![](/screenshots/23c2cef2-dd8d-4053-8465-f5de9e8d22e7.png)
clicksud.biz
Open in
urlscan Pro
2606:4700:3032::ac43:ce32
Public Scan
Submission: On November 16 via api from LU — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on September 22nd 2023. Valid for: 3 months.
This is the only time clicksud.biz was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
ASN2635 (AUTOMATTIC, US)
PTR: i0.wp.com
i1.wp.com | |
i0.wp.com | |
i3.wp.com |
ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com |
ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
yalapwl.xyz
yalapwl.xyz |
96 KB |
13 |
clicksud.biz
1 redirects
clicksud.biz |
213 KB |
9 |
imgur.com
i.imgur.com — Cisco Umbrella Rank: 7022 |
660 KB |
8 |
wp.com
8 redirects
i1.wp.com — Cisco Umbrella Rank: 8598 i0.wp.com — Cisco Umbrella Rank: 3823 i3.wp.com — Cisco Umbrella Rank: 52597 |
2 KB |
6 |
gstatic.com
fonts.gstatic.com |
162 KB |
4 |
yandex.ru
1 redirects
mc.yandex.ru — Cisco Umbrella Rank: 4034 |
72 KB |
3 |
yandex.com
1 redirects
mc.yandex.com — Cisco Umbrella Rank: 8755 |
2 KB |
3 |
unpkg.com
unpkg.com — Cisco Umbrella Rank: 903 |
41 KB |
2 |
videocdnmetrika.com
videocdnmetrika.com — Cisco Umbrella Rank: 139580 |
2 KB |
2 |
yadro.ru
1 redirects
counter.yadro.ru — Cisco Umbrella Rank: 11595 |
1 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 335 |
87 KB |
1 |
dns.google
dns.google — Cisco Umbrella Rank: 1140 |
526 B |
1 |
sadjklq.com
sadjklq.com — Cisco Umbrella Rank: 155318 |
1014 B |
1 |
alleviatepracticableaddicted.com
alleviatepracticableaddicted.com — Cisco Umbrella Rank: 227123 |
|
1 |
doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 |
4 KB |
1 |
commentsmodule.com
commentsmodule.com — Cisco Umbrella Rank: 113921 |
|
1 |
googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 97 |
52 KB |
1 |
cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 899 |
7 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
2 KB |
0 |
duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion
Failed
duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion Failed |
|
62 | 20 |
Domain | Requested by | |
---|---|---|
14 | yalapwl.xyz |
clicksud.biz
yalapwl.xyz unpkg.com |
13 | clicksud.biz |
1 redirects
clicksud.biz
static.cloudflareinsights.com |
9 | i.imgur.com |
clicksud.biz
|
6 | fonts.gstatic.com |
fonts.googleapis.com
|
4 | mc.yandex.ru |
1 redirects
yalapwl.xyz
videocdnmetrika.com |
4 | i1.wp.com | 4 redirects |
3 | mc.yandex.com |
1 redirects
yalapwl.xyz
|
3 | unpkg.com |
yalapwl.xyz
|
2 | videocdnmetrika.com |
sadjklq.com
videocdnmetrika.com |
2 | counter.yadro.ru |
1 redirects
yalapwl.xyz
|
2 | i3.wp.com | 2 redirects |
2 | i0.wp.com | 2 redirects |
1 | cdn.jsdelivr.net |
videocdnmetrika.com
|
1 | dns.google |
yalapwl.xyz
|
1 | sadjklq.com |
yalapwl.xyz
|
1 | alleviatepracticableaddicted.com |
yalapwl.xyz
|
1 | googleads.g.doubleclick.net |
pagead2.googlesyndication.com
|
1 | commentsmodule.com |
yalapwl.xyz
|
1 | pagead2.googlesyndication.com |
yalapwl.xyz
|
1 | static.cloudflareinsights.com |
clicksud.biz
|
1 | fonts.googleapis.com |
clicksud.biz
|
0 | duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion Failed |
yalapwl.xyz
|
62 | 22 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.facebook.com |
api.whatsapp.com |
reddit.com |
telegram.me |
vk.com |
bit.ly |
www.twitch.tv |
Subject Issuer | Validity | Valid | |
---|---|---|---|
clicksud.biz GTS CA 1P5 |
2023-09-22 - 2023-12-21 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.imgur.com Sectigo RSA Domain Validation Secure Server CA |
2023-03-13 - 2024-03-12 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-10 - 2024-04-09 |
a year | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
commentsmodule.com GTS CA 1P5 |
2023-10-12 - 2024-01-10 |
3 months | crt.sh |
alleviatepracticableaddicted.com R3 |
2023-10-29 - 2024-01-27 |
3 months | crt.sh |
sadjklq.com GTS CA 1P5 |
2023-09-24 - 2023-12-23 |
3 months | crt.sh |
mc.yandex.ru GlobalSign ECC OV SSL CA 2018 |
2023-08-14 - 2024-01-24 |
5 months | crt.sh |
dns.google GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
videocdnmetrika.com GTS CA 1P5 |
2023-09-28 - 2023-12-27 |
3 months | crt.sh |
This page contains 5 frames:
Primary Page:
https://clicksud.biz/2023/04/taximetristi-2023-online-film-romanesc-hd/
Frame ID: 7ABAE08545EA7DABF75D533F5590A8E2
Requests: 27 HTTP requests in this frame
Frame:
https://yalapwl.xyz/e/K2dSYVRtcW9EeTlTMmhJYkhkUzN0Zz09
Frame ID: A68830A49FFF97338FE01D6E0BEF0F8D
Requests: 27 HTTP requests in this frame
Frame:
https://clicksud.biz/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Frame ID: D3078ECB5444BD861D549C9EB928310E
Requests: 2 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/html/r20231109/r20190131/zrt_lookup_fy2021.html
Frame ID: 87BFED17DA2BDAC91ABBAEB38FCF6372
Requests: 1 HTTP requests in this frame
Frame:
https://videocdnmetrika.com/f.php?sid=212040
Frame ID: 4F4B546C4B4594D63DA4FE94C46C8B8D
Requests: 5 HTTP requests in this frame
Screenshot
![](/screenshots/23c2cef2-dd8d-4053-8465-f5de9e8d22e7.png)
Page Title
Taximetristi (2023) online film romanescDetected technologies
Detected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- /wp-(?:content|includes)/
Detected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Detected patterns
- googlesyndication\.com/
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
![](/vendor/wappa/icons/Yandex.Metrika.png)
Detected patterns
- mc\.yandex\.ru/metrika/(?:tag|watch)\.js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Title: Facebook
Search URL Search Domain Scan URL
Title: WhatsApp
Search URL Search Domain Scan URL
Title: ReddIt
Search URL Search Domain Scan URL
Title: Telegram
Search URL Search Domain Scan URL
Title: VK
Search URL Search Domain Scan URL
Title: Raportează o problemă!
Search URL Search Domain Scan URL
Title: Facebook
Search URL Search Domain Scan URL
Title: Twitch
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 13- https://i1.wp.com/i.imgur.com/OyuPI1v.jpg?resize=218&w=218 HTTP 302
- https://i.imgur.com/OyuPI1v.jpg
- https://i0.wp.com/i.imgur.com/4vEQ7Xi.jpg?resize=218&w=218 HTTP 302
- https://i.imgur.com/4vEQ7Xi.jpg
- https://i0.wp.com/i.imgur.com/tVF8jUr.jpg?resize=218&w=218 HTTP 302
- https://i.imgur.com/tVF8jUr.jpg
- https://i1.wp.com/i.imgur.com/JZPIzrv.jpg?resize=324&w=324 HTTP 302
- https://i.imgur.com/JZPIzrv.jpg
- https://i1.wp.com/i.imgur.com/RX9HzhL.jpg?resize=324&w=324 HTTP 302
- https://i.imgur.com/RX9HzhL.jpg
- https://i3.wp.com/i.imgur.com/qxksnja.jpg?resize=324&w=324 HTTP 302
- https://i.imgur.com/qxksnja.jpg
- https://i3.wp.com/i.imgur.com/PjVZd9h.jpg?resize=324&w=324 HTTP 302
- https://i.imgur.com/PjVZd9h.jpg
- https://i1.wp.com/i.imgur.com/DWhwApS.jpg?resize=324&w=324 HTTP 302
- https://i.imgur.com/DWhwApS.jpg
- https://clicksud.biz/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://clicksud.biz/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
- https://counter.yadro.ru/hit?rhttps%3A//clicksud.biz/;s1600*1200*24;uhttps%3A//yalapwl.xyz/e/K2dSYVRtcW9EeTlTMmhJYkhkUzN0Zz09%23iss%3DMmEwMTo0YTA6MTMzODo5Mjo6MTE%3D;0.16394200384822688 HTTP 302
- https://counter.yadro.ru/hit?q;rhttps%3A//clicksud.biz/;s1600*1200*24;uhttps%3A//yalapwl.xyz/e/K2dSYVRtcW9EeTlTMmhJYkhkUzN0Zz09%23iss%3DMmEwMTo0YTA6MTMzODo5Mjo6MTE%3D;0.16394200384822688
- https://mc.yandex.com/watch/54046198?wmode=7&page-url=https%3A%2F%2Fyalapwl.xyz%2Fe%2FK2dSYVRtcW9EeTlTMmhJYkhkUzN0Zz09%23iss%3DMmEwMTo0YTA6MTMzODo5Mjo6MTE%3D&page-ref=https%3A%2F%2Fclicksud.biz%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1161%3Acn%3A1%3Adp%3A0%3Als%3A103481695398%3Ahid%3A921165501%3Az%3A60%3Ai%3A20231116142002%3Aet%3A1700140803%3Ac%3A1%3Arn%3A821834563%3Arqn%3A1%3Au%3A170014080391949315%3Aw%3A689x380%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Awv%3A2%3Ads%3A0%2C100%2C194%2C28%2C1%2C0%2C%2C386%2C1%2C%2C%2C%2C742%3Aco%3A0%3Acpf%3A1%3Ans%3A1700140801281%3Arqnl%3A1%3Ast%3A1700140803%3At%3AVideo%20player&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(1) HTTP 302
- https://mc.yandex.com/watch/54046198/1?wmode=7&page-url=https%3A%2F%2Fyalapwl.xyz%2Fe%2FK2dSYVRtcW9EeTlTMmhJYkhkUzN0Zz09%23iss%3DMmEwMTo0YTA6MTMzODo5Mjo6MTE%3D&page-ref=https%3A%2F%2Fclicksud.biz%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1161%3Acn%3A1%3Adp%3A0%3Als%3A103481695398%3Ahid%3A921165501%3Az%3A60%3Ai%3A20231116142002%3Aet%3A1700140803%3Ac%3A1%3Arn%3A821834563%3Arqn%3A1%3Au%3A170014080391949315%3Aw%3A689x380%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Awv%3A2%3Ads%3A0%2C100%2C194%2C28%2C1%2C0%2C%2C386%2C1%2C%2C%2C%2C742%3Aco%3A0%3Acpf%3A1%3Ans%3A1700140801281%3Arqnl%3A1%3Ast%3A1700140803%3At%3AVideo%20player&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29&redirnss=1
- https://mc.yandex.ru/watch/90175160?wmode=7&page-url=https%3A%2F%2Fvideocdnmetrika.com%2Ff.php%3Fsid%3D212040&page-ref=https%3A%2F%2Fyalapwl.xyz%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckruryr72ly1stmj07z%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1161%3Acn%3A1%3Adp%3A0%3Als%3A243625880874%3Ahid%3A791663765%3Az%3A60%3Ai%3A20231116142002%3Aet%3A1700140803%3Ac%3A1%3Arn%3A1028411662%3Arqn%3A1%3Au%3A1700140803645224154%3Aw%3A1x1%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Awv%3A2%3Ads%3A0%2C105%2C143%2C0%2C0%2C0%2C%2C16%2C0%2C%2C%2C%2C282%3Aco%3A0%3Acpf%3A1%3Ans%3A1700140802236%3Arqnl%3A1%3Ast%3A1700140803%3At%3A&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(1) HTTP 302
- https://mc.yandex.ru/watch/90175160/1?wmode=7&page-url=https%3A%2F%2Fvideocdnmetrika.com%2Ff.php%3Fsid%3D212040&page-ref=https%3A%2F%2Fyalapwl.xyz%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckruryr72ly1stmj07z%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1161%3Acn%3A1%3Adp%3A0%3Als%3A243625880874%3Ahid%3A791663765%3Az%3A60%3Ai%3A20231116142002%3Aet%3A1700140803%3Ac%3A1%3Arn%3A1028411662%3Arqn%3A1%3Au%3A1700140803645224154%3Aw%3A1x1%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Awv%3A2%3Ads%3A0%2C105%2C143%2C0%2C0%2C0%2C%2C16%2C0%2C%2C%2C%2C282%3Aco%3A0%3Acpf%3A1%3Ans%3A1700140802236%3Arqnl%3A1%3Ast%3A1700140803%3At%3A&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29
62 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
clicksud.biz/2023/04/taximetristi-2023-online-film-romanesc-hd/ |
316 KB 49 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
20afa215cae204ec71986b2af0c7c332.css
clicksud.biz/wp-content/cache/min/1/ |
948 KB 113 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
24 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clicksud-1-min.png
clicksud.biz/wp-content/uploads/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6iFWBCO.jpg
i.imgur.com/ |
54 KB 54 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
mgoZZFP.jpg
clicksud.biz/wp-content/uploads/ |
272 B 806 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKtdSZaM9iE8KbpRA_hK1QN.woff2
fonts.gstatic.com/s/quicksand/v31/ |
27 KB 28 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ |
47 KB 47 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
newspaper.woff
clicksud.biz/wp-content/themes/Newspaper/images/icons/ |
33 KB 33 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ |
12 KB 12 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKtdSZaM9iE8KbpRA_hJVQNcOM.woff2
fonts.gstatic.com/s/quicksand/v31/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2
fonts.gstatic.com/s/opensans/v36/ |
34 KB 34 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
email-decode.min.js
clicksud.biz/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OyuPI1v.jpg
i.imgur.com/ Redirect Chain
|
74 KB 74 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4vEQ7Xi.jpg
i.imgur.com/ Redirect Chain
|
86 KB 86 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tVF8jUr.jpg
i.imgur.com/ Redirect Chain
|
161 KB 162 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JZPIzrv.jpg
i.imgur.com/ Redirect Chain
|
42 KB 42 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RX9HzhL.jpg
i.imgur.com/ Redirect Chain
|
52 KB 52 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qxksnja.jpg
i.imgur.com/ Redirect Chain
|
90 KB 90 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PjVZd9h.jpg
i.imgur.com/ Redirect Chain
|
36 KB 36 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DWhwApS.jpg
i.imgur.com/ Redirect Chain
|
63 KB 64 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lazyload.min.js
clicksud.biz/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v84a3a4012de94ce1a686ba8c167c359c1696973893317
static.cloudflareinsights.com/beacon.min.js/ |
20 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
l_arrow_red.png
clicksud.biz/wp-content/plugins/wpnextpreviouslink/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
r_arrow_red.png
clicksud.biz/wp-content/plugins/wpnextpreviouslink/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K2dSYVRtcW9EeTlTMmhJYkhkUzN0Zz09
yalapwl.xyz/e/ Frame A688 |
149 KB 38 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
clicksud.biz/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/ Frame D307 Redirect Chain
|
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
827007624cb501bb
clicksud.biz/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame D307 |
0 580 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
websocket_ip.min.js
yalapwl.xyz/js/ Frame A688 |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
email-decode.min.js
yalapwl.xyz/cdn-cgi/scripts/5c5dd728/cloudflare-static/ Frame A688 |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
embed_player.3.css
yalapwl.xyz/styles/global/ Frame A688 |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr.js
yalapwl.xyz/js/video.jquery_plugs/ Frame A688 |
1 KB 922 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
progressbar.min.js
unpkg.com/progressbar.js@1.1.0/dist/ Frame A688 |
29 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
unpkg.com/jquery@2.2.4/dist/ Frame A688 |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.cookie.js
unpkg.com/jquery.cookie@1.4.1/ Frame A688 |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d_check.js
yalapwl.xyz/js/ Frame A688 |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
embed.229.js
yalapwl.xyz/js/ Frame A688 |
168 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popunder.js
yalapwl.xyz/ad/top/ Frame A688 |
21 B 385 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame A688 |
150 KB 52 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ Frame A688 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fuckadblock.js
yalapwl.xyz/js/adv/ Frame A688 |
14 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js.load.1.js
commentsmodule.com/js/ Frame A688 |
0 0 |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zrt_lookup_fy2021.html
googleads.g.doubleclick.net/pagead/html/r20231109/r20190131/ Frame 87BF |
9 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script_33.10.js
yalapwl.xyz/js/ Frame A688 |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
trace
yalapwl.xyz/cdn-cgi/ Frame A688 |
311 B 416 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ab0be2a44b7ecf91bdbd5cd360d84937.js
alleviatepracticableaddicted.com/ab/0b/e2/ Frame A688 |
0 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
video.counters.2.js
yalapwl.xyz/js/ Frame A688 |
696 B 1013 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
netu.php
sadjklq.com/ Frame A688 |
1 KB 1014 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tag.js
mc.yandex.ru/metrika/ Frame A688 |
200 KB 70 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hit
counter.yadro.ru/ Frame A688 Redirect Chain
|
43 B 528 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
resolve
dns.google/ Frame A688 |
334 B 526 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f.php
videocdnmetrika.com/ Frame 4F4B |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner.gif
videocdnmetrika.com/ads/ Frame 4F4B |
42 B 415 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tag.js
cdn.jsdelivr.net/npm/yandex-metrica-watch/ Frame 4F4B |
215 KB 87 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
advert.gif
mc.yandex.com/metrika/ Frame A688 |
43 B 475 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1
mc.yandex.com/watch/54046198/ Frame A688 Redirect Chain
|
447 B 557 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
advert.gif
mc.yandex.ru/metrika/ Frame 4F4B |
43 B 271 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1
mc.yandex.ru/watch/90175160/ Frame 4F4B Redirect Chain
|
427 B 463 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
rum
clicksud.biz/cdn-cgi/ |
0 138 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_adview_.ad.json
yalapwl.xyz/ad/banner/_adsense_/_adserver/ Frame A688 |
2 B 418 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_adview_.ad.json
yalapwl.xyz/ad/banner/_adsense_/_adserver/ Frame A688 |
2 B 415 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion
- URL
- https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/favicon.ico
Verdicts & Comments Add Verdict or Comment
14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 object| documentPictureInPicture undefined| href object| wpra object| WPACCallbacks object| fifuImageVars object| wpnextpreviouslink_public object| lazyLoadOptions function| LazyLoad object| __cfBeacon22 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.clicksud.biz/ | Name: cf_clearance Value: Pa4h.v9JiiggR5dTBiETWTHRU_Nz99VubJXtqG1TWvY-1700140801-0-1-3c8e7555.33e405.d0a70d1a-0.2.1700140801 |
|
yalapwl.xyz/ | Name: uid Value: uplXu6PuAlOQmWo3T0kjsBt**g46Pwej |
|
.yadro.ru/ | Name: FTID Value: 1bLXS20SWMOg1bLXS2003995 |
|
.yadro.ru/ | Name: VID Value: 2-gvm800NCeg1bLXS2003Pbo |
|
.yandex.ru/ | Name: i Value: ShyfrIeeJgruGtdbV4ItXKKoslBVLUkzBFMoY8tJCEXa6BMrdI3IppgX+uJ9HkCeW1tXN+bB5b8xdiJuTGkiCIdCxxE= |
|
.yandex.ru/ | Name: yandexuid Value: 7925269601700140802 |
|
.yalapwl.xyz/ | Name: _ym_uid Value: 170014080391949315 |
|
.yalapwl.xyz/ | Name: _ym_d Value: 1700140803 |
|
mc.yandex.com/ | Name: yabs-sid Value: 766981401700140802 |
|
.yandex.com/ | Name: yuidss Value: 1548480751700140802 |
|
.yandex.com/ | Name: ymex Value: 1731676802.yrts.1700140802#1731676802.yrtsi.1700140802 |
|
.yandex.com/ | Name: bh Value: KgI/MA== |
|
.videocdnmetrika.com/ | Name: _ym_uid Value: 1700140803645224154 |
|
.videocdnmetrika.com/ | Name: _ym_d Value: 1700140803 |
|
.yandex.com/ | Name: i Value: WsCWK5wDB/6Vs/XfDq3a+kE6aFkXZ2vy+mHpUjl1HXYdIxMhC1ZoDjsz/7AYLbDf8i7JX0zHx14TlE6Qh62BWu7qSvE= |
|
.yandex.com/ | Name: yandexuid Value: 4036443381700140802 |
|
.yalapwl.xyz/ | Name: _ym_isad Value: 2 |
|
mc.yandex.ru/ | Name: yabs-sid Value: 2373034031700140802 |
|
.yandex.ru/ | Name: yuidss Value: 7925269601700140802 |
|
.yandex.ru/ | Name: ymex Value: 1731676802.yrts.1700140802 |
|
.yandex.ru/ | Name: bh Value: KgI/MA== |
|
.videocdnmetrika.com/ | Name: _ym_isad Value: 2 |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
alleviatepracticableaddicted.com
cdn.jsdelivr.net
clicksud.biz
commentsmodule.com
counter.yadro.ru
dns.google
duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.imgur.com
i0.wp.com
i1.wp.com
i3.wp.com
mc.yandex.com
mc.yandex.ru
pagead2.googlesyndication.com
sadjklq.com
static.cloudflareinsights.com
unpkg.com
videocdnmetrika.com
yalapwl.xyz
duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion
146.75.116.193
173.233.137.44
192.0.77.2
2001:4860:4860::8844
2606:4700:3030::6815:5738
2606:4700:3032::6815:2662
2606:4700:3032::ac43:ce32
2606:4700:3036::6815:b61
2606:4700::6810:3865
2606:4700::6810:5814
2606:4700::6810:7daf
2a00:1450:4001:806::2002
2a00:1450:4001:828::2002
2a00:1450:4001:828::200a
2a00:1450:4001:830::2003
2a02:6b8::1:119
2a06:98c1:3121::3
88.212.202.52
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
05dd67b141d06912491380a569333b78ccc6d2a38105b479830b63389fef0c56
0ce28c49e2139d11fb1975a2aae3f10f5855a1421444aa7ea1a1d03178514fb7
140c0600601a25bf467e3d8f5f1b2eaa9a6aa48987ee81b6b75bddd953253a24
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f4572fade8966e740e06b1eb069dcff0c26364839a245cc36c7c7a6961b2e5c
34310731b79445f958ec982df1cb3793cea4f125f0a192a110d08203f4015c10
39db6855768d1a1c3fdea4bfe265a325dd52a17a49b1f97423e8f06df457f739
419b600e2a3d2523ed458633a946a9a07fcf046077f0ea79f3e435f154f04ee7
425b5d41a0870d778c4e7c6cbbe75a25ef1d228f91e496d99bd46893e1d80519
458cc3be215bef898d5e6a41e25f0c022e6d5d5e61add13f13c01898bb53b9bc
461a8f40fe6308ce4f17c5e1514e5aa28af91f443ec757cb14425e0a408d046a
472aa6bfc4a46a6e125ab18fef5cd85a8a065d3fb0c70a9f06e28a8ea4a659f5
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54d5792e37008bd3ce28d4831554e3c30eec13427bb2a1b4e0638c6913f77a98
5a42c91e1ecc9b09346a1520d9a6f98074c13eebfb1cc87c4e82e5992beb685b
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
616302627ba5b2eb25b3ce54904945cafb9ee94622ae793179dc4e88414b976c
623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016
6de84b73da25d5b99460ece630dc34f28945b71c016e9a1bcf51277aed7a6851
73cdea3ea0691f9ac4150be0c937dc2ee7eaa10205168a84e41ef5c9e05784b7
743eb99eb066a15c714c9deb9e1a9402c3aa869c54dde33d50e2ec281c7d3e00
7e5965a6eb681ef5f8a59dacd6e8c8263dcbbb512e441e532fee942a90c4c7ea
7f1c829b0c90fd664a03bb714a74f7d35d9e38ee1687104abc8ad5bd9c8ccb6c
7f747bee2364ba2e1f150ca17a9b4483674903684f2b20a9060d8890beacf540
803bd4bf8d7643b7c7cb1a3cb7e3ba194b241a5bcb51ea33a3a293c0e2fad72d
8242bea524220a4d6b10461cff17e594c1bb6ded57c17bd55dbae1c4a08da42b
84d13f28fa66b7c6a27998c4b1f2670e74efe40218489b6626da725ae741a5dd
88e33d38aa577708d4cb0230edfddbbc348ed7dd6af3224797bee28eae0f2c7a
8b48b76666a244374347e5945f7ffd260fe5c3ffb97a0843f9e0c09c1180d3db
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
8d5f8ef5fa0c3b76ad715a94bcc4573f860d8291e0c2af7632b506d57b558349
8df358ee6ecd6cbb7466f6e31f9529bed03ff78ac08830b35796092ce23d18e9
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
a499068cf858aa2cd9b077e2e354b6bf8435eaa8e44c2047f403c7283031977f
a54f8bf8f586c5af5de03154b4e16b0318edcc8076c56c21a7eff0bb710e336e
a806d6151b2ea97598f90c7cd00fd6bdcea9e7deb2f3da8a15dce09577a0bd79
a822fc87475fe72aa7e5bfbe7a12bf6c649d6adfa611b41d7138fa06a6cdfa69
ac8e8ffc35ba53190925d14ab161e6ca52390305a820f53dcd8acaf5fee759bb
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
b96c59c082710d4ffb7d27e3f25fac6893552db47190148f95f22ac7b5961b42
c072a27a7f4cb8208cfde8fa44b56a477e71027dc8a34657a993a22fd309872a
d2054b9fb412f742d8d13aa75a48e59b830094999f9000ae8c69916e11b8d805
d478d8a4c24cc557d5a141de9e8e0761eea06e3336271f5696cfda068c14e597
d64b0fd1077283ea512832b3ace63687279aec678a7aaef6e894e6a00c39d96c
d9784dbf11886ea032ffbd00f499d333519babe001eacc19df7ab89de17bec47
d9bcbaa520858fdbfc18666d53ed90678678b65c9ca3020be759939843d90b63
e2f1967bd0ff37182a4c0d4af0ae9cb04cdcbd189cec906bc2e2d9e0a36209e7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f140ccf5cbd8bee72a1ccff6b05759fde131c9005e38169132fd1beb24aa3c00
fcc8ce9811f88009783b34ee73ff5314ce760e0c611c2aaf5c4ef65961b0813e