![](/screenshots/1d286c9f-8fa5-4081-aec6-7ebb81e83418.png)
wingiftcard.site
Open in
urlscan Pro
2606:4700:30::681b:95d4
Public Scan
Effective URL: https://wingiftcard.site/wp-content/plugins/clickervolt/go.php?s=nl-pop-adv&src=5ddaa392804741n0&v1=1314&v2=1314-d5b2905z...
Submission: On December 17 via automatic, source urlhaus
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on August 11th 2019. Valid for: a year.
This is the only time wingiftcard.site was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 185.148.82.88 185.148.82.88 | 49063 (DTLN) (DTLN) | |
2 | 134.249.116.78 134.249.116.78 | 15895 (KSNET-AS) (KSNET-AS) | |
1 1 | 194.147.34.180 194.147.34.180 | 51659 (ASBAXET) (ASBAXET) | |
2 | 85.25.252.199 85.25.252.199 | 8972 (GD-EMEA-D...) (GD-EMEA-DC-SXB1) | |
1 2 | 185.89.102.8 185.89.102.8 | 209813 (FASTCONTENT) (FASTCONTENT) | |
1 2 | 185.50.248.98 185.50.248.98 | 209813 (FASTCONTENT) (FASTCONTENT) | |
1 3 | 198.143.165.222 198.143.165.222 | 32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC) | |
4 | 2606:4700:30:... 2606:4700:30::681b:95d4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 99.198.108.197 99.198.108.197 | 32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC) | |
1 | 2a05:d018:483... 2a05:d018:483:6130:2464:bd6c:b85f:35d9 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 2a00:1450:400... 2a00:1450:4001:81d::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:818::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
18 | 11 |
ASN49063 (DTLN, RU)
PTR: hostru04.fornex.org
kybis.ru |
ASN15895 (KSNET-AS, UA)
PTR: 134-249-116-78.broadband.kyivstar.net
134.249.116.78 |
ASN8972 (GD-EMEA-DC-SXB1, DE)
PTR: static-ip-85-25-252-199.inaddr.ip-pool.com
rd43.space |
ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: server04.com-2.mobi
best.prizedeal0919.info |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
wingiftcard.site |
ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: server04.com-2.mobi
mon.wingiftcard.site |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
securecloud-smart.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google.com |
ASN15169 (GOOGLE - Google LLC, US)
www.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
wingiftcard.site
wingiftcard.site mon.wingiftcard.site |
5 KB |
3 |
prizedeal0919.info
1 redirects
best.prizedeal0919.info |
4 KB |
2 |
google.com
www.google.com |
594 B |
2 |
mobappcenter1.com
1 redirects
mobappcenter1.com |
927 B |
2 |
nonamergw53.live
1 redirects
mobile5228.nonamergw53.live |
1017 B |
2 |
rd43.space
rd43.space |
48 KB |
1 |
gstatic.com
www.gstatic.com |
91 KB |
1 |
securecloud-smart.com
securecloud-smart.com |
|
1 |
secretshoplik.ga
secretshoplik.ga Failed |
663 B |
1 |
kybis.ru
1 redirects
kybis.ru |
880 B |
18 | 10 |
Domain | Requested by | |
---|---|---|
4 | wingiftcard.site |
best.prizedeal0919.info
wingiftcard.site |
3 | best.prizedeal0919.info |
1 redirects
mobappcenter1.com
best.prizedeal0919.info |
2 | www.google.com |
wingiftcard.site
www.gstatic.com |
2 | mobappcenter1.com |
1 redirects
mobile5228.nonamergw53.live
|
2 | mobile5228.nonamergw53.live |
1 redirects
rd43.space
|
2 | rd43.space |
134.249.116.78
rd43.space |
1 | www.gstatic.com |
www.google.com
|
1 | securecloud-smart.com |
wingiftcard.site
|
1 | mon.wingiftcard.site |
wingiftcard.site
|
1 | secretshoplik.ga |
134.249.116.78
|
1 | kybis.ru | 1 redirects |
18 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
best.prizedeal0919.info Let's Encrypt Authority X3 |
2019-12-13 - 2020-03-12 |
3 months | crt.sh |
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-08-11 - 2020-08-10 |
a year | crt.sh |
mon.wingiftcard.site Let's Encrypt Authority X3 |
2019-11-18 - 2020-02-16 |
3 months | crt.sh |
securessl-fb.com Amazon |
2019-04-20 - 2020-05-20 |
a year | crt.sh |
www.google.com GTS CA 1O1 |
2019-11-13 - 2020-02-05 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2019-12-03 - 2020-02-25 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://wingiftcard.site/wp-content/plugins/clickervolt/go.php?s=nl-pop-adv&src=5ddaa392804741n0&v1=1314&v2=1314-d5b2905z&v3=0.00116&v4=6771478394174440284&c5=gb
Frame ID: 591075F5104931425E0914D7142E2306
Requests: 15 HTTP requests in this frame
Frame:
http://rd43.space/media/mainstream/iframe.html
Frame ID: 127D81600F337F163778332BF7F8C3E5
Requests: 1 HTTP requests in this frame
Frame:
https://securecloud-smart.com/?a=28953&c=174995&s2=5df91fba669c5mrf
Frame ID: 7015EE9FA7E276186933CF68FB8D9327
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcjbsQUAAAAAJPGyzZ8mWwKd2bz0PsM5LWUir69&co=aHR0cHM6Ly93aW5naWZ0Y2FyZC5zaXRlOjQ0Mw..&hl=en&v=mhgGrlTs_PbFQOW4ejlxlxZn&size=invisible&cb=s3x2m96mrnhf
Frame ID: 95A2D01F2CFD0E0DEAEC8A0B97B4E148
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/1d286c9f-8fa5-4081-aec6-7ebb81e83418.png)
Page URL History Show full URLs
-
http://kybis.ru/
HTTP 302
http://134.249.116.78/?key=yusdVocZlno9DrtN0I7qT3kuJAd1RnBn Page URL
- http://134.249.116.78/cloud.php Page URL
-
http://secretshoplik.ga/index/?6871568466678
HTTP 302
http://rd43.space/?u=h2xkd0x&o=lxkgnum&t=cid:1316&cid=1316-11111-20191217213432012e5 Page URL
- http://mobile5228.nonamergw53.live/1075856723/?u=h2xkd0x&o=lxkgnum&t=cid:1316&cid=1316-11111-20191217213432012e... Page URL
-
http://mobile5228.nonamergw53.live/web/
HTTP 302
http://mobappcenter1.com/?url=I4WHKFughjJF8hN7lWENt4g7gTF2s7%2bARoeVr6SAkaO1NW67HOxAK4xsrMlPpz%2fpIUP... HTTP 302
http://mobappcenter1.com/away.php Page URL
- https://best.prizedeal0919.info/?utm_medium=ea172d248b9735e460f00fe3598f79e5f994c72b&utm_campaign=m&cid=d701... Page URL
- https://best.prizedeal0919.info/?utm_term=6771478394174440284&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
-
https://best.prizedeal0919.info/proc.php?15268168ef944504f625363e4f1134ae483ccc01
HTTP 302
https://wingiftcard.site/wp-content/plugins/clickervolt/go.php?s=nl-pop-adv&src=5ddaa392804741n0&v1=1... Page URL
Detected technologies
Detected patterns
- script /\/wp-(?:content|includes)\//i
Detected patterns
- headers server /php\/?([\d.]+)?/i
- script /\/wp-(?:content|includes)\//i
Detected patterns
- script /\/wp-(?:content|includes)\//i
![](/vendor/wappa/icons/WindowsServer.png)
Detected patterns
- headers server /Win32|Win64/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
![](/vendor/wappa/icons/reCAPTCHA.png)
Detected patterns
- script /\/recaptcha\/api\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://kybis.ru/
HTTP 302
http://134.249.116.78/?key=yusdVocZlno9DrtN0I7qT3kuJAd1RnBn Page URL
- http://134.249.116.78/cloud.php Page URL
-
http://secretshoplik.ga/index/?6871568466678
HTTP 302
http://rd43.space/?u=h2xkd0x&o=lxkgnum&t=cid:1316&cid=1316-11111-20191217213432012e5 Page URL
- http://mobile5228.nonamergw53.live/1075856723/?u=h2xkd0x&o=lxkgnum&t=cid:1316&cid=1316-11111-20191217213432012e5&f=1&fp=jjgN%2Fdocsgz3lsxY5Tmc%2BqyvyzkOgZGO7244yjeCZn%2BCOI76ApZewKdlteeQ2pKXqrFFmvbgK4CFYqsxnVN6tsVnh9r6t8UR4CZXJDwcvCW8RgCeW2RBo9325F%2FzihRR94tgRyXgHRhCU0M0w%2FhkrOCeU%2BWZvezVefjBfUSBt3PrxlVGjzQb2eH2AMsXzsoRiJeUfYRwJ0v5t8HGkYHHiKdXALrYmKaymMZSp3ZjLgoBhG99NJMG0FzuVBlCXd48aPBGsSUJYX9KlmjJdKMxpRkPAO6cY4fP3IcQsgyGBFXjBtA%2FFQtHVZViNm0vwHcSwNV8R6maw4OtVRcapkOJtGN2jMzEgTm%2F8AbVgUTOncKHIMYnXQsrbdwBzLfMjhm12kUkRQqUtb10jWTw%2BTVPOMo1kpgM4PBpasngk6anP93%2FBMTl6Bwl8Y4tAFAwjmq%2BnQY2emH9y%2F4%2B9ATN4TWq8gHQp%2FlOTCM1v%2Bx7eSrIXRArlym0CExHcS%2FHkE9luOVv98VMspN8Ix5aC4Xz2kitGRaLkb91vRaQDDxhQSd%2BOjwiwf8%2BC4d9Wz4gtHV1MluXSzklxm6wu%2FH3CQh4uEOobVp%2FVvnSgBcLJAgbL3BwVqb7rcicrIPKulg%2FnW%2BPJcYd Page URL
-
http://mobile5228.nonamergw53.live/web/
HTTP 302
http://mobappcenter1.com/?url=I4WHKFughjJF8hN7lWENt4g7gTF2s7%2bARoeVr6SAkaO1NW67HOxAK4xsrMlPpz%2fpIUPEJIzpBj%2flHB%2fR3eW4tF5XWMtSliIVNaW8kQzHSdzdf6lHcJn2Jg99xC778qsFXYo%2f%2bFDuJDzqnFd%2bsViWK8h84NFy0meMKiKoqlcidVT%2f7%2fAoop11Ioin1vXkisduUfVVk7fPAL8%3d HTTP 302
http://mobappcenter1.com/away.php Page URL
- https://best.prizedeal0919.info/?utm_medium=ea172d248b9735e460f00fe3598f79e5f994c72b&utm_campaign=m&cid=d701422e-ca74-4cc1-9e2a-c6f1c92269b4&np=1 Page URL
- https://best.prizedeal0919.info/?utm_term=6771478394174440284&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f Page URL
-
https://best.prizedeal0919.info/proc.php?15268168ef944504f625363e4f1134ae483ccc01
HTTP 302
https://wingiftcard.site/wp-content/plugins/clickervolt/go.php?s=nl-pop-adv&src=5ddaa392804741n0&v1=1314&v2=1314-d5b2905z&v3=0.00116&v4=6771478394174440284&c5=gb Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://kybis.ru/ HTTP 302
- http://134.249.116.78/?key=yusdVocZlno9DrtN0I7qT3kuJAd1RnBn
- http://secretshoplik.ga/index/?6871568466678 HTTP 302
- http://rd43.space/?u=h2xkd0x&o=lxkgnum&t=cid:1316&cid=1316-11111-20191217213432012e5
- http://mobile5228.nonamergw53.live/web/ HTTP 302
- http://mobappcenter1.com/?url=I4WHKFughjJF8hN7lWENt4g7gTF2s7%2bARoeVr6SAkaO1NW67HOxAK4xsrMlPpz%2fpIUPEJIzpBj%2flHB%2fR3eW4tF5XWMtSliIVNaW8kQzHSdzdf6lHcJn2Jg99xC778qsFXYo%2f%2bFDuJDzqnFd%2bsViWK8h84NFy0meMKiKoqlcidVT%2f7%2fAoop11Ioin1vXkisduUfVVk7fPAL8%3d HTTP 302
- http://mobappcenter1.com/away.php
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
134.249.116.78/ Redirect Chain
|
621 B 825 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cloud.php
134.249.116.78/ |
159 B 363 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
secretshoplik.ga/index/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() rd43.space/ Redirect Chain
|
47 KB 47 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() rd43.space/media/mainstream/ Frame 127D |
123 B 454 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() mobile5228.nonamergw53.live/1075856723/ |
85 B 497 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
away.php
mobappcenter1.com/ Redirect Chain
|
346 B 572 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
best.prizedeal0919.info/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
best.prizedeal0919.info/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
go.php
wingiftcard.site/wp-content/plugins/clickervolt/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pub.min.js
mon.wingiftcard.site/js/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
securecloud-smart.com/ Frame 7015 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cvTrack.js
wingiftcard.site/wp-content/plugins/clickervolt/redirect/jsTracking/js/ |
10 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
remoteTracking.php
wingiftcard.site/wp-content/plugins/clickervolt/redirect/jsTracking/ |
405 B 322 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
763 B 594 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/mhgGrlTs_PbFQOW4ejlxlxZn/ |
254 KB 91 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame 95A2 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
remoteTracking.php
wingiftcard.site/wp-content/plugins/clickervolt/redirect/jsTracking/ |
37 B 126 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- secretshoplik.ga
- URL
- http://secretshoplik.ga/index/?6871568466678
Verdicts & Comments Add Verdict or Comment
12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| s number| cvTimeStart string| pm_tag string| pm_pid object| clickerVolt object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client object| recaptcha object| closure_lm_6373787 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.google.com/ | Name: NID Value: 193=KkJF7FUNBD5Ex7dS-2FGGCq2L6j7ZbNJw9vONGFlm3sgthhyKgMt4XrDnUQyaprcdxfBVGHm6Sa9kUzWP7ljh2-I0FBV-t6Ataz7N-YidQFLLxQNjiVaBMl2aFC8_4ZbAbqZzqZc2AQ7p6vuEhhB5dfSNduQnMi2pcv_-G9EmRc |
|
trk.securesmrt-dt.com/ | Name: scriptHash Value: 374734 |
|
trk.securesmrt-dt.com/ | Name: unique_2541605 Value: unique_2541605 |
|
wingiftcard.site/ | Name: clickervolt-sid Value: a8455e97751e43551624559ec750fc7f |
|
trk.securesmrt-dt.com/ | Name: unique_id Value: 5df91fbb0d8e0448886544 |
|
wingiftcard.site/ | Name: PHPSESSID Value: a8455e97751e43551624559ec750fc7f |
|
.wingiftcard.site/ | Name: __cfduid Value: d75643281116e0eb34e2e65e68f3ca3e01576607674 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
best.prizedeal0919.info
kybis.ru
mobappcenter1.com
mobile5228.nonamergw53.live
mon.wingiftcard.site
rd43.space
secretshoplik.ga
securecloud-smart.com
wingiftcard.site
www.google.com
www.gstatic.com
secretshoplik.ga
134.249.116.78
185.148.82.88
185.50.248.98
185.89.102.8
194.147.34.180
198.143.165.222
2606:4700:30::681b:95d4
2a00:1450:4001:818::2003
2a00:1450:4001:81d::2004
2a05:d018:483:6130:2464:bd6c:b85f:35d9
85.25.252.199
99.198.108.197
0f908f9dac6d6c6b1def5bbea4256de99239cc542e5b12d48074b10d62483a6e
21cc64e357282fee09dfcd3970621678d007869b10fa17e908e3a5e24da9196b
2f36055fac491a54112cba3a629071c24d344a2d94e30c41b76a007ffb078ed6
4a043b8bc9903ffae8697a842a9c8957d6175dae01daff00f12068c45bb2fcdb
5e9dbcfc8aedb6245dc28a3eee96a55ee27e0e91656e5914309e1edbb34c088e
747a09c16bc5d4d6fe32123c27af2bbf8c372db4fb2babea61b14cc1f880d23e
7fcd4d6165eab9417f48871ff5b1689b729bed92b12d0f8b92f6dd31f38a872c
9ea791072baeb5784e2781f93763cd3e5aee3e0b385e0a8b6f394ca869eedaa9
a7bae1c42dc7bbd0783d5fa483075b3ca30c47f7b83bbd0fa3816407cb6161d6
c2cca14e4dbf2994f90b91ef01ec4d6eb6b560b429d028317d624d9b5f4bdcb0
d2ea711a2a3e6df2beb6900210895a990ee625fadf7c7e00bb5bad66490b812f
e1b04b6251183878b7c0351c3e2e39470720d102ccfeea448e4c304f5c865f41
e525d997676ea030ea84245bd848129423e6b2e30f5667c3a7d879645288bed5