URL: https://cs2.eragaming.ru/
Submission Tags: phishingrod
Submission: On June 28 via api from DE — Scanned from DE

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 21 HTTP transactions. The main IP is 80.255.187.114, located in Yaroslavl, Russian Federation and belongs to TENSOR-AS Yaroslavl branch, RU. The main domain is cs2.eragaming.ru.
TLS certificate: Issued by E6 on June 27th 2024. Valid for: 3 months.
This is the only time cs2.eragaming.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
15 80.255.187.114 30881 (TENSOR-AS...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a04:4e42:600... 54113 (FASTLY)
3 2a00:1450:400... 15169 (GOOGLE)
21 4
Apex Domain
Subdomains
Transfer
15 eragaming.ru
cs2.eragaming.ru
917 KB
3 gstatic.com
fonts.gstatic.com
47 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381
449 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83
1 KB
21 4
Domain Requested by
15 cs2.eragaming.ru cs2.eragaming.ru
3 fonts.gstatic.com fonts.googleapis.com
2 cdn.jsdelivr.net cs2.eragaming.ru
cdn.jsdelivr.net
1 fonts.googleapis.com cs2.eragaming.ru
21 4

This site contains no links.

Subject Issuer Validity Valid
cs2.eragaming.ru
E6
2024-06-27 -
2024-09-25
3 months crt.sh
upload.video.google.com
WR2
2024-06-13 -
2024-09-05
3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3
2023-09-27 -
2024-10-28
a year crt.sh
*.gstatic.com
WR2
2024-06-13 -
2024-09-05
3 months crt.sh

This page contains 1 frames:

Primary Page: https://cs2.eragaming.ru/
Frame ID: C5B7A2B6895960C74A97E10361468831
Requests: 21 HTTP requests in this frame

Screenshot

Page Title

G5V

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

21
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

1415 kB
Transfer

1706 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
cs2.eragaming.ru/
2 KB
2 KB
Document
General
Full URL
https://cs2.eragaming.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy nginx/1.27.0 /
Resource Hash
fd46e5edd122379ba638ecb2c33e66313403704c0b80b491ca67fa719ea7d4a8

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000
content-length
1635
content-type
text/html
date
Fri, 28 Jun 2024 09:07:06 GMT
etag
"66759ef1-663"
last-modified
Fri, 21 Jun 2024 15:40:33 GMT
server
Caddy nginx/1.27.0
css
fonts.googleapis.com/
13 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700,900
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4680f0242ae53304a6bf932234579ecf1100b3473bd822857943a3e5a2e01f8d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Fri, 28 Jun 2024 09:07:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 28 Jun 2024 08:15:57 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 28 Jun 2024 09:07:06 GMT
materialdesignicons.min.css
cdn.jsdelivr.net/npm/@mdi/font@latest/css/
339 KB
55 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
03fe3caba05e65b14e4035139eee89b12be87cd0bcf342ac3886770eec3a9962
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 28 Jun 2024 09:07:06 GMT
x-content-type-options
nosniff
content-encoding
br
age
7022
x-jsd-version
7.4.47
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
55843
x-served-by
cache-fra-etou8220075-FRA
x-jsd-version-type
version
etag
W/"54a02-OVjZUfBzAil15Q3gxxGhe/obcD8"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
chunk-vendors.91e2255c.js
cs2.eragaming.ru/js/
383 KB
383 KB
Script
General
Full URL
https://cs2.eragaming.ru/js/chunk-vendors.91e2255c.js
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy, nginx/1.27.0 /
Resource Hash
9fe5585ab0875e605dad91a98311aaff95352dbe7e3044ca9fc0cb26420ae0ab

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 28 Jun 2024 09:07:06 GMT
last-modified
Fri, 21 Jun 2024 15:40:33 GMT
server
Caddy, nginx/1.27.0
etag
"66759ef1-5fb5c"
content-type
application/javascript
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000
content-length
392028
app.7801ddf4.js
cs2.eragaming.ru/js/
81 KB
81 KB
Script
General
Full URL
https://cs2.eragaming.ru/js/app.7801ddf4.js
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy, nginx/1.27.0 /
Resource Hash
93ef5c669caad39ae0dc7064ecc98c20e940efe6999d78b96b068f7d99e33410

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 28 Jun 2024 09:07:06 GMT
last-modified
Fri, 21 Jun 2024 15:40:33 GMT
server
Caddy, nginx/1.27.0
etag
"66759ef1-14311"
content-type
application/javascript
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000
content-length
82705
chunk-vendors.7455ebe1.css
cs2.eragaming.ru/css/
389 KB
389 KB
Stylesheet
General
Full URL
https://cs2.eragaming.ru/css/chunk-vendors.7455ebe1.css
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy, nginx/1.27.0 /
Resource Hash
2048dc018a02b3086fa6eb5c140661e4ada8a19d3807cf351032e50e35be466b

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 28 Jun 2024 09:07:06 GMT
last-modified
Fri, 21 Jun 2024 15:40:33 GMT
server
Caddy, nginx/1.27.0
etag
"66759ef1-61289"
content-type
text/css
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000
content-length
397961
652.a0b769b5.js
cs2.eragaming.ru/js/
34 KB
34 KB
Script
General
Full URL
https://cs2.eragaming.ru/js/652.a0b769b5.js
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/js/app.7801ddf4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy, nginx/1.27.0 /
Resource Hash
62503643d830794860bc644e2822cf3fe7e44e5998632b88a036e24840ed12b1

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 28 Jun 2024 09:07:06 GMT
last-modified
Fri, 21 Jun 2024 15:40:33 GMT
server
Caddy, nginx/1.27.0
etag
"66759ef1-88a4"
content-type
application/javascript
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000
content-length
34980
Home.44f5d4a3.css
cs2.eragaming.ru/css/
11 KB
11 KB
Stylesheet
General
Full URL
https://cs2.eragaming.ru/css/Home.44f5d4a3.css
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/js/app.7801ddf4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy, nginx/1.27.0 /
Resource Hash
f62b94e535dca5cc4a771e5d63791bb9df365b8109b4eaaf38dea14c4b65298e

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 28 Jun 2024 09:07:06 GMT
last-modified
Fri, 21 Jun 2024 15:40:33 GMT
server
Caddy, nginx/1.27.0
etag
"66759ef1-2d8f"
content-type
text/css
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000
content-length
11663
Home.67f84c07.js
cs2.eragaming.ru/js/
10 KB
10 KB
Script
General
Full URL
https://cs2.eragaming.ru/js/Home.67f84c07.js
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/js/app.7801ddf4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy, nginx/1.27.0 /
Resource Hash
91c447ff5ebd7c1f05fb55c7821050a7348bbaee688b8effe66cd8f8aaadad69

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 28 Jun 2024 09:07:06 GMT
last-modified
Fri, 21 Jun 2024 15:40:33 GMT
server
Caddy, nginx/1.27.0
etag
"66759ef1-28df"
content-type
application/javascript
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000
content-length
10463
isLoggedIn
cs2.eragaming.ru/api/
5 B
731 B
XHR
General
Full URL
https://cs2.eragaming.ru/api/isLoggedIn
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/js/chunk-vendors.91e2255c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy /
Resource Hash
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/json, text/plain, */*
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date
Fri, 28 Jun 2024 09:07:06 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
same-origin
alt-svc
h3=":443"; ma=2592000
content-length
5
x-xss-protection
0
referrer-policy
no-referrer
server
Caddy
cross-origin-opener-policy
same-origin
etag
W/"5-fLbvuYullyqbUJDcLlF/4U0SywQ"
x-download-options
noopen
vary
Origin
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
https://cs2.eragaming.ru
origin-agent-cluster
?1
access-control-allow-credentials
true
isLoggedIn
cs2.eragaming.ru/api/
5 B
143 B
XHR
General
Full URL
https://cs2.eragaming.ru/api/isLoggedIn
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/js/chunk-vendors.91e2255c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy /
Resource Hash
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/json, text/plain, */*
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date
Fri, 28 Jun 2024 09:07:06 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
same-origin
alt-svc
h3=":443"; ma=2592000
content-length
5
x-xss-protection
0
referrer-policy
no-referrer
server
Caddy
cross-origin-opener-policy
same-origin
etag
W/"5-fLbvuYullyqbUJDcLlF/4U0SywQ"
x-download-options
noopen
vary
Origin
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
https://cs2.eragaming.ru
origin-agent-cluster
?1
access-control-allow-credentials
true
materialdesignicons-webfont.woff2
cdn.jsdelivr.net/npm/@mdi/font@latest/fonts/
394 KB
394 KB
Font
General
Full URL
https://cdn.jsdelivr.net/npm/@mdi/font@latest/fonts/materialdesignicons-webfont.woff2?v=7.4.47
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
662fefa8f2f8a95c18588d21774789c107c64e771cbe65a69af46291c4311afc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cdn.jsdelivr.net/npm/@mdi/font@latest/css/materialdesignicons.min.css
Origin
https://cs2.eragaming.ru
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 28 Jun 2024 09:07:06 GMT
x-content-type-options
nosniff
age
16741
x-jsd-version
7.4.47
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
403216
x-served-by
cache-fra-eddf8230085-FRA
x-jsd-version-type
version
etag
W/"62710-TiD2zPQxmd6lyFsjoODwuoH/7iY"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://cs2.eragaming.ru
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 17:31:01 GMT
x-content-type-options
nosniff
age
56165
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 17:31:01 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://cs2.eragaming.ru
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 07:43:41 GMT
x-content-type-options
nosniff
age
91405
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 07:43:41 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://cs2.eragaming.ru
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 20:58:55 GMT
x-content-type-options
nosniff
age
43691
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15920
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 20:58:55 GMT
leaderboard
cs2.eragaming.ru/api/
18 B
207 B
XHR
General
Full URL
https://cs2.eragaming.ru/api/leaderboard
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/js/chunk-vendors.91e2255c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy /
Resource Hash
9e7d607d861c4ab4b59853f4c71b4bd43094f292dfd8c09501d2da6a36a85ebd
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/json, text/plain, */*
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date
Fri, 28 Jun 2024 09:07:06 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
same-origin
alt-svc
h3=":443"; ma=2592000
content-length
18
x-xss-protection
0
referrer-policy
no-referrer
server
Caddy
cross-origin-opener-policy
same-origin
etag
W/"12-Lc1kHAu2e7uQk1/+jkV2PW+O/Ec"
x-download-options
noopen
vary
Origin
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
https://cs2.eragaming.ru
origin-agent-cluster
?1
access-control-allow-credentials
true
players
cs2.eragaming.ru/api/leaderboard/
18 B
58 B
XHR
General
Full URL
https://cs2.eragaming.ru/api/leaderboard/players
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/js/chunk-vendors.91e2255c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy /
Resource Hash
9e7d607d861c4ab4b59853f4c71b4bd43094f292dfd8c09501d2da6a36a85ebd
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/json, text/plain, */*
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date
Fri, 28 Jun 2024 09:07:06 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
same-origin
alt-svc
h3=":443"; ma=2592000
content-length
18
x-xss-protection
0
referrer-policy
no-referrer
server
Caddy
cross-origin-opener-policy
same-origin
etag
W/"12-Lc1kHAu2e7uQk1/+jkV2PW+O/Ec"
x-download-options
noopen
vary
Origin
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
https://cs2.eragaming.ru
origin-agent-cluster
?1
access-control-allow-credentials
true
3
cs2.eragaming.ru/api/matches/limit/
14 B
85 B
XHR
General
Full URL
https://cs2.eragaming.ru/api/matches/limit/3
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/js/chunk-vendors.91e2255c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy /
Resource Hash
1329bed5a664bbf035723754d90023adf1034d44b942c070a37741a1b762d35c
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/json, text/plain, */*
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date
Fri, 28 Jun 2024 09:07:06 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
same-origin
alt-svc
h3=":443"; ma=2592000
content-length
14
x-xss-protection
0
referrer-policy
no-referrer
server
Caddy
cross-origin-opener-policy
same-origin
etag
W/"e-WYK4BnUZblp67DSj6h3zsi1C62g"
x-download-options
noopen
vary
Origin
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
https://cs2.eragaming.ru
origin-agent-cluster
?1
access-control-allow-credentials
true
isLoggedIn
cs2.eragaming.ru/api/
5 B
29 B
XHR
General
Full URL
https://cs2.eragaming.ru/api/isLoggedIn
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/js/chunk-vendors.91e2255c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy /
Resource Hash
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/json, text/plain, */*
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date
Fri, 28 Jun 2024 09:07:06 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
same-origin
alt-svc
h3=":443"; ma=2592000
content-length
5
x-xss-protection
0
referrer-policy
no-referrer
server
Caddy
cross-origin-opener-policy
same-origin
etag
W/"5-fLbvuYullyqbUJDcLlF/4U0SywQ"
x-download-options
noopen
vary
Origin
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
access-control-allow-origin
https://cs2.eragaming.ru
origin-agent-cluster
?1
access-control-allow-credentials
true
login_small.png
cs2.eragaming.ru/img/
5 KB
5 KB
Image
General
Full URL
https://cs2.eragaming.ru/img/login_small.png
Requested by
Host: cs2.eragaming.ru
URL: https://cs2.eragaming.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy, nginx/1.27.0 /
Resource Hash
b7ebcdfa3017de021ad7fb7198717178c8a79e69b0f38aa2bb455a020e60b41c

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 28 Jun 2024 09:07:06 GMT
last-modified
Fri, 21 Jun 2024 15:40:33 GMT
server
Caddy, nginx/1.27.0
etag
"66759ef1-12ef"
content-type
image/png
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000
content-length
4847
favicon.svg
cs2.eragaming.ru/img/icons/
539 B
595 B
Other
General
Full URL
https://cs2.eragaming.ru/img/icons/favicon.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.255.187.114 Yaroslavl, Russian Federation, ASN30881 (TENSOR-AS Yaroslavl branch, RU),
Reverse DNS
pppoe-80.255.187.114.ttel.ru
Software
Caddy, nginx/1.27.0 /
Resource Hash
756d19f48603ea7fa2aff9b33c449dbee6d7ee07824d830f60b0324a2e10ba13

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cs2.eragaming.ru/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 28 Jun 2024 09:07:06 GMT
last-modified
Fri, 21 Jun 2024 15:40:33 GMT
server
Caddy, nginx/1.27.0
etag
"66759ef1-21b"
content-type
image/svg+xml
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000
content-length
539

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| webpackChunkg5v

1 Cookies

Domain/Path Name / Value
cs2.eragaming.ru/ Name: G5API
Value: s%3AY8Ef88qvxkz2Tsl6tfP3RhQm9hMWx4Nj.eMiKGALz6GAeQyKgQilWsaGHQaussRo9htYZmuCKY4U

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cs2.eragaming.ru
fonts.googleapis.com
fonts.gstatic.com
2a00:1450:4001:800::200a
2a00:1450:4001:829::2003
2a04:4e42:600::485
80.255.187.114
03fe3caba05e65b14e4035139eee89b12be87cd0bcf342ac3886770eec3a9962
1329bed5a664bbf035723754d90023adf1034d44b942c070a37741a1b762d35c
2048dc018a02b3086fa6eb5c140661e4ada8a19d3807cf351032e50e35be466b
4680f0242ae53304a6bf932234579ecf1100b3473bd822857943a3e5a2e01f8d
62503643d830794860bc644e2822cf3fe7e44e5998632b88a036e24840ed12b1
662fefa8f2f8a95c18588d21774789c107c64e771cbe65a69af46291c4311afc
756d19f48603ea7fa2aff9b33c449dbee6d7ee07824d830f60b0324a2e10ba13
91c447ff5ebd7c1f05fb55c7821050a7348bbaee688b8effe66cd8f8aaadad69
93ef5c669caad39ae0dc7064ecc98c20e940efe6999d78b96b068f7d99e33410
9e7d607d861c4ab4b59853f4c71b4bd43094f292dfd8c09501d2da6a36a85ebd
9fe5585ab0875e605dad91a98311aaff95352dbe7e3044ca9fc0cb26420ae0ab
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b7ebcdfa3017de021ad7fb7198717178c8a79e69b0f38aa2bb455a020e60b41c
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f62b94e535dca5cc4a771e5d63791bb9df365b8109b4eaaf38dea14c4b65298e
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
fd46e5edd122379ba638ecb2c33e66313403704c0b80b491ca67fa719ea7d4a8