ihanaloma.ru.com Open in urlscan Pro
103.150.31.10  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

33 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response ihanaloma.ru.com/ilibero/italia/libero2024/	6 KB 7 KB	1024ms 349ms	Document text/html	103.150.31.10 HOST-AS-AP Host U...
General Check archive.org Show headers Download Go to Full URL https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU), Reverse DNS Software Apache / Resource Hash 1e7271f832628acc449ce087d6d75f51739b98094a637c4169940287705ba497 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language en-US,en;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 26 Mar 2024 15:17:30 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	style.css ihanaloma.ru.com/ilibero/italia/libero2024/files/	26 KB 26 KB	317ms 314ms	Stylesheet text/css	103.150.31.10 HOST-AS-AP Host U...
General Check archive.org Show headers Download Go to Full URL https://ihanaloma.ru.com/ilibero/italia/libero2024/files/style.css Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU), Reverse DNS Software Apache / Resource Hash 148c0dcd3eff6305eaffe3600d31334604cc02591259020e54d8835be0e20dfe Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 26 Mar 2024 15:17:30 GMT Last-Modified Thu, 25 Aug 2022 14:13:24 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 26719
GET H/1.1	200 OK	jquery.min.js Show response ihanaloma.ru.com/ilibero/italia/libero2024/files/	87 KB 88 KB	330ms 327ms	Script text/javascript	103.150.31.10 HOST-AS-AP Host U...
General Check archive.org Show headers Download Go to Full URL https://ihanaloma.ru.com/ilibero/italia/libero2024/files/jquery.min.js Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU), Reverse DNS Software Apache / Resource Hash c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 26 Mar 2024 15:17:30 GMT Last-Modified Thu, 25 Aug 2022 12:41:28 GMT Server Apache Content-Type text/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 89493
GET H/1.1	200 OK	placeholders.min.js Show response ihanaloma.ru.com/ilibero/italia/libero2024/files/	4 KB 4 KB	944ms 313ms	Script text/javascript	103.150.31.10 HOST-AS-AP Host U...
General Check archive.org Show headers Download Go to Full URL https://ihanaloma.ru.com/ilibero/italia/libero2024/files/placeholders.min.js Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU), Reverse DNS Software Apache / Resource Hash bb631cb41d70ab6f8a07ab80b053676bca8589e7e1d835827f30e1bffbed91c5 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 26 Mar 2024 15:17:31 GMT Last-Modified Thu, 25 Aug 2022 12:41:28 GMT Server Apache Content-Type text/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 3907
GET H/1.1	200 OK	iam2.0.js Show response ihanaloma.ru.com/ilibero/italia/libero2024/files/	139 KB 139 KB	945ms 315ms	Script text/javascript	103.150.31.10 HOST-AS-AP Host U...
General Check archive.org Show headers Download Go to Full URL https://ihanaloma.ru.com/ilibero/italia/libero2024/files/iam2.0.js Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU), Reverse DNS Software Apache / Resource Hash 6371356d9cb87a361f550a77f374e58eb68a25ab048440a04e11fba1cc575876 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 26 Mar 2024 15:17:31 GMT Last-Modified Thu, 25 Aug 2022 12:41:28 GMT Server Apache Content-Type text/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 141862
GET H2	200	prebid.js Show response www.iolam.it/js/	469 KB 152 KB	503ms 137ms	Script application/javascript	213.209.30.161 MATRIX-AS
General Check archive.org Show headers Download Go to Full URL https://www.iolam.it/js/prebid.js Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 213.209.30.161 Assago, Italy, ASN8660 (MATRIX-AS, IT), Reverse DNS Software Apache / Resource Hash 714ceeb7a00f469992815693f00100f9a225389238f074904ec1967783eb20a0 Security Headers Name Value Strict-Transport-Security max-age=63072000; Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 15:17:30 GMT strict-transport-security max-age=63072000; content-encoding gzip server Apache vary Accept-Encoding content-type application/javascript cache-control max-age=86400 accept-ranges bytes x-robots-tag noindex expires Wed, 27 Mar 2024 15:17:30 GMT
GET H/1.1	200 OK	AdvContent20x20.png ihanaloma.ru.com/ilibero/italia/libero2024/files/	537 B 779 B	950ms 317ms	Image image/png	103.150.31.10 HOST-AS-AP Host U...
General Check archive.org Show headers Download Go to Show image Full URL https://ihanaloma.ru.com/ilibero/italia/libero2024/files/AdvContent20x20.png Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU), Reverse DNS Software Apache / Resource Hash 68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 26 Mar 2024 15:17:31 GMT Last-Modified Mon, 14 Mar 2022 14:18:42 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 537
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	103ms 28ms	Script text/javascript	2607:f8b0:4006:80e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80e::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 14:50:41 GMT content-encoding gzip x-content-type-options nosniff age 1609 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 26 Mar 2025 14:50:41 GMT
GET H3	200	jquery.validate.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.5/	24 KB 7 KB	47ms 23ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.5/jquery.validate.min.js Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 15:17:30 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 898090 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 7032 last-modified Fri, 01 Jul 2022 15:30:23 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "62bf130f-1b78" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RZZFxlUgNcFJK2iCXw01rt0N8%2FzsK05v38nMoRRovizgE%2F7wAUO%2FudZ8vz5XoUGZ1KxSKEsYdA627%2FzPqbFE3j3YvzIio8QczJ0OgF4ZGifhZqDh0Ip51TFN%2Fs0ShELTR%2Bgnk7IX"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 86a81ba10fe64bcd-BUF expires Sun, 16 Mar 2025 15:17:30 GMT
GET H2	200	css2 fonts.googleapis.com/	7 KB 1 KB	178ms 112ms	Stylesheet text/css	2607:f8b0:4006:820::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:820::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 694adc42b1e12c4edc69f43c2aaafea20e28d55d4ee73c3505cd1bf8b90e3452 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000 date Tue, 26 Mar 2024 15:17:30 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 26 Mar 2024 15:15:58 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 26 Mar 2024 15:17:30 GMT
GET H/1.1	404 Not Found	;);%20background-repeat:%20no-repeat;%20background-color:%20rgb(104,%20231,%20255);%20background-position:%20center%20top; ihanaloma.ru.com/ilibero/italia/libero2024/	315 B 315 B	327ms 326ms	Image text/html	103.150.31.10 HOST-AS-AP Host U...
General Check archive.org Show headers Download Go to Show image Full URL https://ihanaloma.ru.com/ilibero/italia/libero2024/;);%20background-repeat:%20no-repeat;%20background-color:%20rgb(104,%20231,%20255);%20background-position:%20center%20top; Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU), Reverse DNS Software Apache / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 26 Mar 2024 15:17:31 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	logo.svg ihanaloma.ru.com/ilibero/italia/libero2024/files/	5 KB 5 KB	317ms 317ms	Image image/svg+xml	103.150.31.10 HOST-AS-AP Host U...
General Check archive.org Show headers Download Go to Show image Full URL https://ihanaloma.ru.com/ilibero/italia/libero2024/files/logo.svg Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/style.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU), Reverse DNS Software Apache / Resource Hash 54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ilibero/italia/libero2024/files/style.css accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 26 Mar 2024 15:17:31 GMT Last-Modified Mon, 14 Mar 2022 14:18:42 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 4827
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	388ms 27ms	Font font/woff2	2607:f8b0:4006:80e::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fonts.googleapis.com/ Origin https://ihanaloma.ru.com accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 20 Mar 2024 09:04:28 GMT x-content-type-options nosniff age 540783 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 20 Mar 2025 09:04:28 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	395ms 35ms	Font font/woff2	2607:f8b0:4006:80e::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fonts.googleapis.com/ Origin https://ihanaloma.ru.com accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 20 Mar 2024 07:57:26 GMT x-content-type-options nosniff age 544805 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 20 Mar 2025 07:57:26 GMT
GET		targeting italiaonline.profiles.tagger.opecloud.com/v1/	0 0
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	90 KB 29 KB	185ms 101ms	Script text/javascript	2607:f8b0:4006:824::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/files/iam2.0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash c3bb98f605190d7a1534fc5b58d78ebd872944e2c2fdcc6f6963bb1a3a748ae8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 15:17:32 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 29144 x-xss-protection 0 server cafe etag 526 / 19808 / 31082082 / config-hash: 8986588044495404927 vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * expires Tue, 26 Mar 2024 15:17:32 GMT
OPTIONS H2	400	targeting italiaonline.profiles.tagger.opecloud.com/v1/ Frame	0 0	359ms 103ms	Preflight text/plain	3.127.130.203 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&gdpr_applies=0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.127.130.203 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-130-203.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers referrer-policy Access-Control-Request-Method GET Origin https://ihanaloma.ru.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers content-encoding gzip content-type text/plain; charset=UTF-8 date Tue, 26 Mar 2024 15:17:32 GMT
GET H2	200	pubads_impl.js Show response securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/	438 KB 138 KB	30ms 29ms	Script text/javascript	2607:f8b0:4006:824::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js?cb=31082082 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 1fe53cf7f03d12af875315353f6ab8df7a936fa9e26cbe0c5e2f1dc7269652b8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 10:01:53 GMT content-encoding br x-content-type-options nosniff age 18939 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 141049 x-xss-protection 0 server cafe etag 7927512453849819874 vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, immutable, max-age=31536000 timing-allow-origin * expires Wed, 26 Mar 2025 10:01:53 GMT
GET H/1.1	200 OK	libero_favicon.ico ihanaloma.ru.com/ilibero/italia/libero2024/files/	1 KB 1 KB	316ms 315ms	Other image/x-icon	103.150.31.10 HOST-AS-AP Host U...
General Check archive.org Show headers Download Go to Full URL https://ihanaloma.ru.com/ilibero/italia/libero2024/files/libero_favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.150.31.10 Singapore, Singapore, ASN136557 (HOST-AS-AP Host Universal Pty Ltd, AU), Reverse DNS Software Apache / Resource Hash fba1ebd847c9826cd1bb0482cb11ba739012cd4b4003af92ab28b8b559a8e8de Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 26 Mar 2024 15:17:32 GMT Last-Modified Mon, 14 Mar 2022 20:09:04 GMT Server Apache Content-Type image/x-icon Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1150
POST		trk www.iolam.it/service/	0 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	34 KB 14 KB	134ms 134ms	Fetch text/plain	142.251.41.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1809280314413798&correlator=1027760194721036&eid=44809527%2C31082082%2C44777897&output=ldjh&gdfp_req=1&vrg=202403190101&ptt=17&impl=fifs&npa=1&iu_parts=5180%2Clibero%2Cwebmail%2Clogin%2Cundefined&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=1540x1024&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1711466254393&lmt=1711466254&adxs=576&adys=50&biw=1600&bih=1113&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=600&u_w=800&u_ah=600&u_aw=800&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyMy4wLjYzMTIuNTgiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjEyMy4wLjYzMTIuNTgiXSxbIk5vdDpBLUJyYW5kIiwiOC4wLjAuMCJdLFsiQ2hyb21pdW0iLCIxMjMuMC42MzEyLjU4Il1dLDBd&url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&vis=1&psz=980x0&msz=1540x0&fws=0&ohw=0&ga_vid=754220200.1711466254&ga_sid=1711466254&ga_hid=473748681&ga_fc=false&dlt=1711466250231&idt=2237&cust_params=oe%3DUTF-8%26optout%3D1%26adv_infocus%3Dyes%26adv_referrer%3Dother%26adv_sgt%3D1%26is_native%3Dno%26xdid_user_ui%3Dfalse%26adv_sso1%3D0%26adv_sso2%3D0%26adv_sso3%3D0%26gdpr%3D0&adks=68688629&frm=20 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js?cb=31082082 Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.41.2 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s40-in-f2.1e100.net Software cafe / Resource Hash 6118449023eeb110ad7ad07186662f882d9239127250731054a4e9293172943a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 15:17:34 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 13851 x-xss-protection 0 google-lineitem-id 6345905207 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138387779046 content-type text/plain; charset=UTF-8 access-control-allow-origin https://ihanaloma.ru.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/	16 KB 12 KB	169ms 107ms	XHR application/json	142.250.72.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202403190101&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js?cb=31082082 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s32-in-f2.1e100.net Software cafe / Resource Hash 6daf2cbb6b06d294c4c917c1dc43cbbb0ffd2a5896a771c09a8fc82e2a0ab6cd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 15:17:34 GMT content-encoding br x-content-type-options nosniff server cafe content-type application/json; charset=UTF-8 access-control-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 12062 x-xss-protection 0
GET H2	200	container.html 317d06816f9e46c554d4f1add57101e4.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 115F	0 0	123ms 41ms	Document text/html	2607:f8b0:4006:80d::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://317d06816f9e46c554d4f1add57101e4.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js?cb=31082082 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ihanaloma.ru.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language en-US,en;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, immutable, max-age=31536000 content-encoding br content-length 2653 content-type text/html cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" cross-origin-resource-policy cross-origin date Tue, 26 Mar 2024 15:17:34 GMT expires Wed, 26 Mar 2025 15:17:34 GMT last-modified Thu, 03 Nov 2022 19:10:08 GMT report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} server sffe timing-allow-origin * vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 9D49	0 0	97ms 97ms	Fetch image/gif	142.251.41.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssM-TeMmOYuXNzFNqPpto-TayBgMl-KXKLVlPEW_DaBaF6cJPe69obnX8KzV18_IZPsISeF06EW_Jxygm2ipbJxghceBac8Wtu6LE2ofQbCDEv8qzJljjJZqZwNM68fSYOGkNqyRTC_NX_DoEn9VFF8iq68390Y_mBaTUKBOiuEhWkBUe30U3XN5sI6cLA2CQiCMsGtbKaIlhLuOcvsuqJbLreyGojuYvi_BWClZYEHMKwkkjFBVwSGbPa_h0F_gIryeGrccg6suHj6jMR0n7E651JY0-W5rUlT7XpjQUReeQw6AJsviiNa6APO-s0YnnuCMn4KxG1g5FeW7decup1_qjppPZGLc99kA_2C-lnFyh6clwVikw&sai=AMfl-YTsvmCXn9Kbf44z7ghVVqjVDb49gWNaFCG910GByqMa4Vr0maD3FMmVNRregivLnt-jjVK_8BzQxjfeEId9sXkDfq5crAdHVdaf4w8Z1JtPGqQY_6NqkjOBMpLxAI03RC8hb3Qp7bM7mGuobesCN3c&sig=Cg0ArKJSzJjNSd3xs5IJEAE&uach_m=%5BUACH%5D&urlfix=1&adurl= Requested by Host: ihanaloma.ru.com URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.41.2 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s40-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 15:17:34 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 server cafe content-type image/gif access-control-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control private cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Tue, 26 Mar 2024 15:17:34 GMT
GET H3	200	ufs_web_display.js Show response pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 9D49	214 KB 65 KB	73ms 23ms	Script text/javascript	142.250.72.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js?cb=31082082 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s32-in-f2.1e100.net Software cafe / Resource Hash 98727e12c24ab43d1f3a871c66c5ce44070e1cedf37bdc9ff476233b8183688b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 14:26:38 GMT content-encoding br x-content-type-options nosniff age 3056 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 66532 x-xss-protection 0 server cafe etag vary Accept-Encoding content-type text/javascript; charset=ISO-8859-1 cache-control public, max-age=3600, stale-while-revalidate=3600 timing-allow-origin * expires Tue, 26 Mar 2024 15:26:38 GMT
GET H2	200	AdvContent20x20.png i3.plug.it/banners/img/	537 B 918 B	229ms 24ms	Image image/png	13.226.34.6 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://i3.plug.it/banners/img/AdvContent20x20.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.226.34.6 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-226-34-6.ewr53.r.cloudfront.net Software nginx / Resource Hash 68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 06:33:31 GMT via 1.1 94344436af750794f6bc9899d89d3a0a.cloudfront.net (CloudFront) last-modified Tue, 09 Jun 2020 08:23:45 GMT server nginx x-amz-cf-pop EWR53-C2 age 31443 etag "5edf4711-219" vary Origin x-cache Hit from cloudfront content-type image/png cache-control max-age=1200, public accept-ranges bytes content-length 537 x-amz-cf-id KuUUTwyf5A_H1N0KpvcPokUgtvpqAiiGiL-20hmBUIuo6cDCDPeGqA== expires Tue, 26 Mar 2024 06:53:31 GMT
GET H2	200	1455025947066887833 tpc.googlesyndication.com/simgad/	240 KB 241 KB	104ms 33ms	Image image/jpeg	2607:f8b0:4006:809::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/1455025947066887833? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:809::2001 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ab12209d372b231e5151f5753ccd4d8652491601626a246c99eece8aee02d933 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Thu, 20 Mar 2025 08:04:07 GMT date Wed, 20 Mar 2024 08:04:07 GMT x-content-type-options nosniff age 544407 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 245889 x-xss-protection 0 last-modified Fri, 08 Apr 2022 08:19:09 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" allow-fenced-frame-automatic-beacons true
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 7 KB	192ms 129ms	Script text/javascript	2607:f8b0:4006:809::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202403190101/pubads_impl.js?cb=31082082 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:809::2001 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 15:17:34 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 6386 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" etag "1637097310169751" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Tue, 26 Mar 2024 15:17:34 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 9D49	0 0	82ms 81ms	Fetch image/gif	142.250.72.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s32-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Tue, 26 Mar 2024 15:17:34 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET DATA	200 OK	truncated / Frame 9D49	215 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0e4f710c3cfec248d9860821d7e5e86ed7c55d19443dd5745b7207f902ae2e8f Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 9D49	0 0	169ms 101ms	Fetch image/gif	142.251.41.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstgX8p79-euW_hlsR-CrIrz4qwlvzdb5XN6m7yKuaMca91kz0FIe8eKCQp7ffZb6MMkXrAA_E9ehCgxb5REltZJ0zmm-IIpvMIv59mcDPZRnxtz2Z-rL5fO7BX30mmJgD2UgSOlNcAIoWptYajd5vmLEKRKqKcb9DUZArhCmpN1ChVUXCpDegDJY1Rye4Eg_pPCNzkrXAXR-i17iq8aWWXsOSRPIC9DRXfgzILj546UzT20z6GMaDSNK8VPwleLRsNQiCgCz_bEXn3V6ktVNJ5hjlLiYkAaEo6PxoOfKeSQiT4nlDQdsWQvkha2IumqeT1I4TdDlTlbKM--uRFTlFQuRSxOFVA1IpyqNarrUEZEOzAsJ61QyzTZ&sai=AMfl-YRN0mrM3KbGhOoBiHLbbZbxWkQ7rXXN9EkMDzWETaA-u8kIYTUi71NCWViAfRNOJ3tA_1Lbn1xBvfQGafR254Nw4cAr8-HNSvar21AewS_FmBat9CUqTxqotBq7NxqmqwODTHOKyPLsjq99OpBqR3U&sig=Cg0ArKJSzK-CUkWdFCp6EAE&uach_m=%5BUACH%5D&urlfix=1&adurl= Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.251.41.2 Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s40-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://ihanaloma.ru.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 26 Mar 2024 15:17:34 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 server cafe content-type image/gif access-control-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control private cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Tue, 26 Mar 2024 15:17:34 GMT
GET H2	200	runner.html tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1259	0 0	94ms 29ms	Document text/html	2607:f8b0:4006:809::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:809::2001 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ihanaloma.ru.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language en-US,en;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers accept-ranges bytes age 545126 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding gzip content-length 5046 content-type text/html cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" cross-origin-resource-policy cross-origin date Wed, 20 Mar 2024 07:52:08 GMT expires Thu, 20 Mar 2025 07:52:08 GMT last-modified Mon, 21 Jun 2021 20:47:05 GMT report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} server sffe vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
GET H3	200	aframe www.google.com/recaptcha/api2/ Frame F2B2	0 0	121ms 47ms	Document text/html	142.250.72.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.72.100 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s32-in-f4.1e100.net Software GSE / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-zDVjgeP39m15wMz58gc63w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ihanaloma.ru.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language en-US,en;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, max-age=300 content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-zDVjgeP39m15wMz58gc63w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Tue, 26 Mar 2024 15:17:34 GMT expires Tue, 26 Mar 2024 15:17:34 GMT report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} server GSE x-content-type-options nosniff x-xss-protection 1; mode=block
GET		sodar pagead2.googlesyndication.com/pagead/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

italiaonline.profiles.tagger.opecloud.com

URL

https://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&gdpr_applies=0

Domain

www.iolam.it

URL

https://www.iolam.it/service/trk

Domain

pagead2.googlesyndication.com

URL

https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202403190101&jk=1809280314413798&bg=!HB-lH1DNAAay2Dj3ktg7ADQBe5WfOM_7-qkzNZyk2oqXBgKrfR_9l0Vll6wZYB1jYI6dLHKTQVRo1DpcSlgjLSvSMnnyAgAAAElSAAAAA2gBB34ANWHUoK2rHkB6rPk_VqCV5upbNg5drK9bSrJkxiwpUopb-nTpBwBz14QS99H2cdVduNwUu0ClmQLUxlqq1zwu7NeYY9dkxxjXC6zKrw3_oHL6hIwM3jgoivY6gB6pybtBx0xdfAWPMRyK15p16MKwQNyEjoB2B1ELJhRo8URUcvKz05q2ywFFnx34qy3xa9YgLkmWjfude9WPKlTUfKSlPrF3MMx6Zhuh8k2Edrm9ymtYndFgZmd_nE3VAB8cS8v8JobcEk1LUTnryMuLyQ8jf58HPmyy_YNWE-jrUkAaQcWnNoDJXI8peOFFcU_KJrOqiUw41DuHtvnJ8x1OYciUgrLr4bOqvHp5-mhs4zYgFuFereSIzPBa9DHWIcqRWeyoenxueYGCeWtQxpJcpfKvb_CC6Tp3oPa2ZKF7DvYBx8Q5Fc2lwLq6TgYkmU8QL8iNsE8oFVs9RvulhstU4UkUn1kt6n-UP58HbhmcoXr8oB4Pt4VY5aW4u4BL1F52QDPZjQImZeJju8JF_jxTIo6rvkwEAWXvuC8vfwVoCqRiezmEdTFOVOY3im9OYM0KmsSR475GqJtB26HVAadUSgQpyRu0larKt_X4xxHZkOq-u67slcIB2tOAdv-2trUGJbzC0vfZCfdLoJh227i6cCHWXsYNIUWCbCnnIu4mHHkq-W0PyebUOqPEavmK4kdssXpjOtxevmkZ_969uZVB54iiUZ9RBHKpUoFxpRs4RXRILLMyJSeHpyRd8jm5YXtwQYWFQcI7Jx4grGO8up1MGEHijg3Dlb2CY0QHXvx4ne9-oaRHZy9G5Ol97S15eGjc7ts8D_x7Yhb_4AObfFF3uTvzYBHoLQujc4_Ll03gfRel1Hm0d2R0l_hIuAP8DfsR3GQGIM0tM7q6-DgyNAue4vqlEapYGoPks8WsUwrJ6IrRzKop5PVjFWd8-udBM1IaD0gauzM-TS3JEt41gZa35dUXdg9ZBzMrerVTfDbror1x_42eaFkv0u7v5XvmruYVww-u5dKaCW4veXwkqZmBzw

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Libero (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| onpagereveal function| $ function| jQuery object| Placeholders object| IOL boolean| iamInitialized object| pubAdsCfg object| grumi object| googletag object| ggeac object| google_tag_data object| google_js_reporting_queue undefined| google_measure_js_timing number| google_unique_id object| gaGlobal object| GoogleGcLKhOms

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ihanaloma.ru.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: ffb4a295ec2630a28e9921081f2ed62d
			.doubleclick.net/	1970-01-21 05:00:26	Name: IDE Value: AHWqTUl7Idytgk5NpUxWCcjvEXiMV_Iv2TsTmm-edij6E5vWiNJk9L_8Bkta1kItonc

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/;);%20background-repeat:%20no-repeat;%20background-color:%20rgb(104,%20231,%20255);%20background-position:%20center%20top; Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Access to XMLHttpRequest at 'https://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&gdpr_applies=0' from origin 'https://ihanaloma.ru.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=https%3A%2F%2Fihanaloma.ru.com%2Filibero%2Fitalia%2Flibero2024%2Findex.php&gdpr_applies=0 Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
javascript	error	URL: https://ihanaloma.ru.com/ilibero/italia/libero2024/index.php Message: Access to XMLHttpRequest at 'https://www.iolam.it/service/trk' from origin 'https://ihanaloma.ru.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.iolam.it/service/trk Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

317d06816f9e46c554d4f1add57101e4.safeframe.googlesyndication.com
ajax.googleapis.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
i3.plug.it
ihanaloma.ru.com
italiaonline.profiles.tagger.opecloud.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.google.com
www.iolam.it
italiaonline.profiles.tagger.opecloud.com
pagead2.googlesyndication.com
www.iolam.it
103.150.31.10
104.17.25.14
13.226.34.6
142.250.72.100
142.250.72.98
142.251.41.2
213.209.30.161
2607:f8b0:4006:809::2001
2607:f8b0:4006:80d::2001
2607:f8b0:4006:80e::2003
2607:f8b0:4006:80e::200a
2607:f8b0:4006:820::200a
2607:f8b0:4006:824::2002
3.127.130.203
0e4f710c3cfec248d9860821d7e5e86ed7c55d19443dd5745b7207f902ae2e8f
148c0dcd3eff6305eaffe3600d31334604cc02591259020e54d8835be0e20dfe
1e7271f832628acc449ce087d6d75f51739b98094a637c4169940287705ba497
1fe53cf7f03d12af875315353f6ab8df7a936fa9e26cbe0c5e2f1dc7269652b8
270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820
54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9
6118449023eeb110ad7ad07186662f882d9239127250731054a4e9293172943a
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6371356d9cb87a361f550a77f374e58eb68a25ab048440a04e11fba1cc575876
68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c
694adc42b1e12c4edc69f43c2aaafea20e28d55d4ee73c3505cd1bf8b90e3452
6daf2cbb6b06d294c4c917c1dc43cbbb0ffd2a5896a771c09a8fc82e2a0ab6cd
714ceeb7a00f469992815693f00100f9a225389238f074904ec1967783eb20a0
98727e12c24ab43d1f3a871c66c5ce44070e1cedf37bdc9ff476233b8183688b
ab12209d372b231e5151f5753ccd4d8652491601626a246c99eece8aee02d933
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
bb631cb41d70ab6f8a07ab80b053676bca8589e7e1d835827f30e1bffbed91c5
c3bb98f605190d7a1534fc5b58d78ebd872944e2c2fdcc6f6963bb1a3a748ae8
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fba1ebd847c9826cd1bb0482cb11ba739012cd4b4003af92ab28b8b559a8e8de
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e