbmconv_20180807194639_27...
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sharktraff.com/gw?sub=9019700101153139030-201808-5a81b6684a&source=34606&url=http%3A%2F%2Ftraffic.tc-clicks.com%2F%3Fp%3D2827%26media_type%3Dmainstream%26click_id%3Dbmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68%26sub_id%3D567_34606&vId=bmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68&hash=642685809ea32be499&ete=true
Requested by
Host: sharktraff.com
URL: https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
62.212.87.141 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
8a9acfd06df7aa4e0d9d29df29573d43ed7044c5d18bc000881e7a9308016052

Request headers

Host
sharktraff.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606
Accept-Encoding
gzip, deflate
Cookie
BSESSID=trk10655a41-a707-40c7-9d5f-c7eda77538f4
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
0F20849DFDFDB86387940F577383553E
Referer
https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606

Response headers

Server
nginx
Date
Tue, 07 Aug 2018 17:46:39 GMT
Content-Type
text/html
Last-Modified
Mon, 15 Jan 2018 18:02:06 GMT
Transfer-Encoding
chunked
ETag
W/"5a5cec9e-606"
Expires
Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control
max-age=315360000
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Tue, 07 Aug 2018 17:46:39 GMT
Transfer-Encoding
chunked
Location
//sharktraff.com/gw?sub=9019700101153139030-201808-5a81b6684a&source=34606&url=http%3A%2F%2Ftraffic.tc-clicks.com%2F%3Fp%3D2827%26media_type%3Dmainstream%26click_id%3Dbmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68%26sub_id%3D567_34606&vId=bmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68&hash=642685809ea32be499&ete=true
Cache-Control
private, max-age=0, no-cache, no-store, must-revalidate
Pragma
no-cache
Set-Cookie
BSESSID=trk10655a41-a707-40c7-9d5f-c7eda77538f4; Max-Age=63072000; Expires=Thu, 06 Aug 2020 17:46:39 GMT; Path=/
Cookie set /
traffic.tc-clicks.com/ 		763 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://traffic.tc-clicks.com/?p=2827&media_type=mainstream&click_id=bmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68&sub_id=567_34606
Requested by
Host: sharktraff.com
URL: https://sharktraff.com/l/642685809ea32be499?sub=9019700101153139030-201808-5a81b6684a&source=34606&url=http%3A%2F%2Ftraffic.tc-clicks.com%2F%3Fp%3D2827%26media_type%3Dmainstream%26click_id%3Dbmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68%26sub_id%3D567_34606&vId=bmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68&hash=642685809ea32be499&ete=true
Protocol
HTTP/1.1
Server
54.76.45.150 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-76-45-150.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c13e46c9ea11ab54cf67940a0ee31c36756a3dfb6f31d1c1680480b858be9006

Request headers

Host
traffic.tc-clicks.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
0F20849DFDFDB86387940F577383553E

Response headers

Date
Tue, 07 Aug 2018 17:46:39 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Server
nginx
Vary
Accept-Encoding
Set-Cookie
traffic-back=ok; expires=Tue, 07-Aug-2018 17:47:09 GMT; Max-Age=30; path=/; domain=traffic.tc-clicks.com traffic-visited-offers=18902%7C1533663999%7C18902%7Cunspecified; expires=Wed, 08-Aug-2018 17:46:39 GMT; Max-Age=86400; path=/; domain=traffic.tc-clicks.com rts-trck=1; expires=Tue, 07-Aug-2018 17:56:39 GMT; Max-Age=600; path=/; domain=traffic.tc-clicks.com
Last-Modified
Tue, 7 Aug 2018 17:46:39 GMT
Expires
Tue, 7 Aug 2018 17:46:39 GMT
Cache-Control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
Pragma
no-cache
X-Robots-Tag
noindex, nofollow
Content-Encoding
gzip
Cookie set ck.php
pnr2712.brucelead.com/ 		983 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://pnr2712.brucelead.com/ck.php?line_item_id=4245&subid_spx=2827&tracker=e7pmqlpwvns4wgkoc4w80cggc,13057484,5,2827&ctrack=1533663999.1261854848
Protocol
HTTP/1.1
Server
109.123.118.67 , United Kingdom, ASN13213 (UK2NET-AS, GB),
Reverse DNS
118-67.topstaffsolutions.com
Software
SpirooxPerformance-Server-1.0 /
Resource Hash
d2bfa713af9fbca6ff056c32779b923cd273a8a2f4be4ae5f9d8b5b83305a7ae

Request headers

Host
pnr2712.brucelead.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://traffic.tc-clicks.com/?p=2827&media_type=mainstream&click_id=bmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68&sub_id=567_34606
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
0F20849DFDFDB86387940F577383553E
Referer
http://traffic.tc-clicks.com/?p=2827&media_type=mainstream&click_id=bmconv_20180807194639_270db10e_9ed3_4c75_b011_ed2e9ac50c68&sub_id=567_34606

Response headers

Date
Tue, 07 Aug 2018 17:46:39 GMT
Server
SpirooxPerformance-Server-1.0
Cache-Control
no-cache, no-store, must-revalidate, max-age=0
Expires
0
Pragma
no-cache
Content-Length
983
Connection
close
Content-Type
text/html; charset=utf-8
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie
session=20180807_d6adfb86-9a69-11e8-8bf4-25a81ea5390c%7C1244991073029878%7C2018-08-07T17%3A46%3A39%2B0000%7C2921044%7CGermany%7C4245%7C2827%7Ce7pmqlpwvns4wgkoc4w80cggc%2C13057484%2C5%2C2827%7C2712%7C4%7C1837%7C4245%7C2%7C2402%7C0%7C12657%7C10976%7C21975%7C6997%7C0%7C0%7C3%7C1%7CMac%7C67%7C%7C%7CChrome%7CHETZNER%7CWIFI%7C148.251.45.0%2F24%7C148.251.45.254%7C0%7C2827%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7Cnull%7C%7C0.0%7C0.0%7C0.0%7C0.0%7C0%7Ctraffic.tc-clicks.com%7C1533663999877%7C%7Cfalse%7Cfalse%7C52%7C0%7C27%7C%7C0%7C0%7C%7Cpnr2712.brucelead.com%7Cde%7C; domain=pnr2712.brucelead.com; path=/
Cookie set click
tracking.pluscpi.mobi/
Redirect Chain
  • http://pnr2712.brucelead.com/ck_jump?id=cz0xMjQ0OTkxMDczMDI5ODc4JnQ9MTUzMzY2Mzk5OSZoPTExNDY4MTM5MzU=&__if=0&__type=unknown&__deviceid=
  • https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU%3D&sub1=20180807_d6adfb86-9a69-11e8-8bf4-25a81ea5390c
271 B
530 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU%3D&sub1=20180807_d6adfb86-9a69-11e8-8bf4-25a81ea5390c
Requested by
Host: pnr2712.brucelead.com
URL: http://pnr2712.brucelead.com/ck.php?line_item_id=4245&subid_spx=2827&tracker=e7pmqlpwvns4wgkoc4w80cggc,13057484,5,2827&ctrack=1533663999.1261854848
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.32.250.1 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Host
tracking.pluscpi.mobi
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://pnr2712.brucelead.com/ck.php?line_item_id=4245&subid_spx=2827&tracker=e7pmqlpwvns4wgkoc4w80cggc,13057484,5,2827&ctrack=1533663999.1261854848
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
0F20849DFDFDB86387940F577383553E
Referer
http://pnr2712.brucelead.com/ck.php?line_item_id=4245&subid_spx=2827&tracker=e7pmqlpwvns4wgkoc4w80cggc,13057484,5,2827&ctrack=1533663999.1261854848

Response headers

Server
nginx
Date
Tue, 07 Aug 2018 17:46:39 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
afclick=5b69daff9125fb000199d9a2; Expires=Wed, 07 Aug 2019 17:46:39 GMT
Content-Encoding
gzip

Redirect headers

Date
Tue, 07 Aug 2018 17:46:39 GMT
Server
SpirooxPerformance-Server-1.0
Cache-Control
no-cache, no-store, must-revalidate, max-age=0
Expires
0
Pragma
no-cache
Connection
close
Location
https://tracking.pluscpi.mobi/click?pid=1001&offer_id=7610&sub2=UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU%3D&sub1=20180807_d6adfb86-9a69-11e8-8bf4-25a81ea5390c
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie
session=0; domain=pnr2712.brucelead.com; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT c21975=1 ; domain=pnr2712.brucelead.com; path=/; expires=Wed, 08 Aug 2018 17:46:39 GMT l4245=1 ; domain=pnr2712.brucelead.com; path=/; expires=Wed, 08 Aug 2018 17:46:39 GMT
Primary Request Cookie set /
aptitude.thetopmainplacesetnowcontentsnewlist.trade/
Redirect Chain
  • https://vip.adpiano.com/pljas/msnrop/?utm_source=17256&utm_campaign=616748&clck=5b69daff9125fb000199d9a2&sid=1001_UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU=
  • https://www.downloadcross.stream/?gea=ZLmJ6g4DY3rlfFeDQN2ED9YLPWPLefUWPUADV0HP1T4.&cid=5b69daff9125fb000199d9a2&sub=1001_UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU=
  • https://aptitude.thetopmainplacesetnowcontentsnewlist.trade/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b69daff9125fb000199d9a2&sub=1001_UzoxO...
666 KB
465 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://aptitude.thetopmainplacesetnowcontentsnewlist.trade/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b69daff9125fb000199d9a2&sub=1001_UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU=&v_id=vdI-kyOffjxkjh4OIjNlvfcbuhMbWFHjIR0eK5wTSN8.
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.15.157.194 , France, ASN12876 (AS12876, FR),
Reverse DNS
51-15-157-194.rev.poneytelecom.eu
Software
nginx/1.13.9 / PHP/7.0.27-0+deb9u1
Resource Hash
8c2dc3e0250176978fc0ecc2c4dca1308b65dc1e1c6847e044f81c347aed1e28
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Host
aptitude.thetopmainplacesetnowcontentsnewlist.trade
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
0F20849DFDFDB86387940F577383553E

Response headers

Server
nginx/1.13.9
Date
Tue, 07 Aug 2018 17:46:40 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/7.0.27-0+deb9u1
Set-Cookie
channel=plus_mac2; expires=Tue, 07-Aug-2018 18:06:40 GMT; Max-Age=1200; path=/ dist_id=2610; expires=Tue, 07-Aug-2018 18:06:40 GMT; Max-Age=1200; path=/ lp_id=2320; expires=Tue, 07-Aug-2018 18:06:40 GMT; Max-Age=1200; path=/
Strict-Transport-Security
max-age=15768000
Content-Encoding
gzip

Redirect headers

Server
nginx/1.13.9
Date
Tue, 07 Aug 2018 17:46:40 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/7.0.30-0+deb9u1
Location
https://aptitude.thetopmainplacesetnowcontentsnewlist.trade/?gea=uDPSZ2yLVTeHkjeh-ZHgXB9r04wpIIjzkPYyIHWKHJPwKfi7xFxITxC3EK1KETIaU3OVzopF6whvgn70dBsYSQ..&cid=5b69daff9125fb000199d9a2&sub=1001_UzoxODM3LFNCOjI4MjcsTDo0MjQ1LEM6MjE5NzU=&v_id=vdI-kyOffjxkjh4OIjNlvfcbuhMbWFHjIR0eK5wTSN8.
Strict-Transport-Security
max-age=15768000
truncated
/ 		24 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
06f39efc265052e6fbe7a889cc48904fb149358f8c5243023a670cd5fb581381

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		21 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f7a2be71742bafbf402ed941c48b981cec234709e12adc5c20bb399412799874

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		28 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
36dc7c37393ee468e4efd16b9a915114943db37d5937b0beb5cd01f628a23469

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		32 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7187aeacacd4d14c0e0b31c2d3686a10e334e61a4a8b3c64dd38aed62eba4d1

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		22 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee2a07bd37a9929e7dd189ad0c05e3eb27ea31e6ddc6beb2d6a4db5a89962441

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		24 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
00e13ef52545e82fa4d31907ef274a76d7755e102b10029a54b2a650c6d380a5

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		36 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2750e17782b11cb2d53a78fd8cfe909a57cce7834d9f1d2b5aca999f6d23638c

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		39 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
59eeda148701ab1739c450f45ebbc1abed681b4e732342b52968c478f30c0ec0

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		25 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1ae1e057debc221e1471354f15431c18d456c7fd7543fe8d968b1797a19ab722

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		30 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
730b5f27c8524eb5c38f182a45acda474d2117b6ae6b618ba19a8b92abca4de2

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		33 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
244d51c52be8f4aec58fe17d0383af45245f410fce160d0135a3ce173d51bcc1

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ 		37 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
39311f6d6b968abe38b00398d4b9bec6909f2eea0dd7752d43d7a5c04e63a31e

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fake Flash Update

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showStep string| host string| pdi_param_1 number| pdi_param_2 number| pdi_param_3 string| pdi_start_url object| head object| css object| adVars function| goToAd function| setFilterEffect function| close_modal_ad function| showModalAd function| httpGetAsync object| dlobj

3 Cookies

Domain/Path Name / Value
aptitude.thetopmainplacesetnowcontentsnewlist.trade/ Name: dist_id
Value: 2610
aptitude.thetopmainplacesetnowcontentsnewlist.trade/ Name: lp_id
Value: 2320
aptitude.thetopmainplacesetnowcontentsnewlist.trade/ Name: channel
Value: plus_mac2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aptitude.thetopmainplacesetnowcontentsnewlist.trade
pnr2712.brucelead.com
sharktraff.com
tracking.pluscpi.mobi
traffic.tc-clicks.com
vip.adpiano.com
www.downloadcross.stream
www.greatestapps.mobi
109.123.118.67
212.32.250.1
34.236.254.103
51.15.157.194
52.28.126.132
54.172.2.149
54.76.45.150
62.212.87.141
00e13ef52545e82fa4d31907ef274a76d7755e102b10029a54b2a650c6d380a5
06f39efc265052e6fbe7a889cc48904fb149358f8c5243023a670cd5fb581381
1ae1e057debc221e1471354f15431c18d456c7fd7543fe8d968b1797a19ab722
244d51c52be8f4aec58fe17d0383af45245f410fce160d0135a3ce173d51bcc1
2750e17782b11cb2d53a78fd8cfe909a57cce7834d9f1d2b5aca999f6d23638c
2f0f2931a3a9f0866073a99be33295d76e0ecc2084918b4e11e006e4b6c834e7
36dc7c37393ee468e4efd16b9a915114943db37d5937b0beb5cd01f628a23469
39311f6d6b968abe38b00398d4b9bec6909f2eea0dd7752d43d7a5c04e63a31e
59eeda148701ab1739c450f45ebbc1abed681b4e732342b52968c478f30c0ec0
730b5f27c8524eb5c38f182a45acda474d2117b6ae6b618ba19a8b92abca4de2
8a9acfd06df7aa4e0d9d29df29573d43ed7044c5d18bc000881e7a9308016052
8c2dc3e0250176978fc0ecc2c4dca1308b65dc1e1c6847e044f81c347aed1e28
c13e46c9ea11ab54cf67940a0ee31c36756a3dfb6f31d1c1680480b858be9006
d2bfa713af9fbca6ff056c32779b923cd273a8a2f4be4ae5f9d8b5b83305a7ae
d7187aeacacd4d14c0e0b31c2d3686a10e334e61a4a8b3c64dd38aed62eba4d1
ee2a07bd37a9929e7dd189ad0c05e3eb27ea31e6ddc6beb2d6a4db5a89962441
f7a2be71742bafbf402ed941c48b981cec234709e12adc5c20bb399412799874