best-dates-here.com
Open in
urlscan Pro
217.69.15.95
Malicious Activity!
Public Scan
Effective URL: https://best-dates-here.com/?u=7pfk605&o=e9ym176&t=456926_popcash&cid=a41ae7291565898ab2b61d1bfe1aecba-11246-0130
Submission: On January 30 via manual from IL
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on December 13th 2019. Valid for: 3 months.
This is the only time best-dates-here.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 31.170.100.126 31.170.100.126 | 201942 (SOLTIA) (SOLTIA) | |
1 2 | 109.123.118.67 109.123.118.67 | 13213 (UK2NET-AS) (UK2NET-AS) | |
1 | 188.40.16.23 188.40.16.23 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 1 | 94.23.206.47 94.23.206.47 | 16276 (OVH) (OVH) | |
1 3 | 198.143.165.219 198.143.165.219 | 32475 (SINGLEHOP...) (SINGLEHOP-LLC) | |
1 | 205.147.93.131 205.147.93.131 | 393676 (ZENEDGE) (ZENEDGE) | |
1 2 | 18.211.45.57 18.211.45.57 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 2a03:b0c0:3:d... 2a03:b0c0:3:d0::d13:7001 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
12 | 217.69.15.95 217.69.15.95 | 20473 (AS-CHOOPA) (AS-CHOOPA) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:81b::2003 | 15169 (GOOGLE) (GOOGLE) | |
23 | 10 |
ASN13213 (UK2NET-AS, GB)
PTR: 118-67.topstaffsolutions.com
tr4ck.bruceleadx2.com |
ASN24940 (HETZNER-AS, DE)
PTR: static.23.16.40.188.clients.your-server.de
1d616fe9445.clicks-tc.com |
ASN32475 (SINGLEHOP-LLC, US)
PTR: server04.com-2.mobi
now.loading-wsite.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-45-57.compute-1.amazonaws.com
getad.xyz |
ASN14061 (DIGITALOCEAN-ASN, US)
track.discoverapp.xyz |
ASN20473 (AS-CHOOPA, US)
PTR: 217.69.15.95.vultr.com
best-dates-here.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
best-dates-here.com
best-dates-here.com |
521 KB |
3 |
loading-wsite.com
1 redirects
now.loading-wsite.com |
5 KB |
2 |
gstatic.com
fonts.gstatic.com |
28 KB |
2 |
getad.xyz
getad.xyz Failed |
754 B |
2 |
bruceleadx2.com
1 redirects
tr4ck.bruceleadx2.com |
3 KB |
1 |
googleapis.com
fonts.googleapis.com |
2 KB |
1 |
discoverapp.xyz
1 redirects
track.discoverapp.xyz |
609 B |
1 |
minently.com
minently.com |
3 KB |
1 |
go-rillatrack.com
1 redirects
go-rillatrack.com |
355 B |
1 |
clicks-tc.com
1d616fe9445.clicks-tc.com |
1 KB |
1 |
musboon.com
mobi.musboon.com |
533 B |
23 | 11 |
Domain | Requested by | |
---|---|---|
12 | best-dates-here.com |
getad.xyz
best-dates-here.com |
3 | now.loading-wsite.com |
1 redirects
now.loading-wsite.com
|
2 | fonts.gstatic.com |
best-dates-here.com
|
2 | getad.xyz |
minently.com
|
2 | tr4ck.bruceleadx2.com | 1 redirects |
1 | fonts.googleapis.com |
best-dates-here.com
|
1 | track.discoverapp.xyz | 1 redirects |
1 | minently.com |
now.loading-wsite.com
|
1 | go-rillatrack.com | 1 redirects |
1 | 1d616fe9445.clicks-tc.com |
tr4ck.bruceleadx2.com
|
1 | mobi.musboon.com | |
23 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.clicks-tc.com Let's Encrypt Authority X3 |
2020-01-10 - 2020-04-09 |
3 months | crt.sh |
now.loading-wsite.com Let's Encrypt Authority X3 |
2020-01-03 - 2020-04-02 |
3 months | crt.sh |
minently.com Let's Encrypt Authority X3 |
2019-12-11 - 2020-03-10 |
3 months | crt.sh |
best-dates-here.com Let's Encrypt Authority X3 |
2019-12-13 - 2020-03-12 |
3 months | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-01-07 - 2020-03-31 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-01-14 - 2020-04-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://best-dates-here.com/?u=7pfk605&o=e9ym176&t=456926_popcash&cid=a41ae7291565898ab2b61d1bfe1aecba-11246-0130
Frame ID: 9C5FFA297682A191C65FD0A429703A38
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://mobi.musboon.com/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/ecd6d08f-f... Page URL
- http://tr4ck.bruceleadx2.com/ck.php?line_item_id=17994&site=&cid=M2020013007-d4550e54e2ab77bc879fc9c90125... Page URL
-
http://tr4ck.bruceleadx2.com/ck_jump?id=cz0zMjgwNjIzMTM0MTcyODczNiZ0PTE1ODAzNjkyNTMmaD02MjI4MTIxNDc=&__if...
HTTP 302
https://1d616fe9445.clicks-tc.com/?p=5947&media_type=mainstream&pi=UzoyMzg4LFNCOiosTDoxNzk5NCxDOjE4ODE5&click_... Page URL
-
http://go-rillatrack.com/b.php?trf=m&p=custom_trafficompany&d=5caf619098142974e1094aa0&pid=5lo46hzgy5...
HTTP 302
https://now.loading-wsite.com/?utm_medium=044188730a0d579726ff030f34159eece2e383db&utm_campaign=MS&1=5947&... Page URL
- https://now.loading-wsite.com/?utm_term=6787634261567471720&clickverify=1&utm_content=e6c2c6dcd68fd49594fc... Page URL
-
https://now.loading-wsite.com/proc.php?3f55790a81c1ac886913a391acd2b747c5df887d
HTTP 302
https://minently.com/RnSda/rDN3/ojdn/-nsy7qV12RbEJREofa-9SEFI3YukEcIdVCna0zeC8rcq89okAHvP?qDo=MS_... Page URL
- http://getad.xyz/go/216668/456926 Page URL
-
http://getad.xyz/ad/ad?p=216668&w=456926&t=c1da539a6f3b2ee2&r=aHR0cHMlM0ElMkYlMkZtaW5lbnRseS5...
HTTP 303
https://track.discoverapp.xyz/15GeVW?siteid=456926&cost=0.00031 HTTP 302
https://best-dates-here.com/?u=7pfk605&o=e9ym176&t=456926_popcash&cid=a41ae7291565898ab2b61d1bfe1aecba-1... Page URL
Detected technologies
animate.css (Web Frameworks) ExpandDetected patterns
- html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://mobi.musboon.com/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/ecd6d08f-fc2681ec-d8bef6f3-7659-f353 Page URL
- http://tr4ck.bruceleadx2.com/ck.php?line_item_id=17994&site=&cid=M2020013007-d4550e54e2ab77bc879fc9c90125249e Page URL
-
http://tr4ck.bruceleadx2.com/ck_jump?id=cz0zMjgwNjIzMTM0MTcyODczNiZ0PTE1ODAzNjkyNTMmaD02MjI4MTIxNDc=&__if=0&__pm=0&__wv=0&__type=unknown&__deviceid=
HTTP 302
https://1d616fe9445.clicks-tc.com/?p=5947&media_type=mainstream&pi=UzoyMzg4LFNCOiosTDoxNzk5NCxDOjE4ODE5&click_id=&click_id=20200130_fb710db4-4331-11ea-bbd9-5570f6275b94 Page URL
-
http://go-rillatrack.com/b.php?trf=m&p=custom_trafficompany&d=5caf619098142974e1094aa0&pid=5lo46hzgy50ghlir3do0s48co,14331597,5,5947&source=5947
HTTP 302
https://now.loading-wsite.com/?utm_medium=044188730a0d579726ff030f34159eece2e383db&utm_campaign=MS&1=5947&cid=5e328566981429474863c007 Page URL
- https://now.loading-wsite.com/?utm_term=6787634261567471720&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b78784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45f Page URL
-
https://now.loading-wsite.com/proc.php?3f55790a81c1ac886913a391acd2b747c5df887d
HTTP 302
https://minently.com/RnSda/rDN3/ojdn/-nsy7qV12RbEJREofa-9SEFI3YukEcIdVCna0zeC8rcq89okAHvP?qDo=MS_WW_Desktop&subid=6787634261567471720&ext1=6437 Page URL
- http://getad.xyz/go/216668/456926 Page URL
-
http://getad.xyz/ad/ad?p=216668&w=456926&t=c1da539a6f3b2ee2&r=aHR0cHMlM0ElMkYlMkZtaW5lbnRseS5jb20lMkY=&vw=1600&vh=1200
HTTP 303
https://track.discoverapp.xyz/15GeVW?siteid=456926&cost=0.00031 HTTP 302
https://best-dates-here.com/?u=7pfk605&o=e9ym176&t=456926_popcash&cid=a41ae7291565898ab2b61d1bfe1aecba-11246-0130 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- http://tr4ck.bruceleadx2.com/ck_jump?id=cz0zMjgwNjIzMTM0MTcyODczNiZ0PTE1ODAzNjkyNTMmaD02MjI4MTIxNDc=&__if=0&__pm=0&__wv=0&__type=unknown&__deviceid= HTTP 302
- https://1d616fe9445.clicks-tc.com/?p=5947&media_type=mainstream&pi=UzoyMzg4LFNCOiosTDoxNzk5NCxDOjE4ODE5&click_id=&click_id=20200130_fb710db4-4331-11ea-bbd9-5570f6275b94
- http://go-rillatrack.com/b.php?trf=m&p=custom_trafficompany&d=5caf619098142974e1094aa0&pid=5lo46hzgy50ghlir3do0s48co,14331597,5,5947&source=5947 HTTP 302
- https://now.loading-wsite.com/?utm_medium=044188730a0d579726ff030f34159eece2e383db&utm_campaign=MS&1=5947&cid=5e328566981429474863c007
- https://now.loading-wsite.com/proc.php?3f55790a81c1ac886913a391acd2b747c5df887d HTTP 302
- https://minently.com/RnSda/rDN3/ojdn/-nsy7qV12RbEJREofa-9SEFI3YukEcIdVCna0zeC8rcq89okAHvP?qDo=MS_WW_Desktop&subid=6787634261567471720&ext1=6437
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
ecd6d08f-fc2681ec-d8bef6f3-7659-f353
mobi.musboon.com/f6612a1d516725be822f3424f22fe64f/e3513143202a282b3c89436ac2877991/ |
198 B 533 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
ck.php
tr4ck.bruceleadx2.com/ |
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
1d616fe9445.clicks-tc.com/ Redirect Chain
|
1003 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
now.loading-wsite.com/ Redirect Chain
|
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
now.loading-wsite.com/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
-nsy7qV12RbEJREofa-9SEFI3YukEcIdVCna0zeC8rcq89okAHvP
minently.com/RnSda/rDN3/ojdn/ Redirect Chain
|
4 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
456926
getad.xyz/go/216668/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
456926
getad.xyz/go/216668/ |
466 B 517 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
best-dates-here.com/ Redirect Chain
|
7 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
animate.min.css
best-dates-here.com/media/dating/toon2/css/ |
52 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
best-dates-here.com/media/dating/toon2/css/ |
8 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js.cookie.js
best-dates-here.com/cookie/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utils.js
best-dates-here.com/util/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
123.jpg
best-dates-here.com/media/dating/toon2/images/ |
175 KB 175 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.2.4.min.js
best-dates-here.com/media/dating/toon2/js/ |
84 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
trls.js
best-dates-here.com/media/dating/toon2/js/ |
28 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bb.js
best-dates-here.com/media/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
exit-popup.css
best-dates-here.com/media/exit-new/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
exit1.js
best-dates-here.com/media/exit-new/ |
32 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
36 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.jpg
best-dates-here.com/media/dating/toon2/images/ |
117 KB 117 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v16/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- getad.xyz
- URL
- http://getad.xyz/go/216668/456926?
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)47 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate number| exDays boolean| validNavigation function| wireUpEvents function| Cookies function| docReady function| getParameterByName function| hideUnsub function| languageDetection function| writeLocation object| geoRefData function| showLocation function| appendPixels undefined| randomNumber function| $ function| jQuery object| translation string| language function| replace_text function| translation_available function| detect_language function| translate object| _0x1b1f function| _0x2cf4 boolean| PreventBb function| getUrlParameter function| getUrlWithParam string| popup_style string| popup_glow string| thePopup string| current_href boolean| PreventExitSplash object| alert_lang function| trans_available function| detect_lang string| lang string| exitsplashpage string| exitsplashmessage function| appendHtml function| DisplayExitSplash function| addLoadEvent function| addClickEvent object| a function| disablelinksfunc function| disableformsfunc object| x2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
best-dates-here.com/ | Name: s1 Value: a8k7hs27qsey8b7q |
|
best-dates-here.com/ | Name: ASP.NET_SessionId Value: horv5oozuwcgsxg5ptisk3br |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1d616fe9445.clicks-tc.com
best-dates-here.com
fonts.googleapis.com
fonts.gstatic.com
getad.xyz
go-rillatrack.com
minently.com
mobi.musboon.com
now.loading-wsite.com
tr4ck.bruceleadx2.com
track.discoverapp.xyz
getad.xyz
109.123.118.67
18.211.45.57
188.40.16.23
198.143.165.219
205.147.93.131
217.69.15.95
2a00:1450:4001:80b::200a
2a00:1450:4001:81b::2003
2a03:b0c0:3:d0::d13:7001
31.170.100.126
94.23.206.47
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
03909eb2c20124e62bfad448545d33b1aee8e76ba292c3c5fc15af47c9f804cc
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1c7361fcec43aecb4c517914dde9ecbf1fe1aaa0969411a7a383391236f335f4
38ce84d98596983e7f10e96d9d4d65e8b0e851fdc0827df1a5f769f263601f4c
408885915473803c26419ec9081d1df03b88afbc52d44d4838ed57923dc3a1d2
5a07b844b7898003a027b72a08fad5f65190eb22594d3f6206da37ca0e3fd265
5aa5a69b6cca81fde78fcfffa75e3a33fe55106185e05935e40ae7f4fe214214
5afa3f15b4b80206a6663f95a1db9de15c05b7eed13f75d24500696fe2a77576
71b3ccd070734cf41f0e6f5b75ad779985000aa62c90dd549bec10f3f9c9f1ee
807855a6e13cc2a2811e2c02365c1396327322018d26a3b8e5898e53de7154da
8c02b7f983ebe2b97b25ffbeba72dbfb4ac6f242d1bd608e698af1598012699a
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
985659942ab60a92b3c0a7f876d9ef60e8f048ff655a622a172fa4b44f901b6c
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
b5eaefef0eb2427539cd7059a04802b9f9c4b98bc81de89d613ba28dca234b04
dec8296da072c9e67ea3a14718871dd607645f3fef81039c29ac850aea4ee2a9
e75ec428166ac71ec8fe6a6dcd91e7977b379afad36aaf9b355d3c69038b9ab5
eb4cddbab2c7f5130a908640411b18092a2dc8c523f41fb745dbdef3467c45f8
f6113b1f6bdd279404fd53c920f6ba411b66a897db4c67e16d2129af22370a57
f61d61e21e118725699a14b9b85a45185b12fbfea3220818c5ea6f811d520f29
f689bac1fcf5a197b3d3d41efc249bd4d27782133d7cdd1dc880424e800aca84