URL: https://ark-invests.net/
Submission Tags: https://phish.report @phish_report Search All
Submission: On February 08 via api from FI — Scanned from FI

Summary

This website contacted 9 IPs in 6 countries across 6 domains to perform 27 HTTP transactions. The main IP is 193.233.234.5, located in Russian Federation and belongs to SERVER4-AS, RU. The main domain is ark-invests.net.
TLS certificate: Issued by R3 on February 3rd 2023. Valid for: 3 months.
This is the only time ark-invests.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange)

Community Verdicts: Malicious1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
16 193.233.234.5 210352 (SERVER4-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:6ea0:cb0... 60068 (CDN77 ^_^)
1 3.123.238.23 16509 (AMAZON-02)
4 2a02:6ea0:f40... 60068 (CDN77 ^_^)
1 2a02:6ea0:c70... 60068 (CDN77 ^_^)
27 9
Apex Domain
Subdomains
Transfer
16 ark-invests.net
ark-invests.net
928 KB
5 smartsuppcdn.com
widget-v2.smartsuppcdn.com — Cisco Umbrella Rank: 47757
translations.smartsuppcdn.com — Cisco Umbrella Rank: 52156
193 KB
2 smartsuppchat.com
www.smartsuppchat.com — Cisco Umbrella Rank: 48027
bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 43307
6 KB
1 gstatic.com
fonts.gstatic.com
27 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 687
30 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 32
1 KB
27 6
Domain Requested by
16 ark-invests.net ark-invests.net
code.jquery.com
4 widget-v2.smartsuppcdn.com www.smartsuppchat.com
1 translations.smartsuppcdn.com widget-v2.smartsuppcdn.com
1 bootstrap.smartsuppchat.com www.smartsuppchat.com
1 www.smartsuppchat.com ark-invests.net
1 fonts.gstatic.com fonts.googleapis.com
1 code.jquery.com ark-invests.net
1 fonts.googleapis.com ark-invests.net
27 8

This site contains no links.

Subject Issuer Validity Valid
ark-invests.net
R3
2023-02-03 -
2023-05-04
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-01-31 -
2023-04-25
3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2022-08-03 -
2023-07-14
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-01-09 -
2023-04-03
3 months crt.sh
*.smartsuppchat.com
RapidSSL Global TLS RSA4096 SHA256 2022 CA1
2022-11-30 -
2023-12-29
a year crt.sh
*.smartsuppcdn.com
RapidSSL Global TLS RSA4096 SHA256 2022 CA1
2022-10-19 -
2023-11-19
a year crt.sh

This page contains 2 frames:

Primary Page: https://ark-invests.net/
Frame ID: 1FC993AAB77125CDE9D56D87A40B1561
Requests: 25 HTTP requests in this frame

Frame: https://widget-v2.smartsuppcdn.com/static/js/runtime-main.f3d23b3d.js
Frame ID: 33E75EE60B2D8617CF67574267B43614
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Biggest giveaway CRYPTO of $100,000,000

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

27
Requests

96 %
HTTPS

75 %
IPv6

6
Domains

8
Subdomains

9
IPs

6
Countries

1186 kB
Transfer

2427 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ark-invests.net/
32 KB
10 KB
Document
General
Full URL
https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
9a467b969975aaff468c972c3cfe50258a839938d3c1353832ef51d169ba655b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 08 Feb 2023 09:24:03 GMT
server
nginx/1.14.2
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
style.css
ark-invests.net/css/
15 KB
16 KB
Stylesheet
General
Full URL
https://ark-invests.net/css/style.css
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
1486c23b32516e7cb26dcb6fd0867637152f36d3086ed1698fb77fe4e37b78ec
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:40:05 GMT
server
nginx/1.14.2
etag
"6270a415-3ddd"
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
content-length
15837
css2
fonts.googleapis.com/
8 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Mulish:wght@400;500;600;700;800&display=swap
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
bd38ee1b1bd999c41c9abc88948ca65857a2e14bcffbf3cf025077e41ef2e8aa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 08 Feb 2023 09:24:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 08 Feb 2023 09:23:18 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 08 Feb 2023 09:24:03 GMT
logo.png
ark-invests.net/images/
17 KB
17 KB
Image
General
Full URL
https://ark-invests.net/images/logo.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
22efa82fcb41ff5267224258f85bdcc560022dd755073107485ea9d30cf48df0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:40:36 GMT
server
nginx/1.14.2
etag
"6270a434-435d"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
17245
bage.png
ark-invests.net/images/
2 KB
2 KB
Image
General
Full URL
https://ark-invests.net/images/bage.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
af08796abd9d689f3aa32ad614bae264334e80972ae8af3f782969a9908c81ab
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:40:16 GMT
server
nginx/1.14.2
etag
"6270a420-86e"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
2158
qr.png
ark-invests.net/images/
3 KB
3 KB
Image
General
Full URL
https://ark-invests.net/images/qr.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
19482e138ba46250066a3cc5281c9b944f5a108c1969ea7c322e12a87694f53f
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:40:53 GMT
server
nginx/1.14.2
etag
"6270a445-a38"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
2616
creator.png
ark-invests.net/images/
834 KB
835 KB
Image
General
Full URL
https://ark-invests.net/images/creator.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
87c63ff1ca5191f3aa30f9dd77fef8b7775504a7b1a42485777c336c7ea2dcd8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:41:16 GMT
server
nginx/1.14.2
etag
"6270a45c-d0885"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
854149
wallet.png
ark-invests.net/images/
3 KB
4 KB
Image
General
Full URL
https://ark-invests.net/images/wallet.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
6e9eda9a7e10b91f9eb6017e474e0bd36bbb24f1fe83072b57c228f549de72e9
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:41:16 GMT
server
nginx/1.14.2
etag
"6270a45c-d58"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
3416
transfer.png
ark-invests.net/images/
3 KB
3 KB
Image
General
Full URL
https://ark-invests.net/images/transfer.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
e7360b1f0c43286ed05afbe1c1199e8d5ecbca6073348436f54f306f89365149
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:41:16 GMT
server
nginx/1.14.2
etag
"6270a45c-c93"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
3219
checkmark.png
ark-invests.net/images/
3 KB
3 KB
Image
General
Full URL
https://ark-invests.net/images/checkmark.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
250afefa520b3aae218720489ecd43f14770a6e6fcfe766a0b1b57a6bfc54445
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:40:18 GMT
server
nginx/1.14.2
etag
"6270a422-d23"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
3363
bonus.png
ark-invests.net/images/
3 KB
3 KB
Image
General
Full URL
https://ark-invests.net/images/bonus.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
c1b2572637ca424dabac0c3d8db6daa51845a2c3795706e35deced316df50557
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:40:16 GMT
server
nginx/1.14.2
etag
"6270a420-b07"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
2823
popper.png
ark-invests.net/images/
25 KB
25 KB
Image
General
Full URL
https://ark-invests.net/images/popper.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
7de5ea62067ff095bb447c068dd04ba536e7939675ff3dee11251b303c0f99b4
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:40:54 GMT
server
nginx/1.14.2
etag
"6270a446-6385"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
25477
jquery-3.6.0.min.js
code.jquery.com/
87 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-15d9d"
vary
Accept-Encoding
x-hw
1675848243.dop068.sk1.t,1675848243.cds205.sk1.hn,1675848243.cds210.sk1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30875
main.js
ark-invests.net/js/
4 KB
4 KB
Script
General
Full URL
https://ark-invests.net/js/main.js
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
f248f57b305d704e334d7ab41387a1fcb7bcf1fa4cf511c2bcd5c89acf8165bc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:55:54 GMT
server
nginx/1.14.2
etag
"6270a7ca-f42"
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
content-length
3906
truncated
/
941 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0a9df1f511fa67348c990b9fac842820391187da222427d1d9f033ea22e43bc9

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/
919 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b87c46af04ddea1f8e93820468c9185beec36ecc6de92d7c3e6f00657a677027

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Content-Type
image/gif
background.png
ark-invests.net/images/
432 KB
0
Image
General
Full URL
https://ark-invests.net/images/background.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/css/style.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:40:57 GMT
server
nginx/1.14.2
etag
"6270a449-b33d9"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
734169
background2.png
ark-invests.net/images/
256 KB
0
Image
General
Full URL
https://ark-invests.net/images/background2.png
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/css/style.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:41:07 GMT
server
nginx/1.14.2
etag
"6270a453-b1c21"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
728097
eth.svg
ark-invests.net/fonts/
804 B
1012 B
Image
General
Full URL
https://ark-invests.net/fonts/eth.svg
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/css/style.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
4eb940bcb10d3a139b2f32e1a5a93465aae791a99aabc99a1ebc550b38f019c4
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:40:07 GMT
server
nginx/1.14.2
etag
"6270a417-324"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
content-length
804
1Ptvg83HX_SGhgqk3wot.woff2
fonts.gstatic.com/s/mulish/v12/
27 KB
27 KB
Font
General
Full URL
https://fonts.gstatic.com/s/mulish/v12/1Ptvg83HX_SGhgqk3wot.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Mulish:wght@400;500;600;700;800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8da72dacca3725d500bc789e5f506c76367804eecc46c4249ce0ff822d7a147e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://ark-invests.net
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 15:21:36 GMT
x-content-type-options
nosniff
age
64947
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
27428
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 18:57:51 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 07 Feb 2024 15:21:36 GMT
loader.js
www.smartsuppchat.com/
19 KB
6 KB
Script
General
Full URL
https://www.smartsuppchat.com/loader.js?
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:cb00::2 , United Kingdom, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
827004400366298b1c2019b75c57558f2d1618bc0b27bbd2b8e03df251cfc3db

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-77-nzt
Abm0DAb5eUL/GgAAAA
x-accel-expires
@1675848278
date
Wed, 08 Feb 2023 09:24:04 GMT
x-77-pop
viennaAT
content-encoding
gzip
last-modified
Wed, 28 Dec 2022 13:18:33 GMT
server
CDN77-Turbo
etag
W/"63ac4229-4b9b"
x-77-nzt-ray
fefc880dfdb535e1346ae363223dc901
x-cache
HIT
content-type
application/javascript
x-77-cache
HIT
cache-control
max-age=300, public, s-maxage=60
x-age
26
expires
Wed, 28 Dec 2022 13:26:14 GMT
action.php
ark-invests.net/
0
0

check.svg
ark-invests.net/images/
552 B
760 B
Image
General
Full URL
https://ark-invests.net/images/check.svg
Requested by
Host: ark-invests.net
URL: https://ark-invests.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.233.234.5 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
991853dfc8a9360aa875d125a527eb498db0c834446f9b18d0a03385989ff9c5
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://ark-invests.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Wed, 08 Feb 2023 09:24:03 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Tue, 03 May 2022 03:44:16 GMT
server
nginx/1.14.2
etag
"6270a510-228"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
content-length
552
af6ff79b645a62a13dd8e334c70d91d223e1ac33.json
bootstrap.smartsuppchat.com/widget/
1 KB
698 B
XHR
General
Full URL
https://bootstrap.smartsuppchat.com/widget/af6ff79b645a62a13dd8e334c70d91d223e1ac33.json
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.123.238.23 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-123-238-23.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
c507dbea5854797674a3f36b39b29ab7b8514cc562c228035824d947c33ea732

Request headers

Referer
https://ark-invests.net/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type
text/plain

Response headers

x-version
53ea911f61896be6992922257e82b4783f6cf210
date
Wed, 08 Feb 2023 09:24:04 GMT
content-encoding
br
x-hit
redis
etag
"491-ypb9mhZzNWnAO+qg/LGhAAcJ/UU"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0, must-revalidate
asset-manifest.json
widget-v2.smartsuppcdn.com/
2 KB
761 B
XHR
General
Full URL
https://widget-v2.smartsuppcdn.com/asset-manifest.json
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:f400::4 Zagreb, Croatia, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
4ed77c10a807e960cf6bdba12b47383985559d74ee8d13349bbb936cfdd15004

Request headers

Referer
https://ark-invests.net/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type
text/plain

Response headers

x-77-pop
zagrebHR
date
Wed, 08 Feb 2023 09:24:04 GMT
content-encoding
gzip
x-cache
HIT
x-77-cache
HIT
x-age
48
x-77-nzt
AamW8oqKnK//MAAAAA
x-accel-expires
@1675848256
last-modified
Tue, 17 Jan 2023 07:36:57 GMT
server
CDN77-Turbo
etag
W/"63c65019-6ce"
x-77-nzt-ray
bcd92b1f7e50db47346ae3633e398c1f
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=300, public, s-maxage=60
expires
Tue, 17 Jan 2023 09:23:56 GMT
runtime-main.f3d23b3d.js
widget-v2.smartsuppcdn.com/static/js/ Frame 33E7
2 KB
2 KB
Script
General
Full URL
https://widget-v2.smartsuppcdn.com/static/js/runtime-main.f3d23b3d.js
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:f400::4 Zagreb, Croatia, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
b3d88c6be6776be61a3ffa5ec8cb7d865dbca46273310e8cef0e2830d63b57ba

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-77-pop
zagrebHR
date
Wed, 08 Feb 2023 09:24:04 GMT
content-encoding
gzip
x-cache
HIT
x-77-cache
HIT
x-age
1901107
x-77-nzt
AamW8oodH9j/MwIdAA
x-accel-expires
@1705483137
last-modified
Tue, 17 Jan 2023 07:36:57 GMT
server
CDN77-Turbo
etag
W/"63c65019-9bd"
x-77-nzt-ray
bcd92b1f7e500148346ae3635e209e2d
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable
expires
Wed, 17 Jan 2024 09:18:57 GMT
6.84dd967b.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame 33E7
524 KB
159 KB
Script
General
Full URL
https://widget-v2.smartsuppcdn.com/static/js/6.84dd967b.chunk.js
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:f400::4 Zagreb, Croatia, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
9958eb02df29370898c5e5103246bda1e1d71ac75baf8fa4fab4c1697c4f28b3

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-77-pop
zagrebHR
date
Wed, 08 Feb 2023 09:24:04 GMT
content-encoding
gzip
x-cache
HIT
x-77-cache
HIT
x-age
1901107
x-77-nzt
AamW8oqNclf/MwIdAA
x-accel-expires
@1705483137
last-modified
Tue, 17 Jan 2023 07:36:57 GMT
server
CDN77-Turbo
etag
W/"63c65019-8312d"
x-77-nzt-ray
bcd92b1f7e500148346ae36308dba42d
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable
expires
Wed, 17 Jan 2024 09:18:57 GMT
main.a3c0c1de.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame 33E7
115 KB
29 KB
Script
General
Full URL
https://widget-v2.smartsuppcdn.com/static/js/main.a3c0c1de.chunk.js
Requested by
Host: www.smartsuppchat.com
URL: https://www.smartsuppchat.com/loader.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:f400::4 Zagreb, Croatia, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
5f6bf6b99ae034198d13d88b6516d9a1f3bf87560b731b1ec3f83ff5aab875d3

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-77-pop
zagrebHR
date
Wed, 08 Feb 2023 09:24:04 GMT
content-encoding
gzip
x-cache
HIT
x-77-cache
HIT
x-age
1901107
x-77-nzt
AamW8ooYl5//MwIdAA
x-accel-expires
@1705483137
last-modified
Tue, 17 Jan 2023 07:36:57 GMT
server
CDN77-Turbo
etag
W/"63c65019-1cc88"
x-77-nzt-ray
bcd92b1f7e500148346ae36326d7ec2d
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable
expires
Wed, 17 Jan 2024 09:18:57 GMT
defaults
translations.smartsuppcdn.com/api/v1/widget/translations/lang/en/ Frame 33E7
5 KB
2 KB
Fetch
General
Full URL
https://translations.smartsuppcdn.com/api/v1/widget/translations/lang/en/defaults
Requested by
Host: widget-v2.smartsuppcdn.com
URL: https://widget-v2.smartsuppcdn.com/static/js/6.84dd967b.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
3461dccf5c38f49731966b75ab09d13442fba2aecdc5844d84db6e2290f8468e

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-77-pop
frankfurtDE
x-version
78e493457cacc39802378b86cc0dd22811aade7e
date
Wed, 08 Feb 2023 09:24:05 GMT
content-encoding
gzip
x-cache
HIT
x-77-cache
HIT
x-age
86
x-response-time
0ms
x-77-nzt
AcO1rgUFHyD/VgAAAA
x-accel-expires
@1675848759
server
CDN77-Turbo
x-77-nzt-ray
25b02131fe50c72f356ae363117dc623
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=600

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ark-invests.net
URL
https://ark-invests.net/action.php

Verdicts & Comments Add Verdict or Comment


Malicious page.url
Submitted on February 8th 2023, 9:27:33 am UTC — From Japan

Threats: Phishing Scam
Comment: A crypto investment phishing scam site, disguising the party with a fake event, promoted through YouTube live streaming video QR or hosted chat  - https://pin.ski/3DRFxHD

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| oncontentvisibilityautostatechange object| CDATA function| $ function| jQuery function| round function| copy_wallet function| copyDivToClipboardEth function| copyDivToClipboardBtc function| calculate object| _smartsupp function| shelter_0x42254b function| shelter_0x18ee6d number| height number| width function| shelter_0x3d0b function| shelter_0x4a55 function| shelter_0x30b9 undefined| jToolKit undefined| scrsize function| copy function| detect function| smartsupp number| colorDepth boolean| SMARTSUPP_LOADED object| $smartsupp

2 Cookies

Domain/Path Name / Value
ark-invests.net/ Name: ssupp.vid
Value: vi_8ek0a8dhtC
ark-invests.net/ Name: ssupp.visits
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ark-invests.net
bootstrap.smartsuppchat.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
translations.smartsuppcdn.com
widget-v2.smartsuppcdn.com
www.smartsuppchat.com
ark-invests.net
193.233.234.5
2001:4de0:ac18::1:a:2b
2a00:1450:4001:82a::200a
2a00:1450:400d:80a::2003
2a02:6ea0:c700::11
2a02:6ea0:cb00::2
2a02:6ea0:f400::4
3.123.238.23
0a9df1f511fa67348c990b9fac842820391187da222427d1d9f033ea22e43bc9
1486c23b32516e7cb26dcb6fd0867637152f36d3086ed1698fb77fe4e37b78ec
19482e138ba46250066a3cc5281c9b944f5a108c1969ea7c322e12a87694f53f
22efa82fcb41ff5267224258f85bdcc560022dd755073107485ea9d30cf48df0
250afefa520b3aae218720489ecd43f14770a6e6fcfe766a0b1b57a6bfc54445
3461dccf5c38f49731966b75ab09d13442fba2aecdc5844d84db6e2290f8468e
4eb940bcb10d3a139b2f32e1a5a93465aae791a99aabc99a1ebc550b38f019c4
4ed77c10a807e960cf6bdba12b47383985559d74ee8d13349bbb936cfdd15004
5f6bf6b99ae034198d13d88b6516d9a1f3bf87560b731b1ec3f83ff5aab875d3
6e9eda9a7e10b91f9eb6017e474e0bd36bbb24f1fe83072b57c228f549de72e9
7de5ea62067ff095bb447c068dd04ba536e7939675ff3dee11251b303c0f99b4
827004400366298b1c2019b75c57558f2d1618bc0b27bbd2b8e03df251cfc3db
87c63ff1ca5191f3aa30f9dd77fef8b7775504a7b1a42485777c336c7ea2dcd8
8da72dacca3725d500bc789e5f506c76367804eecc46c4249ce0ff822d7a147e
991853dfc8a9360aa875d125a527eb498db0c834446f9b18d0a03385989ff9c5
9958eb02df29370898c5e5103246bda1e1d71ac75baf8fa4fab4c1697c4f28b3
9a467b969975aaff468c972c3cfe50258a839938d3c1353832ef51d169ba655b
af08796abd9d689f3aa32ad614bae264334e80972ae8af3f782969a9908c81ab
b3d88c6be6776be61a3ffa5ec8cb7d865dbca46273310e8cef0e2830d63b57ba
b87c46af04ddea1f8e93820468c9185beec36ecc6de92d7c3e6f00657a677027
bd38ee1b1bd999c41c9abc88948ca65857a2e14bcffbf3cf025077e41ef2e8aa
c1b2572637ca424dabac0c3d8db6daa51845a2c3795706e35deced316df50557
c507dbea5854797674a3f36b39b29ab7b8514cc562c228035824d947c33ea732
e7360b1f0c43286ed05afbe1c1199e8d5ecbca6073348436f54f306f89365149
f248f57b305d704e334d7ab41387a1fcb7bcf1fa4cf511c2bcd5c89acf8165bc
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e