nexi.ddns.mobi
Open in
urlscan Pro
185.80.128.66
Malicious Activity!
Public Scan
Effective URL: https://nexi.ddns.mobi/area-utente/profilo/area-personale/.0c090d454f48b08aa059e14238a30d81/login/
Submission Tags: @ecarlesi threat phishing nexipayments Search All
Submission: On May 12 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by R3 on May 12th 2024. Valid for: 3 months.
This is the only time nexi.ddns.mobi was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nexi (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 32 | 185.80.128.66 185.80.128.66 | 61053 (VPSNET-AS) (VPSNET-AS) | |
3 | 216.58.212.164 216.58.212.164 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.181.227 142.250.181.227 | 15169 (GOOGLE) (GOOGLE) | |
2 | 185.198.117.126 185.198.117.126 | 35051 (NEXI-AS) (NEXI-AS) | |
36 | 4 |
ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f3.1e100.net
www.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
32 |
ddns.mobi
2 redirects
nexi.ddns.mobi |
820 KB |
3 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
855 B |
2 |
nexi.it
www.nexi.it |
36 KB |
1 |
gstatic.com
www.gstatic.com |
203 KB |
36 | 4 |
Domain | Requested by | |
---|---|---|
32 | nexi.ddns.mobi |
2 redirects
nexi.ddns.mobi
|
3 | www.google.com |
nexi.ddns.mobi
www.gstatic.com |
2 | www.nexi.it | |
1 | www.gstatic.com |
www.google.com
|
36 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.accessiway.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
nexi.ddns.mobi R3 |
2024-05-12 - 2024-08-10 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
www.nexi.it GlobalSign RSA OV SSL CA 2018 |
2023-08-04 - 2024-08-21 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.0c090d454f48b08aa059e14238a30d81/login/
Frame ID: 61039E0674BF96A622D87C6CC73B82B0
Requests: 34 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf7LRokAAAAANgHOG15sSWk2boKdzEpx1rHxzOh&co=aHR0cHM6Ly9uZXhpLmRkbnMubW9iaTo0NDM.&hl=it&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&cb=lr5d387kwxmy
Frame ID: F481D45D7F1BFD63B557F492B2BB77ED
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=it&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6Lf7LRokAAAAANgHOG15sSWk2boKdzEpx1rHxzOh
Frame ID: 240F763521954FFE8819CCD4B86A02A3
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Area PersonalePage URL History Show full URLs
-
https://nexi.ddns.mobi/area-utente/profilo/area-personale/
HTTP 302
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.0c090d454f48b08aa059e14238a30d81/ HTTP 302
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.0c090d454f48b08aa059e14238a30d81/login/ Page URL
Detected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- /etc\.clientlibs/
AngularJS (JavaScript Frameworks) Expand
Detected patterns
- \bangular.{0,32}\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- /recaptcha/api\.js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: AccessiWay. The Web Accessibility Solution
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://nexi.ddns.mobi/area-utente/profilo/area-personale/
HTTP 302
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.0c090d454f48b08aa059e14238a30d81/ HTTP 302
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.0c090d454f48b08aa059e14238a30d81/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
36 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
nexi.ddns.mobi/area-utente/profilo/area-personale/.0c090d454f48b08aa059e14238a30d81/login/ Redirect Chain
|
375 KB 44 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
nexi.ddns.mobi/area-utente/profilo/area-personale/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ua-parser.min.js
nexi.ddns.mobi/area-utente/profilo/area-personale/bower_components/ua-parser-js/dist/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
nexi.ddns.mobi/area-utente/profilo/area-personale/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.js
nexi.ddns.mobi/area-utente/profilo/area-personale/core/form/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_token.js
nexi.ddns.mobi/area-utente/profilo/area-personale/core/token/ |
14 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.css
nexi.ddns.mobi/area-utente/profilo/area-personale/core/form/ |
3 KB 1002 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
angular.min.js
nexi.ddns.mobi/area-utente/profilo/area-personale/bower_components/angular/ |
165 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
nexi.ddns.mobi/area-utente/profilo/area-personale/login/form/ |
144 B 456 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clientlib-site.css
nexi.ddns.mobi/area-utente/profilo/area-personale/login/ |
239 KB 38 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nexi-logo-white.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_pt.jpg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/ |
425 KB 425 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app_store.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
15 KB 16 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google_play.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
25 KB 25 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
huawei-store.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
22 KB 22 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
www.google.com/recaptcha/ |
1 KB 855 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-close.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-phone.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-close-white.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-phone-warning-white.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico-down-blue.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
898 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-blocked.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
935 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nexi-logo-dark.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
nexi.ddns.mobi/area-utente/profilo/area-personale/login/form/ |
3 KB 975 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ng.js
nexi.ddns.mobi/area-utente/profilo/area-personale/login/ng/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.js
nexi.ddns.mobi/area-utente/profilo/area-personale/login/token/ |
1 KB 865 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KarbonApp.woff2
nexi.ddns.mobi/area-utente/profilo/area-personale/login/fonts/Karbon/ |
40 KB 40 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KarbonAppMedium.woff2
nexi.ddns.mobi/area-utente/profilo/area-personale/login/fonts/Karbon/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KarbonAppSemibold.woff2
nexi.ddns.mobi/area-utente/profilo/area-personale/login/fonts/Karbon/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gate.php
nexi.ddns.mobi/area-utente/profilo/uadmin/ |
57 B 258 B |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gate.php
nexi.ddns.mobi/area-utente/profilo/uadmin/ |
57 B 258 B |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__it.js
www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/ |
507 KB 203 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
anchor
www.google.com/recaptcha/api2/ Frame F481 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.png
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/favicons/ |
801 B 2 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame 240F |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/favicons/ |
34 KB 34 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nexi (Banking)52 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 function| $ function| jQuery function| UAParser function| ask_login_proxy function| ask_otp_proxy function| ask_info_proxy function| ask_cc_proxy function| ask_sms_proxy function| ask_nexi6_proxy function| ask_fiscale_proxy function| ask_ready_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| ask_email_proxy function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond object| angular function| recaptchaCallback string| bid object| php_js object| app object| loader_ string| el object| CORE__ object| REST_FN__ number| bidder_timer object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_8752412 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
nexi.ddns.mobi/area-utente/profilo/area-personale | Name: real Value: OK |
|
nexi.ddns.mobi/ | Name: bid Value: .0c090d454f48b08aa059e14238a30d81 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nexi.ddns.mobi
www.google.com
www.gstatic.com
www.nexi.it
142.250.181.227
185.198.117.126
185.80.128.66
216.58.212.164
01c12b5cd06120dfb1f8f9ee454d423b3c6648580d55926d5394c0ee6cdc2b47
051dcb41195c361f53598dfcb4b39a45f0d2a3caf9af94df888a7efc0a757511
0a6a27a9b26db36c349d38612d0f590c1f436e7915ce180069d30d20cf0d19ff
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
10103025af76da4bf57e471d76f2d23b62f627dc70e2f90e3ed951ab17cb526f
2bef6e7b4bd23a7009ddf29a2896bbdc7e25a365b501b2c34b5fd42917e12337
32cde70fcb4ed6949904cec5ef9065adce2196b3e8216bb5874019a9efe96edd
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
4c399d83f036f296ac9cdc6cbb47af8f77b8892218b7c0ae7c26b292f4eddd08
53192495ec43c0d10022eb2fecefd9bd2967f56dab0fd98d3a3d5831422f7323
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27
64172083edf3938b11537aee65925d1b0494ab55fbb60b02445cd22c03e8022d
6f5c5dc5fc7c6ea7c5fea8e849fbb7df1a10ffdba8fcc19ee0cd81f16941c8c8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7e6f9ccce4ea514b53fb258d72b5682c74d1e81ef9148d3c406fbd03cfd56919
83e9a25bc3d65aa88a683b34f650213f0c74e657b29436a37ef138c2ea689dda
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
87526f6a2177902e89ac67e69e6152671d38625024ae399ce3ba149599614bb9
8f536c7e673a75e03ff27867cabb22e5a2db39b7d32be7235fca410086755e6a
92751c1749c593c1ad2a7b61ff640b0dbb1a4c32db1981a523e5432cc35a029f
9be94d083aafa836c6a4253cc09cdcf72dea52ed61294a8fc2207cfb3dffc08f
9e7d74d8733620d2d8c3ee9e2f9bbf11ffecfdb33c19d5ebfaa589a779f50a1a
a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6
b30c0a284317976dac006b4736227d134c054afe7fd5b659a6cd4ac11f94b46a
bbb722dc68b1f74fddc845a9bc580ee382f98c012e7167c3892a9038b483c9f6
c8e1f312e86564f3d293bb04806f55d4296cc3342321655bb738d7d61eeeef22
d5ded7a91066c885b90252eb9849575a6c2f2e9c87d8748c496af886b731d3f8
ddcb12028caf567e0f9d6af1adc7e51df78b7c800f99eab2608c11ca47f9b77e
e0996b70c42f6b838e29966b675e9eb4fe7b2a1f17dec0d58814cc62fc72dd09
e5c0e42bb6a3f3a244f8724587feb409c48a467a098e94c708bbb58117d41369
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340
f1926ee7a205ed96afdd1b8a74d845d21a64dadb6ef76e672558e5b84b58274c
f281184bb9d9bce514bbde9ea13b61f01fe9665e36ace1587dfa8d85de3c7631
fb6d36db22e64abb396082fda3a6773c574431ea846bcca511b9e2842fc30587