www.agora-solucoesregistros.com Open in urlscan Pro
20.127.87.163  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://fatura-rrrenner.blogspot.com/?m=2 Page URL
2. https://www.agora-solucoesregistros.com/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ fatura-rrrenner.blogspot.com/	85 KB 14 KB	292ms 220ms	Document text/html	2a00:1450:4001:82f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fatura-rrrenner.blogspot.com/?m=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html; charset=UTF-8 expires Wed, 09 Mar 2022 12:16:22 GMT date Wed, 09 Mar 2022 12:16:22 GMT cache-control private, max-age=0 last-modified Wed, 09 Mar 2022 01:34:17 GMT etag W/"bbd636207bc30f82c073acf240a2922b27c25cab7d757db8bfcaf99e205dc954" content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 14204 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	1601750677-blog_controls.css www.blogger.com/static/v1/v-css/	657 B 772 B	66ms 19ms	Stylesheet text/css	2a00:1450:4001:82b::2009 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.blogger.com/static/v1/v-css/1601750677-blog_controls.css Requested by Host: fatura-rrrenner.blogspot.com URL: https://fatura-rrrenner.blogspot.com/?m=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fatura-rrrenner.blogspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Mon, 07 Mar 2022 14:52:56 GMT x-content-type-options nosniff age 163406 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 657 x-xss-protection 0 last-modified Mon, 07 Mar 2022 07:53:27 GMT server sffe vary Accept-Encoding report-to {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="blogger-tech" expires Tue, 07 Mar 2023 14:52:56 GMT
GET H2	200	authorization.css www.blogger.com/dyn-css/	1 B 684 B	160ms 114ms	Stylesheet text/css	2a00:1450:4001:82b::2009 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.blogger.com/dyn-css/authorization.css?targetBlogID=6929354733781707669&zx=fa1b1526-1640-498d-b5aa-850f521693bd Requested by Host: fatura-rrrenner.blogspot.com URL: https://fatura-rrrenner.blogspot.com/?m=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://fatura-rrrenner.blogspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache content-security-policy script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport content-encoding gzip x-content-type-options nosniff last-modified Wed, 09 Mar 2022 12:16:22 GMT server GSE date Wed, 09 Mar 2022 12:16:22 GMT x-frame-options SAMEORIGIN p3p CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." cache-control no-cache, no-store, max-age=0, must-revalidate content-type text/css; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21 x-xss-protection 1; mode=block expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	3334278262-classic.css www.blogger.com/static/v1/v-css/navbar/	871 B 941 B	64ms 18ms	Stylesheet text/css	2a00:1450:4001:82b::2009 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.blogger.com/static/v1/v-css/navbar/3334278262-classic.css Requested by Host: fatura-rrrenner.blogspot.com URL: https://fatura-rrrenner.blogspot.com/?m=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fatura-rrrenner.blogspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Tue, 08 Mar 2022 14:20:27 GMT content-encoding gzip x-content-type-options nosniff age 78955 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 404 x-xss-protection 0 last-modified Mon, 07 Mar 2022 15:52:59 GMT server sffe vary Accept-Encoding report-to {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="blogger-tech" expires Wed, 08 Mar 2023 14:20:27 GMT
GET H2	200	plusone.js apis.google.com/js/	53 KB 21 KB	83ms 37ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://apis.google.com/js/plusone.js Requested by Host: fatura-rrrenner.blogspot.com URL: https://fatura-rrrenner.blogspot.com/?m=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fatura-rrrenner.blogspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers content-security-policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20530 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="gapi-team" date Wed, 09 Mar 2022 12:16:22 GMT vary Accept-Encoding report-to {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]} content-type text/javascript access-control-allow-origin * cache-control private, max-age=1800, stale-while-revalidate=1800 etag "c71e14de7b0f5f23" accept-ranges bytes timing-allow-origin * expires Wed, 09 Mar 2022 12:16:22 GMT
GET H2	200	logo_guiamais_com_branco.png www.guiamais.com.br/content/images/	2 KB 3 KB	665ms 211ms	Image image/png	200.98.73.79 Universo Online S.A.
General Check archive.org Show headers Download Go to Show image Full URL https://www.guiamais.com.br/content/images/logo_guiamais_com_branco.png Requested by Host: fatura-rrrenner.blogspot.com URL: https://fatura-rrrenner.blogspot.com/?m=2 Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 200.98.73.79 São Paulo, Brazil, ASN7162 (Universo Online S.A., BR), Reverse DNS 200-98-73-79.clouduol.com.br Software nginx / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://fatura-rrrenner.blogspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 12:16:06 GMT last-modified Tue, 11 Oct 2016 17:42:58 GMT server nginx etag W/"2365-1476207778000" content-type image/png cache-control max-age=31536000, public accept-ranges bytes content-length 2365 expires Thu, 09 Mar 2023 12:16:06 GMT
GET H2	200	listing-divulgue-1.jpg www.guiamais.com.br/content/images/	7 KB 8 KB	601ms 213ms	Image image/jpeg	200.98.73.79 Universo Online S.A.
General Check archive.org Show headers Download Go to Show image Full URL https://www.guiamais.com.br/content/images/listing-divulgue-1.jpg Requested by Host: fatura-rrrenner.blogspot.com URL: https://fatura-rrrenner.blogspot.com/?m=2 Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 200.98.73.79 São Paulo, Brazil, ASN7162 (Universo Online S.A., BR), Reverse DNS 200-98-73-79.clouduol.com.br Software nginx / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://fatura-rrrenner.blogspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 12:16:06 GMT last-modified Mon, 29 Jan 2018 19:32:28 GMT server nginx etag W/"7509-1517254348000" content-type image/jpeg cache-control max-age=31536000, public accept-ranges bytes content-length 7509 expires Thu, 09 Mar 2023 12:16:06 GMT
GET		guiamais-busque-encontre-locais-empresas.png www.guiamais.com.br/content/images/	0 0
GET H2	200	icon18_edit_allbkg.gif resources.blogblog.com/img/	162 B 300 B	18ms 17ms	Image image/gif	2a00:1450:4001:82b::2009 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://resources.blogblog.com/img/icon18_edit_allbkg.gif Requested by Host: fatura-rrrenner.blogspot.com URL: https://fatura-rrrenner.blogspot.com/?m=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fatura-rrrenner.blogspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Sat, 05 Mar 2022 17:58:40 GMT x-content-type-options nosniff last-modified Sat, 05 Mar 2022 03:50:32 GMT server sffe age 325063 report-to {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]} content-type image/gif cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 162 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="blogger-tech" expires Sat, 12 Mar 2022 17:58:40 GMT
GET H2	200	bloggerbutton1.gif buttons.blogger.com/	1 KB 2 KB	97ms 17ms	Image image/gif	2a00:1450:4001:831::2009 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://buttons.blogger.com/bloggerbutton1.gif Requested by Host: fatura-rrrenner.blogspot.com URL: https://fatura-rrrenner.blogspot.com/?m=2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://fatura-rrrenner.blogspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Tue, 08 Mar 2022 15:26:31 GMT x-content-type-options nosniff last-modified Tue, 08 Mar 2022 12:54:36 GMT server sffe age 74992 report-to {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]} content-type image/gif cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1386 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="blogger-tech" expires Tue, 15 Mar 2022 15:26:31 GMT
GET		cookienotice.js fatura-rrrenner.blogspot.com/js/	0 0
GET H/1.1	200 OK	Primary Request / Show response www.agora-solucoesregistros.com/	77 KB 20 KB	881ms 559ms	Document text/html	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/ Requested by Host: fatura-rrrenner.blogspot.com URL: https://fatura-rrrenner.blogspot.com/?m=2 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 138b9e0ce715513ba08d29e141c2fedef70e5ff700dd88ec04dee41ab17f65ee Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://fatura-rrrenner.blogspot.com/ Response headers Date Wed, 09 Mar 2022 12:16:22 GMT Server Apache/2.4.25 (Debian) Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Vary Accept-Encoding Content-Encoding gzip Content-Length 19617 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	style.css www.agora-solucoesregistros.com/1ur4gmn1bq/	539 KB 58 KB	198ms 115ms	Stylesheet text/css	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/style.css Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 05ee848751920da7e6eca02b1369b0e16a76d987affffd740a5a594ca5d537d4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Content-Encoding gzip Last-Modified Mon, 21 Feb 2022 15:12:52 GMT Server Apache/2.4.25 (Debian) ETag "86de0-5d888aa8be500-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 59124
GET H/1.1	200 OK	jquery-3.6.0.min.js Show response www.agora-solucoesregistros.com/1ur4gmn1bq/	87 KB 31 KB	314ms 108ms	Script application/javascript	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/jquery-3.6.0.min.js Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Content-Encoding gzip Last-Modified Sat, 19 Feb 2022 13:12:52 GMT Server Apache/2.4.25 (Debian) ETag "15d9f-5d85ec1b5dd00-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 30908
GET H/1.1	200 OK	validador.js Show response www.agora-solucoesregistros.com/1ur4gmn1bq/	1 KB 724 B	405ms 103ms	Script application/javascript	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/validador.js Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 2c8548291a7fa6aefe9b40dc6de1e5618adbc510b6f6e11abfa11e7413d8dad9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Content-Encoding gzip Last-Modified Sun, 20 Feb 2022 13:30:22 GMT Server Apache/2.4.25 (Debian) ETag "46f-5d8731e22f780-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 375
GET H/1.1	200 OK	script.js Show response www.agora-solucoesregistros.com/1ur4gmn1bq/	1 KB 731 B	508ms 103ms	Script application/javascript	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/script.js Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 5d7a15d535ee0286e0f4c3d79d9fd556eb2e72c00c9bc0145a3d965af326832a Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Content-Encoding gzip Last-Modified Sat, 29 Jan 2022 17:57:52 GMT Server Apache/2.4.25 (Debian) ETag "56d-5d6bc4a484800-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 382
GET H2	200	css2 fonts.googleapis.com/	2 KB 1 KB	74ms 28ms	Stylesheet text/css	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:wght@100&display=swap Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 85e50fe35ea954d81d2feea489b29264aa77b93526409bc630df84d2d11e99ae Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 09 Mar 2022 12:16:23 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 09 Mar 2022 12:16:23 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 09 Mar 2022 12:16:23 GMT
GET H/1.1	200 OK	Roboto-Black.woff2 www.agora-solucoesregistros.com/1ur4gmn1bq/fonts/	14 KB 15 KB	302ms 101ms	Stylesheet application/octet-stream	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/fonts/Roboto-Black.woff2 Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 75ac79783355faa30bc9e86a16614f1922bf05e7fc4814d2243670abce438b66 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Last-Modified Mon, 21 Feb 2022 14:49:18 GMT Server Apache/2.4.25 (Debian) ETag "3900-5d8885643f780" Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 14592
GET H/1.1	200 OK	Roboto-Bold.woff2 www.agora-solucoesregistros.com/1ur4gmn1bq/fonts/	14 KB 15 KB	303ms 101ms	Stylesheet application/octet-stream	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/fonts/Roboto-Bold.woff2 Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 7d98694eb820956ac7e2348164fe4c8869a9d1aa86cb9d441ee835defecd9a40 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Last-Modified Mon, 21 Feb 2022 14:49:22 GMT Server Apache/2.4.25 (Debian) ETag "3958-5d88856810080" Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 14680
GET H/1.1	200 OK	Roboto-Light.woff2 www.agora-solucoesregistros.com/1ur4gmn1bq/fonts/	14 KB 15 KB	304ms 102ms	Stylesheet application/octet-stream	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/fonts/Roboto-Light.woff2 Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash dc83d079bf6ea426a563fda6781219da5ee7580e800351bf6930dc1d5b226253 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Last-Modified Mon, 21 Feb 2022 14:49:26 GMT Server Apache/2.4.25 (Debian) ETag "3968-5d88856be0980" Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 14696
GET H/1.1	200 OK	Roboto-Regular.woff2 www.agora-solucoesregistros.com/1ur4gmn1bq/fonts/	14 KB 15 KB	307ms 103ms	Stylesheet application/octet-stream	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/fonts/Roboto-Regular.woff2 Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash da7eb0a27aee8aa2521c5484f0914e5d61893ad489acf4386b43b8115a501582 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Last-Modified Mon, 21 Feb 2022 14:49:32 GMT Server Apache/2.4.25 (Debian) ETag "3908-5d88857199700" Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 14600
GET H/1.1	200 OK	principal.js Show response www.agora-solucoesregistros.com/1ur4gmn1bq/	6 KB 1 KB	428ms 105ms	Script application/javascript	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/principal.js Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 55403f6903f9a135cdd019364c6a8204b8f5fd1b049618313f4be35be5c70782 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Content-Encoding gzip Last-Modified Sun, 20 Feb 2022 13:34:30 GMT Server Apache/2.4.25 (Debian) ETag "17b0-5d8732ceb2580-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 1003
GET H/1.1	200 OK	principal2.js Show response www.agora-solucoesregistros.com/1ur4gmn1bq/	3 KB 1 KB	428ms 105ms	Script application/javascript	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/principal2.js Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 50a887f5df7278ec0159df9fbd2046a0f416439d66ed837505c3ad346b2284ad Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:23 GMT Content-Encoding gzip Last-Modified Sun, 20 Feb 2022 13:37:48 GMT Server Apache/2.4.25 (Debian) ETag "ba0-5d87338b86300-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 937
GET H/1.1	200 OK	google-play-badge-reverse.svg www.agora-solucoesregistros.com/1ur4gmn1bq/	11 KB 11 KB	103ms 101ms	Image image/svg+xml	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/google-play-badge-reverse.svg Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash e946d863a136a09089fd275d574ff3346bad8327d4ef378c06af35872d9fe56d Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:24 GMT Last-Modified Sat, 19 Feb 2022 13:12:52 GMT Server Apache/2.4.25 (Debian) ETag "2a25-5d85ec1b5dd00" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 10789
GET H/1.1	200 OK	celular-login.png www.agora-solucoesregistros.com/1ur4gmn1bq/	152 KB 152 KB	108ms 105ms	Image image/png	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/celular-login.png Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 7db4ada57262fbacd47bef4e96e3cedda276b9267e6ca4d20adeeb1c24d870b6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:24 GMT Last-Modified Sat, 19 Feb 2022 13:12:52 GMT Server Apache/2.4.25 (Debian) ETag "25e28-5d85ec1b5dd00" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 155176
GET H/1.1	200 OK	google-play-badge.svg www.agora-solucoesregistros.com/1ur4gmn1bq/	11 KB 11 KB	105ms 102ms	Image image/svg+xml	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/google-play-badge.svg Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 8827f96ace2afe4aeff4c33db4ac86193f38a62cb30d9fbba949e0b72c2a55ff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:24 GMT Last-Modified Sat, 19 Feb 2022 13:12:52 GMT Server Apache/2.4.25 (Debian) ETag "2a22-5d85ec1b5dd00" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 10786
GET H/1.1	200 OK	app-store-badge.svg www.agora-solucoesregistros.com/1ur4gmn1bq/	14 KB 14 KB	106ms 103ms	Image image/svg+xml	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/app-store-badge.svg Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 3dd08d21a5c010294a50355af3565a50d08ea4aef83e822114be29171209f109 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:24 GMT Last-Modified Sat, 19 Feb 2022 13:12:52 GMT Server Apache/2.4.25 (Debian) ETag "37b6-5d85ec1b5dd00" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 14262
GET H/1.1	200 OK	bg-login.svg www.agora-solucoesregistros.com/1ur4gmn1bq/vectors/	664 B 952 B	104ms 103ms	Image image/svg+xml	20.127.87.163 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.agora-solucoesregistros.com/1ur4gmn1bq/vectors/bg-login.svg Requested by Host: www.agora-solucoesregistros.com URL: https://www.agora-solucoesregistros.com/1ur4gmn1bq/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 20.127.87.163 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.25 (Debian) / Resource Hash 3bb71cec41dd0b3c5782f72d32b1b028fdc9558f0acace778d1a2c312d50f382 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.agora-solucoesregistros.com/1ur4gmn1bq/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 12:16:24 GMT Last-Modified Mon, 21 Feb 2022 15:11:36 GMT Server Apache/2.4.25 (Debian) ETag "298-5d888a6043a00" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 664

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.guiamais.com.br

URL

https://www.guiamais.com.br/content/images/guiamais-busque-encontre-locais-empresas.png

Domain

fatura-rrrenner.blogspot.com

URL

https://fatura-rrrenner.blogspot.com/js/cookienotice.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Realize (Financial)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery function| _cpf function| validarCPF function| btn_load function| passc function| validBand function| validDate function| validCP

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.agora-solucoesregistros.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 82bcukko236ntrpmtf176l0rps

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: https://www.agora-solucoesregistros.com/(Line 610) Message: Error while parsing the 'sandbox' attribute: 'allow-storage-access-by-user-activation' is an invalid sandbox flag.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

apis.google.com
buttons.blogger.com
fatura-rrrenner.blogspot.com
fonts.googleapis.com
resources.blogblog.com
www.agora-solucoesregistros.com
www.blogger.com
www.guiamais.com.br
fatura-rrrenner.blogspot.com
www.guiamais.com.br
20.127.87.163
200.98.73.79
2a00:1450:4001:810::200a
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2009
2a00:1450:4001:82f::2001
2a00:1450:4001:831::2009
05ee848751920da7e6eca02b1369b0e16a76d987affffd740a5a594ca5d537d4
138b9e0ce715513ba08d29e141c2fedef70e5ff700dd88ec04dee41ab17f65ee
2c8548291a7fa6aefe9b40dc6de1e5618adbc510b6f6e11abfa11e7413d8dad9
3bb71cec41dd0b3c5782f72d32b1b028fdc9558f0acace778d1a2c312d50f382
3dd08d21a5c010294a50355af3565a50d08ea4aef83e822114be29171209f109
50a887f5df7278ec0159df9fbd2046a0f416439d66ed837505c3ad346b2284ad
55403f6903f9a135cdd019364c6a8204b8f5fd1b049618313f4be35be5c70782
5d7a15d535ee0286e0f4c3d79d9fd556eb2e72c00c9bc0145a3d965af326832a
75ac79783355faa30bc9e86a16614f1922bf05e7fc4814d2243670abce438b66
7d98694eb820956ac7e2348164fe4c8869a9d1aa86cb9d441ee835defecd9a40
7db4ada57262fbacd47bef4e96e3cedda276b9267e6ca4d20adeeb1c24d870b6
85e50fe35ea954d81d2feea489b29264aa77b93526409bc630df84d2d11e99ae
8827f96ace2afe4aeff4c33db4ac86193f38a62cb30d9fbba949e0b72c2a55ff
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
da7eb0a27aee8aa2521c5484f0914e5d61893ad489acf4386b43b8115a501582
dc83d079bf6ea426a563fda6781219da5ee7580e800351bf6930dc1d5b226253
e946d863a136a09089fd275d574ff3346bad8327d4ef378c06af35872d9fe56d