flourishchiken.com Open in urlscan Pro
2a06:98c1:3121::3  Malicious Activity! Public Scan

Submitted URL: https://storage.googleapis.com/pemotion/tixrin.html#/T0h5U2l6QlQzVHJoS0libzhSYmk5dGhObE8vTnZDZkhuY2JyZy9IeVVDVDFnZmZjMkd0cWZmdV...
Effective URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Submission: On October 25 via manual from ES — Scanned from ES

Summary

This website contacted 9 IPs in 5 countries across 9 domains to perform 28 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is flourishchiken.com.
TLS certificate: Issued by GTS CA 1P5 on October 20th 2022. Valid for: 3 months.
This is the only time flourishchiken.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Customer Survey Spam (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 2a00:1450:400... 15169 (GOOGLE)
1 1 163.172.113.22 12876 (Online SAS)
1 193.163.199.95 398343 (BAXET-GROUP)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
19 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2600:9000:20e... 16509 (AMAZON-02)
28 9
Apex Domain
Subdomains
Transfer
19 flourishchiken.com
flourishchiken.com
913 KB
2 lottiefiles.com
assets3.lottiefiles.com — Cisco Umbrella Rank: 144265
4 KB
2 unpkg.com
unpkg.com — Cisco Umbrella Rank: 801
90 KB
2 googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 403
fonts.googleapis.com — Cisco Umbrella Rank: 44
2 KB
1 gstatic.com
fonts.gstatic.com
18 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 677
30 KB
1 wheezepumps.com
wheezepumps.com
688 B
1 moisturizering.com
moisturizering.com
443 B
0 trk-epicurei.com Failed
trk-epicurei.com Failed
28 9
Domain Requested by
19 flourishchiken.com moisturizering.com
flourishchiken.com
2 assets3.lottiefiles.com unpkg.com
2 unpkg.com 1 redirects flourishchiken.com
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com flourishchiken.com
1 code.jquery.com flourishchiken.com
1 wheezepumps.com 1 redirects
1 moisturizering.com storage.googleapis.com
1 storage.googleapis.com
0 trk-epicurei.com Failed flourishchiken.com
28 10

This site contains no links.

Subject Issuer Validity Valid
storage.googleapis.com
GTS CA 1C3
2022-09-26 -
2022-12-19
3 months crt.sh
moisturizering.com
R3
2022-09-09 -
2022-12-08
3 months crt.sh
*.flourishchiken.com
GTS CA 1P5
2022-10-20 -
2023-01-18
3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2022-08-03 -
2023-07-14
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-09-26 -
2022-12-19
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-09-26 -
2022-12-19
3 months crt.sh
*.lottiefiles.com
Amazon
2022-09-25 -
2023-10-23
a year crt.sh

This page contains 1 frames:

Primary Page: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Frame ID: 199D16E90D3A144DCC63A409FC324A18
Requests: 28 HTTP requests in this frame

Screenshot

Page Title

Shopper Survey - We Want Your Opinion!

Page URL History Show full URLs

  1. https://storage.googleapis.com/pemotion/tixrin.html Page URL
  2. http://163.172.113.22//T0h5U2l6QlQzVHJoS0libzhSYmk5dGhObE8vTnZDZkhuY2JyZy9IeVVDVDFnZmZjMkd0cWZmdVo... HTTP 302
    https://moisturizering.com/0/0/0/eec37cca8e1afce93aba134e4e771e6c/3/32974_2/9099_33371_1560297_md Page URL
  3. https://wheezepumps.com/index2.php?s1=351432&s2=835191567&s3=1708&s4=0&ow=49&p=sp8mar9a HTTP 302
    https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

28
Requests

93 %
HTTPS

80 %
IPv6

9
Domains

10
Subdomains

9
IPs

5
Countries

1058 kB
Transfer

1461 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://storage.googleapis.com/pemotion/tixrin.html Page URL
  2. http://163.172.113.22//T0h5U2l6QlQzVHJoS0libzhSYmk5dGhObE8vTnZDZkhuY2JyZy9IeVVDVDFnZmZjMkd0cWZmdVo2T3Y1eGFrc0ZTejF0V2k4TzFQUDNZN0wrNHdSaUJ1LzF6M25lZktFcEcwd1JNMUtEbms9 HTTP 302
    https://moisturizering.com/0/0/0/eec37cca8e1afce93aba134e4e771e6c/3/32974_2/9099_33371_1560297_md Page URL
  3. https://wheezepumps.com/index2.php?s1=351432&s2=835191567&s3=1708&s4=0&ow=49&p=sp8mar9a HTTP 302
    https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://163.172.113.22//T0h5U2l6QlQzVHJoS0libzhSYmk5dGhObE8vTnZDZkhuY2JyZy9IeVVDVDFnZmZjMkd0cWZmdVo2T3Y1eGFrc0ZTejF0V2k4TzFQUDNZN0wrNHdSaUJ1LzF6M25lZktFcEcwd1JNMUtEbms9 HTTP 302
  • https://moisturizering.com/0/0/0/eec37cca8e1afce93aba134e4e771e6c/3/32974_2/9099_33371_1560297_md
Request Chain 6
  • https://unpkg.com/@lottiefiles/lottie-player@latest/dist/lottie-player.js HTTP 302
  • https://unpkg.com/@lottiefiles/lottie-player@1.6.0/dist/lottie-player.js

28 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
tixrin.html
storage.googleapis.com/pemotion/
244 B
824 B
Document
General
Full URL
https://storage.googleapis.com/pemotion/tixrin.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

accept-ranges
bytes
age
2948
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=3600
content-length
244
content-type
text/html
date
Tue, 25 Oct 2022 07:39:49 GMT
etag
"0660370f3237b0631608028758526b94"
expires
Tue, 25 Oct 2022 08:39:49 GMT
last-modified
Thu, 01 Sep 2022 18:57:52 GMT
server
UploadServer
x-goog-generation
1662058672580119
x-goog-hash
crc32c=m7XoDw== md5=BmA3DzI3sGMWCAKHWFJrlA==
x-goog-metageneration
2
x-goog-storage-class
STANDARD
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
244
x-guploader-uploadid
ADPycdug5M_0xq_eBxRJMxfbpNrhhWAD5Nyy6u4-mCKr0JnPeGckXF9E5DETLCe50-oo5DeyY3esxEFdHUZw3-1xRojr5Q
9099_33371_1560297_md
moisturizering.com/0/0/0/eec37cca8e1afce93aba134e4e771e6c/3/32974_2/
Redirect Chain
  • http://163.172.113.22//T0h5U2l6QlQzVHJoS0libzhSYmk5dGhObE8vTnZDZkhuY2JyZy9IeVVDVDFnZmZjMkd0cWZmdVo2T3Y1eGFrc0ZTejF0V2k4TzFQUDNZN0wrNHdSaUJ1LzF6M25lZktFcEcwd1JNMUtEbms9
  • https://moisturizering.com/0/0/0/eec37cca8e1afce93aba134e4e771e6c/3/32974_2/9099_33371_1560297_md
150 B
443 B
Document
General
Full URL
https://moisturizering.com/0/0/0/eec37cca8e1afce93aba134e4e771e6c/3/32974_2/9099_33371_1560297_md
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/pemotion/tixrin.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.163.199.95 , Hong Kong, ASN398343 (BAXET-GROUP, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://storage.googleapis.com/pemotion/tixrin.html#/T0h5U2l6QlQzVHJoS0libzhSYmk5dGhObE8vTnZDZkhuY2JyZy9IeVVDVDFnZmZjMkd0cWZmdVo2T3Y1eGFrc0ZTejF0V2k4TzFQUDNZN0wrNHdSaUJ1LzF6M25lZktFcEcwd1JNMUtEbms9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

content-length
150
content-type
text/html; charset=UTF-8
date
Tue, 25 Oct 2022 08:29:02 GMT
server
Apache

Redirect headers

Connection
Keep-Alive
Content-Length
163
Content-Type
text/html; charset=UTF-8
Date
Tue, 25 Oct 2022 08:28:57 GMT
Keep-Alive
timeout=5, max=100
Location
https://moisturizering.com/0/0/0/eec37cca8e1afce93aba134e4e771e6c/3/32974_2/9099_33371_1560297_md
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33
X-Powered-By
PHP/7.1.33
Primary Request /
flourishchiken.com/
Redirect Chain
  • https://wheezepumps.com/index2.php?s1=351432&s2=835191567&s3=1708&s4=0&ow=49&p=sp8mar9a
  • https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
23 KB
5 KB
Document
General
Full URL
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Requested by
Host: moisturizering.com
URL: https://moisturizering.com/0/0/0/eec37cca8e1afce93aba134e4e771e6c/3/32974_2/9099_33371_1560297_md
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa2e9439824cd25ebcb5950e6ec81321efe71f42406d8aabc896d7f344c8775f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://moisturizering.com/0/0/0/eec37cca8e1afce93aba134e4e771e6c/3/32974_2/9099_33371_1560297_md
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
75f9950d19be867e-MAD
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 25 Oct 2022 08:29:03 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fkW130QkAxSl8jG89wtjges3pJtnRKU3FNuCkOMWuE0bMxnYEgCJ2mGP8T2ALYzIZ6Fh2WVju%2BYkd%2FSff3Bym9NeE3x01Pd7JBupDbKOjUMm297GdDTr0v6is%2FVxX4vkCFfX%2BW%2FtoM6mUBDOWmeRzzg%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,User-Agent
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-cache-status
DYNAMIC
cf-ray
75f99509da2f660b-MAD
content-type
text/html; charset=UTF-8
date
Tue, 25 Oct 2022 08:29:02 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jBrUB%2Btvg8M6kZkO2T5ONh1wyHojbNAkXfVc4Cp7CZpmozXabBP2N3uSRiv14%2B72cjD2gvFnl04oG%2Bbyk%2F5YWpwFozj8ZsYm6uLYr8K0PNeupYka2YJ%2FhYpn4SqwUTDMnN9CDBHv0BvCzhAbjH4%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
User-Agent
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
style02.css
flourishchiken.com/master/css/
39 KB
7 KB
Stylesheet
General
Full URL
https://flourishchiken.com/master/css/style02.css
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b047eb5e0cfe268c1f99dc4bae3397cd2f7da38f0c543a2cad9997ce3a600a9e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Wed, 02 Sep 2020 09:26:08 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MFtDgCqZn6y5duJqhpicVEOwMLFoRK4CpL9LMCnm7k06Dif%2BrthzjafizgrM2zRE9c5y%2Bn%2BJfR0N6n7SA11A%2F9tEZNcEGSSUsO2icCfovPbQBgBrGZV9uLg0w6Ix7lQOsO0JcR2vwGgmfeei%2F8elV8g%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
75f9950fc884867e-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
jquery-3.5.1.min.js
code.jquery.com/
87 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
content-encoding
gzip
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
etag
W/"28feccc0-15d84"
vary
Accept-Encoding
x-hw
1666686543.dop003.ma1.t,1666686543.cds226.ma1.hn,1666686543.cds032.ma1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30879
datespain.js
flourishchiken.com/master/js/
979 B
759 B
Script
General
Full URL
https://flourishchiken.com/master/js/datespain.js
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca05e639c0634538ffb8a61bb72fdaff4aa01dcd0a4f8e88aaa665629e2d627d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rcn339YvWuxlZAA0kThSnKFkG3JLAITcFZsKCBkLYq0i6wGT5pUydMKo4%2BGFF15cHWyFNX269CjhG3Q7CnJaSb9VmFrMRyzxnCjYhf2%2FeD3GvVbgh8B6fnKfZAKAF7mQEOLmDFSA%2FGTVj61IxitFkvE%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
75f9950fc888867e-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
rndm_ppl_cmt_spn.js
flourishchiken.com/master/js/
0
0
Script
General
Full URL
https://flourishchiken.com/master/js/rndm_ppl_cmt_spn.js
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/html
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a0Ls7n4D6pz7sWAry3hV%2FjYpH1FpnvX7pxV4NI%2FNHWT9AoKrC1SMd6GuSORVwgTs10dnjthkuzWeGdVA9q9RkW9oe3DVWatUAsDCwyHYijSp26tDgCtFHmWRAcnBGzj6aIGDdkhLzd6colz53vnsby4%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400
cf-ray
75f9950fc88c867e-MAD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
lottie-player.js
unpkg.com/@lottiefiles/lottie-player@1.6.0/dist/
Redirect Chain
  • https://unpkg.com/@lottiefiles/lottie-player@latest/dist/lottie-player.js
  • https://unpkg.com/@lottiefiles/lottie-player@1.6.0/dist/lottie-player.js
346 KB
90 KB
Script
General
Full URL
https://unpkg.com/@lottiefiles/lottie-player@1.6.0/dist/lottie-player.js
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H2
Server
2606:4700::6810:7eaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42d1792df588dbdfd956b9ecd2f6d85d368ecd7e27ddc91adb09d984a22ed46b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
94620
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01GG49X72SZZA2N9X3MN4EEB4Y-mad
server
cloudflare
etag
W/"5664f-nL1GUo3O167x1rvVi92ydr01W9E"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75f995108bb96695-MAD

Redirect headers

date
Tue, 25 Oct 2022 08:29:03 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01GG740BV553VJY87QCNVNF8QP-mad
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
144
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
location
/@lottiefiles/lottie-player@1.6.0/dist/lottie-player.js
cache-control
public, s-maxage=600, max-age=60
cf-ray
75f995103ad46695-MAD
msg.js
flourishchiken.com/inc/
942 B
755 B
Script
General
Full URL
https://flourishchiken.com/inc/msg.js
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06c3f3452108be85c9304eb8e6fc6dc831534e12362cfd03afd47f4320f894a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 20 Oct 2022 12:25:37 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RX3Q49r%2F4wjhoq83Oj5rQIL7uEmfTN8OosT9tsy3E2Be6fTYzHlkcIzbJiBBvK9KnNqNf56SlQTALVybCdMSGaa9NGqrj7BU3wmEog%2Br6ifp8oCAjfZgIqk%2BBC8VlCH5lnR1kXKvvSSwEd4PLB7cJT4%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
75f9950fc88f867e-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
mercadona-logo.png
flourishchiken.com/master/img/
16 KB
16 KB
Image
General
Full URL
https://flourishchiken.com/master/img/mercadona-logo.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
486e297a511c94325e233c271e8454e098d136f43ecd905f230d8a7e8386ebb1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
15945
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3P4RILBl9vZNV66wU70E%2BUWzEy2iGuKLjYejuCw%2Bd2fzJAQt4crtW%2FjQ6rURtr2RULtN775He%2B2npisz6zbLg9OLB%2F62zxne7S5mVipa6G%2FBxmJOKO2hyBHsxf5NH8EIryaDAzoIyHtOPUd660w83EY%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
75f995125e62660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
rsrchlogo.png
flourishchiken.com/master/img/
7 KB
8 KB
Image
General
Full URL
https://flourishchiken.com/master/img/rsrchlogo.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
674584cb68a5f4e5522ec2f815d155dcb75bec263cabae31fb0e7f3885027fd2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
7225
x-xss-protection
1; mode=block
last-modified
Mon, 20 Jul 2020 15:52:40 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Tjk%2BcgHeboCCTNB%2B1BFBWcC42P6iTLwkXPNHSGmBZtoxUNnLU2EAFwPCQ3nT6bepEUhsgzyOwPXfQoTfchSqaDt%2B559Hb7gAdoBvu9F91qa0UgKlTydcuqiFSm1NNWZgV0H8X6lxrxhrC2hgOSuzFg%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
75f995126e96660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
mrcdngift.png
flourishchiken.com/master/img/
13 KB
14 KB
Image
General
Full URL
https://flourishchiken.com/master/img/mrcdngift.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7c6512b7f7fbe64f5277c7e4d97c1b4424a060b3130d5790deb9a35d04ce553
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
13561
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kTMfRj2I3wxr%2Fta9IkylAyfLlxtwpt8%2FdIymUdI565YKJE1iLqJZwefiT%2FHCFHsTT3cKaHxF2LGOh1ZFoqIRzQOCozXQHlfUDKCsqH80Tci1tNkqe3ybbiQNNYds7fNYEtkMqM6191G7z9AXvRpYmiU%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
75f995127e9f660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
2ebdcbbe75f2e771343491a1541c83b7.png
flourishchiken.com/master/img/
1 KB
2 KB
Image
General
Full URL
https://flourishchiken.com/master/img/2ebdcbbe75f2e771343491a1541c83b7.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
735ee02711d4d62d8cfba0c075237f227491a044441540d39f8c8203ccd54cea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1457
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5n3ZyBPpXu3ITW36pE9tKVFr3GUd8AQHN6vLK%2FCDu5csjGrfEs3Hz88NImL%2Fz7eCTL%2FOdM61IGxEf%2BKsuRrbx4o8rqzwG8IhQS7Dwzsu3yRjCsZSJfOyQt00PmpmZbJ9%2BypOV1LXIpLdnCkJ0DfIzJk%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
75f995127ea4660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
0039d2a7dcbf1a1b449884e25d738020.png
flourishchiken.com/master/img/
646 B
1 KB
Image
General
Full URL
https://flourishchiken.com/master/img/0039d2a7dcbf1a1b449884e25d738020.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8fccb5c96c54856548fbad584f0e41f72313b94b33ec32d328985b3267f4035e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
646
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mug5hVp7whExgpjXqLhHxNdYtsCYrOpS0qKBeaKHv1Nn8zzKGwzDWREa6IdoCIiwIelHypudTCfo8zUiX7AiBoMkTuq0eCaIFV7wCybGpL8mdhVewEDRIu9FUePNrWn64G4EL1KSjf2t%2B9%2B9smVUS4Y%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
75f995127ea7660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
image.php
flourishchiken.com/
26 KB
26 KB
Image
General
Full URL
https://flourishchiken.com/image.php?img=images/products_image/iphone12blue.jpg
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
254fdfed87e8fa5f6c78841bc80e8062c264c435253a981113fdcc60c7884e23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:04 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
User-Agent, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/pjpeg
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nsm6gCtXgbeCOSWzAQfBOQ83rXGrp%2FDAD51Ut7mGTtD8YEbF7lFDpwiplF4VJoqt246SRLdIZGPWSQ68EC79V45s2kIEw7qceoubUmH1NyypSVLRL%2FHFTBpKrF8lYkbevNXuHSufGQl1BqVVFHedVuc%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
75f995127ea9660b-MAD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
9227ed9e10072ce0bac69dc54109221b.png
flourishchiken.com/master/img/
1 KB
2 KB
Image
General
Full URL
https://flourishchiken.com/master/img/9227ed9e10072ce0bac69dc54109221b.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ea6b093885ce53036c4b381a1ce1496d53029b9a205fe9471666022efde5d8f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1172
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9GwC0Sb4VesWsT05vi2THA066ddqDDrD7BKZxAyjLO9RH96jhn5DmTQzShMbNbThT2JC8njKT2CGQQfgLOUfVJfr4GZ2RhlTGRxgIdEV%2BW9fJnHpqYH%2BqL42EPC6L26a8CKJlcSZNIAZT3cvm6uKv0c%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
75f995127eac660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
image.php
flourishchiken.com/
320 KB
321 KB
Image
General
Full URL
https://flourishchiken.com/image.php?img=images/products_image/s21.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d41d76bb2c632bda86ac1dc43b359eb4dfd6e78a2dc647ca827936b195d3588
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:04 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
User-Agent, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k%2BC4tqSresyTCP44oK%2BOL1v4AR1VnijmWYNdVdFonUNU6XgP9XXcBWgH2VhDLZfff7F9mzUGSbc%2BohBPRjVfFARanHw8kEHMvhYIQD9%2Bw1svJeemS32IHRxAB7iMSROGbEQvQBoe5tl4u62%2FeRknKsE%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
75f995127eae660b-MAD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
expires
Tue, 01 Nov 2022 08:29:04 GMT
image.php
flourishchiken.com/
496 KB
497 KB
Image
General
Full URL
https://flourishchiken.com/image.php?img=images/products_image/macbookpro.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2567cac503d7a1e8508fa6d5d50427c36f8ba5b7af76f7164f625e9ca025d86
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:04 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
User-Agent, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9rUSUDuuSZ62yX2s3p73Jkf9vfRbagaEJFC7QbxgjMQaysyzdmGihQUJvH%2BplFCc4z8Yl4ox%2BhjAWjmjgNE8qo03qszwGqPgIvt5ygAfSlk3rspkoH%2B%2BLIoUEBDSQli2%2BhuCgN5MljBLLtjqP79sHTo%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
75f995127eb1660b-MAD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
expires
Tue, 01 Nov 2022 08:29:04 GMT
bcf7f117acc460e9148a3031c5b6c4e4.png
flourishchiken.com/master/img/
4 KB
4 KB
Image
General
Full URL
https://flourishchiken.com/master/img/bcf7f117acc460e9148a3031c5b6c4e4.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597fb65af1d452e7346e3d24adead2908ddf2c3bae4a6ae5c4e7440e33bd39b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3947
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cf6F3do1REquluOtGKJqJgg%2FLO3%2FDDFLdIF8j59AfgwN7PFP7FPaH2xcADGuAxpnFBIxyL70A5TxwvGlxCIrTK8vrV39d2U%2BFR52iILTLA%2BvIPHs09U0YySSkVQnw43SofiOL5A3UdnOYr6KrzOrKoc%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
75f995127eb5660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
x.png
flourishchiken.com/master/img/
5 KB
6 KB
Image
General
Full URL
https://flourishchiken.com/master/img/x.png
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5389
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ei0Lv2deeuW0FLm6JKQNESJ%2FxnuTsw4AoVIjZn9UHLzl4YC9SqbeR6qv%2FnLLSX5gmumFlKIYQZvrqyRc4bkCEzC%2FQhUmCL3PBWfowI8ve13NMZvG3W%2BZWMitZvIIQx7z2Baik3GK%2BIC85bfT7DfjSJY%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
75f995127eb7660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
q_mrcdn.js
flourishchiken.com/master/js/
9 KB
2 KB
Script
General
Full URL
https://flourishchiken.com/master/js/q_mrcdn.js
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
451a36a2d5749c33dedc3d61b74dd4c4dd1f54cbf97c86e492388c7b632e03c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GsX2WcNNin48IJ7BpBCJKNCu4xgDCuwYXPJWXORdvdU5KlqxQ5SsGK1TT4qYd9pK2XfaaUvE3qmaZy%2B4UvBh8YJvUr4LkT1jErEntT%2BS8FBb6i9l7m%2F1QflHBeC7%2BizlFnTr%2FcI8v5cUBde6YF4puXg%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
75f995119c6a660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
timer.js
flourishchiken.com/master/js/
619 B
792 B
Script
General
Full URL
https://flourishchiken.com/master/js/timer.js
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
204d5a3538e51529f2c2cc56c90c4023cb0bbad4bd03e9c116cbcfffd616952b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GO7kCpgwpqCL58fqT32K5cBzq7MjtPPokeFuAYad4csnD7VwRe3Q8uwbRh8PhwMb0prLdvyCVqDymhEul3BiQ%2FLj0rhfb8XTaKGdsuN%2BlljBYPX%2FhnSzB0sCJT9DTtjUcJ3Mscb1jTbneOZygZnFSiA%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
75f99511ed20660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
modal.js
flourishchiken.com/master/js/
673 B
760 B
Script
General
Full URL
https://flourishchiken.com/master/js/modal.js
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a421e3d21b620b2df12e22230e89290da9ed22a3245ab3ce6de31a6a2a661d6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 08:29:03 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
231247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 02 Jun 2020 16:41:27 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=keJwQ2a7PWFegty1Pe%2BB65oW%2BhIFxslqDJYE28aRCGLNO4wwbY6w%2F8iSdN4%2B7HMYsXDWx9wr%2BeEOTJNfUB8XQJq1R%2Ff6AOFNOU05f8B8i%2Bjf4u%2BNH1Zk0cTc1PI64hRAgMsL%2FD0v6L2UyvxB1y2lsYA%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
75f995122dca660b-MAD
expires
Sat, 29 Oct 2022 16:14:56 GMT
css2
fonts.googleapis.com/
5 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Arimo:wght@400;700&display=swap
Requested by
Host: flourishchiken.com
URL: https://flourishchiken.com/master/css/style02.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
8affc1a9a7084dd005ccc72ebc78e99a912e7fe7820025024bbb17a250c5fb44
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 25 Oct 2022 08:29:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 25 Oct 2022 08:16:31 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 25 Oct 2022 08:29:03 GMT
v9e118mez8
trk-epicurei.com/scripts/push/
0
0

P5sMzZCDf9_T_10ZxCE.woff2
fonts.gstatic.com/s/arimo/v27/
18 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/arimo/v27/P5sMzZCDf9_T_10ZxCE.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Arimo:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1ff84f1e03eb15dedc4668f0817372b734934076bc936e12c5c0bd3944dab0c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://flourishchiken.com
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Wed, 19 Oct 2022 21:03:40 GMT
x-content-type-options
nosniff
age
473123
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18260
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 21:03:24 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 19 Oct 2023 21:03:40 GMT
lf20_NxuRdg.json
assets3.lottiefiles.com/temp/
20 KB
2 KB
XHR
General
Full URL
https://assets3.lottiefiles.com/temp/lf20_NxuRdg.json
Requested by
Host: unpkg.com
URL: https://unpkg.com/@lottiefiles/lottie-player@latest/dist/lottie-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:1a00:2:49a2:4500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
30abbcea5f8fb2a97caae4dd9368cfe177ab288bbc0e90437cfec4cf231f31af

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
XpGQn9jTqdCH_09IHXy3AQYee1_F_s91
content-encoding
br
via
1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
date
Tue, 25 Oct 2022 08:29:05 GMT
x-amz-cf-pop
FRA2-C1
x-cache
RefreshHit from cloudfront
last-modified
Wed, 03 Apr 2019 15:01:36 GMT
server
AmazonS3
etag
W/"1b4e549cdda1e3a3e3f75846ec48beea"
access-control-max-age
1800
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=315360000
vary
Accept-Encoding,Origin
x-amz-cf-id
92BdPeWZnwAs1tcubyddsa5V7jH19SR8304wq5nKd-guFp_JafDlow==
lf20_NxuRdg.json
assets3.lottiefiles.com/temp/
20 KB
2 KB
Fetch
General
Full URL
https://assets3.lottiefiles.com/temp/lf20_NxuRdg.json
Requested by
Host: unpkg.com
URL: https://unpkg.com/@lottiefiles/lottie-player@latest/dist/lottie-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:1a00:2:49a2:4500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
30abbcea5f8fb2a97caae4dd9368cfe177ab288bbc0e90437cfec4cf231f31af

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://flourishchiken.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id
XpGQn9jTqdCH_09IHXy3AQYee1_F_s91
content-encoding
br
via
1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
date
Tue, 25 Oct 2022 08:29:05 GMT
x-amz-cf-pop
FRA2-C1
x-cache
Hit from cloudfront
last-modified
Wed, 03 Apr 2019 15:01:36 GMT
server
AmazonS3
etag
W/"1b4e549cdda1e3a3e3f75846ec48beea"
access-control-max-age
1800
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=315360000
vary
Accept-Encoding,Origin
x-amz-cf-id
HoROX1-zSmXy8HzerfGIXty4gMPwVHMQ5ryLzsNxVxipE5TrWIivfQ==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
trk-epicurei.com
URL
https://trk-epicurei.com/scripts/push/v9e118mez8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Customer Survey Spam (Consumer)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| asdf function| datehax object| lottie-player object| reactiveElementVersions object| litHtmlVersions object| litElementVersions function| replaceUrlParam object| MYCALL string| s1 string| s2 string| esource string| pshpub string| pshdomain function| nextQuestion function| drawszlider function| selectReward function| showModal object| comments number| slidewhere number| holvanszlider function| startTimer

3 Cookies

Domain/Path Name / Value
moisturizering.com/ Name: uid1708
Value: 835191567-20221025042902-f746fb40609983a1036c2c49f8a42474-0
wheezepumps.com/ Name: PHPSESSID
Value: 24a15958a12a1aeeb70f1c85c649e1e8
flourishchiken.com/ Name: PHPSESSID
Value: 499f98219808ba06a90411f7e77d12ce

2 Console Messages

Source Level URL
Text
network error URL: https://flourishchiken.com/master/js/rndm_ppl_cmt_spn.js
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: https://flourishchiken.com/?d1ff91a7b5277e8ebc19877edc751ec3
Message:
Refused to execute script from 'https://flourishchiken.com/master/js/rndm_ppl_cmt_spn.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets3.lottiefiles.com
code.jquery.com
flourishchiken.com
fonts.googleapis.com
fonts.gstatic.com
moisturizering.com
storage.googleapis.com
trk-epicurei.com
unpkg.com
wheezepumps.com
trk-epicurei.com
163.172.113.22
193.163.199.95
2001:4de0:ac18::1:a:2a
2600:9000:20eb:1a00:2:49a2:4500:93a1
2606:4700:3030::ac43:9d6d
2606:4700::6810:7eaf
2a00:1450:4001:800::2003
2a00:1450:4001:827::2010
2a00:1450:4001:829::200a
2a06:98c1:3121::3
06c3f3452108be85c9304eb8e6fc6dc831534e12362cfd03afd47f4320f894a3
1ff84f1e03eb15dedc4668f0817372b734934076bc936e12c5c0bd3944dab0c0
204d5a3538e51529f2c2cc56c90c4023cb0bbad4bd03e9c116cbcfffd616952b
254fdfed87e8fa5f6c78841bc80e8062c264c435253a981113fdcc60c7884e23
2ea6b093885ce53036c4b381a1ce1496d53029b9a205fe9471666022efde5d8f
30abbcea5f8fb2a97caae4dd9368cfe177ab288bbc0e90437cfec4cf231f31af
42d1792df588dbdfd956b9ecd2f6d85d368ecd7e27ddc91adb09d984a22ed46b
451a36a2d5749c33dedc3d61b74dd4c4dd1f54cbf97c86e492388c7b632e03c0
486e297a511c94325e233c271e8454e098d136f43ecd905f230d8a7e8386ebb1
4d41d76bb2c632bda86ac1dc43b359eb4dfd6e78a2dc647ca827936b195d3588
597fb65af1d452e7346e3d24adead2908ddf2c3bae4a6ae5c4e7440e33bd39b4
674584cb68a5f4e5522ec2f815d155dcb75bec263cabae31fb0e7f3885027fd2
735ee02711d4d62d8cfba0c075237f227491a044441540d39f8c8203ccd54cea
8affc1a9a7084dd005ccc72ebc78e99a912e7fe7820025024bbb17a250c5fb44
8fccb5c96c54856548fbad584f0e41f72313b94b33ec32d328985b3267f4035e
a421e3d21b620b2df12e22230e89290da9ed22a3245ab3ce6de31a6a2a661d6e
a7c6512b7f7fbe64f5277c7e4d97c1b4424a060b3130d5790deb9a35d04ce553
b047eb5e0cfe268c1f99dc4bae3397cd2f7da38f0c543a2cad9997ce3a600a9e
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
ca05e639c0634538ffb8a61bb72fdaff4aa01dcd0a4f8e88aaa665629e2d627d
d2567cac503d7a1e8508fa6d5d50427c36f8ba5b7af76f7164f625e9ca025d86
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa2e9439824cd25ebcb5950e6ec81321efe71f42406d8aabc896d7f344c8775f