www.ramadaneidbazaar.com.au
Open in
urlscan Pro
192.185.98.74
Malicious Activity!
Public Scan
Effective URL: https://www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login.php?cmd=login_submit&id=2911ad1d767eb7...
Submission: On November 11 via manual from HU
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on October 11th 2019. Valid for: 3 months.
This is the only time www.ramadaneidbazaar.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Erste Bank (Banking)Domain & IP information
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: 192-185-98-74.unifiedlayer.com
www.ramadaneidbazaar.com.au |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
cdn0.erstegroup.com |
ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net |
ASN15169 (GOOGLE - Google LLC, US)
www.google.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google.de |
ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net |
ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
erste02.talkabot.net |
ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
61 |
ramadaneidbazaar.com.au
1 redirects
www.ramadaneidbazaar.com.au |
2 MB |
6 |
google-analytics.com
1 redirects
www.google-analytics.com |
18 KB |
3 |
facebook.com
www.facebook.com |
493 B |
3 |
facebook.net
connect.facebook.net |
109 KB |
3 |
wbtrk.net
cdn.wbtrk.net geid.wbtrk.net |
2 KB |
3 |
erstegroup.com
cdn0.erstegroup.com |
104 KB |
2 |
wcfbc.net
1 redirects
fbc.wcfbc.net |
744 B |
2 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
talkabot.net
erste02.talkabot.net |
62 KB |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
google.de
www.google.de |
109 B |
1 |
google.com
1 redirects
www.google.com |
191 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net |
160 B |
1 |
webtrekk.net
erstegroup01.webtrekk.net |
638 B |
1 |
googletagmanager.com
www.googletagmanager.com |
34 KB |
0 |
erstebank.hu
Failed
www.erstebank.hu Failed |
|
86 | 16 |
Domain | Requested by | |
---|---|---|
61 | www.ramadaneidbazaar.com.au |
1 redirects
www.ramadaneidbazaar.com.au
|
6 | www.google-analytics.com |
1 redirects
www.ramadaneidbazaar.com.au
|
3 | www.facebook.com |
www.ramadaneidbazaar.com.au
|
3 | connect.facebook.net |
www.ramadaneidbazaar.com.au
connect.facebook.net |
3 | cdn0.erstegroup.com |
www.ramadaneidbazaar.com.au
|
2 | fbc.wcfbc.net |
1 redirects
www.ramadaneidbazaar.com.au
|
2 | geid.wbtrk.net |
www.ramadaneidbazaar.com.au
|
2 | fonts.googleapis.com |
www.ramadaneidbazaar.com.au
|
1 | erste02.talkabot.net |
www.ramadaneidbazaar.com.au
|
1 | fonts.gstatic.com |
www.ramadaneidbazaar.com.au
|
1 | www.google.de |
www.ramadaneidbazaar.com.au
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
1 | erstegroup01.webtrekk.net |
www.ramadaneidbazaar.com.au
|
1 | cdn.wbtrk.net |
www.ramadaneidbazaar.com.au
|
1 | www.googletagmanager.com |
www.ramadaneidbazaar.com.au
|
0 | www.erstebank.hu Failed | |
86 | 17 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ramadaneidbazaar.com.au Let's Encrypt Authority X3 |
2019-10-11 - 2020-01-09 |
3 months | crt.sh |
cdn0.erstegroup.com DigiCert Global CA G2 |
2019-08-27 - 2020-08-31 |
a year | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2019-10-16 - 2020-01-08 |
3 months | crt.sh |
*.wbtrk.net Go Daddy Secure Certificate Authority - G2 |
2018-01-12 - 2021-01-12 |
3 years | crt.sh |
*.webtrekk.net Go Daddy Secure Certificate Authority - G2 |
2018-01-08 - 2021-01-08 |
3 years | crt.sh |
*.googleapis.com GTS CA 1O1 |
2019-10-16 - 2020-01-08 |
3 months | crt.sh |
www.google.de GTS CA 1O1 |
2019-10-16 - 2020-01-08 |
3 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2019-09-22 - 2019-12-20 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2019-10-16 - 2020-01-08 |
3 months | crt.sh |
*.talkabot.net COMODO RSA Domain Validation Secure Server CA |
2018-12-10 - 2020-12-09 |
2 years | crt.sh |
fbc.wcfbc.net Go Daddy Secure Certificate Authority - G2 |
2018-01-11 - 2021-01-11 |
3 years | crt.sh |
This page contains 3 frames:
Primary Page:
https://www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login.php?cmd=login_submit&id=2911ad1d767eb7ceca66a2894a2303682911ad1d767eb7ceca66a2894a230368&session=2911ad1d767eb7ceca66a2894a2303682911ad1d767eb7ceca66a2894a230368
Frame ID: 57C352345C8282A1D2EAB593375EF9B1
Requests: 28 HTTP requests in this frame
Frame:
https://www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/netbank-login-hu.html
Frame ID: 42F4EBEA751A4268E431CA8011950B13
Requests: 58 HTTP requests in this frame
Frame:
https://www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/DkKH4pReUF2dxMQdi.html
Frame ID: 24AB45D7D1AADA538615F9CCD039ED91
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/index.php
HTTP 302
https://www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login.php?cmd=login_subm... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Bootstrap (Web Frameworks) Expand
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
RequireJS (JavaScript Frameworks) Expand
Detected patterns
- script /require.*\.js/i
Dynatrace (Analytics) Expand
Detected patterns
- script /dtagent.*\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/index.php
HTTP 302
https://www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login.php?cmd=login_submit&id=2911ad1d767eb7ceca66a2894a2303682911ad1d767eb7ceca66a2894a230368&session=2911ad1d767eb7ceca66a2894a2303682911ad1d767eb7ceca66a2894a230368 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 59- https://www.google-analytics.com/r/collect?v=1&_v=j79&a=836936434&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ramadaneidbazaar.com.au%2Feste%2Fauthenticationfiles%2Fprelogondirectauth%2Fproceed%2Flogin_files%2Fnetbank-login-hu.html&ul=en-us&de=UTF-8&dt=Netbank%20Login%20Hungarian&sd=24-bit&sr=1600x1200&vp=1137x900&je=0&_u=YEBAAEAB~&jid=1503523186&gjid=167677635&cid=364128458.1573463191&tid=UA-33280811-1&_gid=1560785164.1573463191&_r=1>m=2wgaa0P7X6DP5&cd5=GTM-P7X6DP5&cd6=27&cd7=navigate&cd8=0&cd13=false&z=1116245176 HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-33280811-1&cid=364128458.1573463191&jid=1503523186&_gid=1560785164.1573463191&gjid=167677635&_v=j79&z=1116245176 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33280811-1&cid=364128458.1573463191&jid=1503523186&_v=j79&z=1116245176 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33280811-1&cid=364128458.1573463191&jid=1503523186&_v=j79&z=1116245176&slf_rd=1&random=1435658503
- https://fbc.wcfbc.net/v1/fbc?p=441,0&eid=2157346319064135721&acc=185198974225326&t=1573463191088&err= HTTP 307
- https://fbc.wcfbc.net/v1/fbc?p=441,0&eid=2157346319064135721&acc=185198974225326&t=1573463191088&err=&rc
86 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dtagent_ICA23TVbgjopqrst_7000200051022.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
128 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
444 KB 168 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AppConfiguration.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
12 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ThemeConfiguration.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
8 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
124 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
erste-structure.css
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
88 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
erste.css
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Footer.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
1 KB 720 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LoginHeader.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
1 KB 626 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lang-hun.png
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
131 B 168 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lang-eng.png
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
394 B 424 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b_atm.png
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
364 B 394 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e-netbank-logo.png
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a-arrow.png
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
271 B 300 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
requirejs-2.1.14-min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ |
15 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
netbank-login-hu.html
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
158 KB 52 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open-sans-v15-latin-600.woff2
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open-sans-v15-latin-regular.woff2
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AppConfiguration.js
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/config/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ThemeConfiguration.js
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/config/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open-sans-v15-latin-regular.woff
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open-sans-v15-latin-600.woff
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Regular.woff2
cdn0.erstegroup.com/etc/designs/gem/themes/emil/fonts/Regular/ Frame 42F4 |
46 KB 47 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Bold.woff2
cdn0.erstegroup.com/etc/designs/gem/themes/emil/fonts/Bold/ Frame 42F4 |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons.d0ee462f.woff
cdn0.erstegroup.com/etc/designs/gem/themes/emil/fonts/icons/ Frame 42F4 |
10 KB 11 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
z0rzsUtPums13CK.css
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
157 B 169 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
123 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2108253806065797
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
280 KB 282 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1060597607323664
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
20 KB 20 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
103 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
43 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
emil.c8e3ecbb.min.css
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
141 KB 33 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webtrekk_v4.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
61 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors_main.a2b805c3b860d972bd4b.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
199 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.7e0fafcbc55c35202920.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
189 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WCWSocket.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
194 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.a07404e62d45a9a024be.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.57c4371b67f8727cd6a9.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
62 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
25.1d563517fb373d1cdccb.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
45 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
128.d118611fc25b31f5d9c6.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
957 B 533 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0.8409880707251add4c6e.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
123 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
91.9892d50a1f6e34d9aced.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
72.1af60401c1e355555eea.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
46 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
erste-style.css
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
26 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kernel.min.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
288 KB 109 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15676884527511567521178899.png
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
59 KB 59 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2a.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
082dbd6856ab1800e02086f575dce14edadce82a29b0fb556a26f859a4bc8641.js.download
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
733 KB 291 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LkRBiMJhQ0Ge.gif
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
43 B 80 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open-sans-v15-latin-600.ttf
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open-sans-v15-latin-regular.ttf
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ Frame 42F4 |
121 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
emil-print.ed9c8270.min.css
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 42F4 |
11 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
geid.min.js
cdn.wbtrk.net/js/ Frame 42F4 |
1 KB 960 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wt
erstegroup01.webtrekk.net/185198974225326/ Frame 42F4 |
43 B 638 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ Frame 42F4 |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ Frame 42F4 |
6 KB 806 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ Frame 42F4 |
2 KB 553 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Frame 42F4 Redirect Chain
|
42 B 109 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ Frame 42F4 |
122 KB 27 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 42F4 |
68 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ Frame 42F4 |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
token.json
www.ramadaneidbazaar.com.au/libs/granite/csrf/ Frame 42F4 |
12 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WCWSocket.js
erste02.talkabot.net/cwd/js/ Frame 42F4 |
194 KB 62 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1060597607323664
connect.facebook.net/signals/config/ Frame 42F4 |
23 KB 8 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2108253806065797
connect.facebook.net/signals/config/ Frame 42F4 |
306 KB 74 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ Frame 42F4 |
44 B 247 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ Frame 42F4 |
44 B 100 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cc
geid.wbtrk.net/ Frame 42F4 |
2 B 736 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DkKH4pReUF2dxMQdi.html
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/login_files/ Frame 24AB |
201 B 244 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
minimized.svg
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/assets/erste/ Frame 42F4 |
12 KB 12 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
down.svg
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/assets/ui/ Frame 42F4 |
12 KB 12 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
segmentation.segment.js
www.ramadaneidbazaar.com.au/etc/ Frame 42F4 |
226 B 279 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stores.init.js
www.ramadaneidbazaar.com.au/etc/clientcontext/erstegroup/default/content/jcr:content/ Frame 42F4 |
226 B 253 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fbc
fbc.wcfbc.net/v1/ Frame 42F4 Redirect Chain
|
69 B 209 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/ Frame 42F4 |
35 B 93 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/ Frame 42F4 |
35 B 93 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/ Frame 42F4 |
35 B 93 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/ Frame 42F4 |
35 B 99 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ Frame 42F4 |
44 B 146 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cc
geid.wbtrk.net/ Frame 42F4 |
90 B 587 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
dynaTraceMonitor
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/ |
12 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
www.erstebank.hu/XYWRElu/ Frame 42F4 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dynaTraceMonitor
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/ |
12 KB 12 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
dynaTraceMonitor
www.ramadaneidbazaar.com.au/este/authenticationfiles/prelogondirectauth/proceed/ |
12 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.erstebank.hu
- URL
- https://www.erstebank.hu/XYWRElu/?m=4056e4967d485fabd6f44f5c30e570ddb39cc43f73f256d361400f3a1d9856157d9dad024d2dd5a49e111d516a30ec26472d956786eb1747eba4a226e0267fb1cad9ca40af91c5a3c24f6ae557ff4d9d0d5afa3a7e9b7d47ef0241d365c45fe1273d5eb74b7fee2337bc6d1142c4f0432a5a1772a925ae02b00863724cf577877c430fceba00e67027b422d9edb275823792fbd1b96fe7b33c7725c2dd45313ff3fc4d44a36169ceb1f88b4f11a6bd99850aa02fd3652d74b3e0ff68852a1112bb51076000cd611ef9c2caf5d485de63a24f476a6b4ad2f812d0ceef900d62f5d1358c1925bc747e534f10b03600d6c8b59e99756c3cccf369cc24ddc2bc7688cb2543966a6856c0cd085ec9417608725c551d9c429a72935c6b1970abf793f1e760dc3d043e528b3f28413a27fb166fbee0072f928998ec0641c36b0176b16a8a5f6105958e9ac7a7ea6ba65e4cb365c8ccd8f0e2d662efe3f56abbf83899250de5a4bf1c58eb6bf768d337d4e931c5e477b1fcd54919f61ea42c26873fc77a0d53703bf0f0ca33af7646f579b781613820e3d70d99a50745b3b1f91d85c9c4c044bfc075cf384038120e12c1654abacff4827316e91266e74c00e6468de65eb268db50385b14e8f23d805f6b4da1fbb61bcab95cfb071389e126f7db8aed67f8192ccb24c5185494da5f1d95
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Erste Bank (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| dT_ object| dynaTrace function| require function| requirejs function| define function| _typeof function| $ function| _ object| i18n object| Backbone function| jQuery13 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.ramadaneidbazaar.com.au/ | Name: dtPC Value: 263190325_654h1 |
|
www.ramadaneidbazaar.com.au/ | Name: dtLatC Value: 1 |
|
.ramadaneidbazaar.com.au/ | Name: _ga Value: GA1.3.364128458.1573463191 |
|
.ramadaneidbazaar.com.au/ | Name: _gcl_au Value: 1.1.1045511417.1573463191 |
|
.ramadaneidbazaar.com.au/ | Name: _gid Value: GA1.3.1560785164.1573463191 |
|
.ramadaneidbazaar.com.au/ | Name: wt_cdbeid Value: 1 |
|
.ramadaneidbazaar.com.au/ | Name: wt_rla Value: 185198974225326%2C1%2C1573463190743 |
|
.ramadaneidbazaar.com.au/ | Name: wt3_eid Value: %3B185198974225326%7C2157346319064135721%232157346319073027612 |
|
.ramadaneidbazaar.com.au/ | Name: _fbp Value: fb.2.1573463190946.1986422150 |
|
.ramadaneidbazaar.com.au/ | Name: _gat_UA-33280811-1 Value: 1 |
|
.ramadaneidbazaar.com.au/ | Name: wt3_sid Value: %3B185198974225326 |
|
www.ramadaneidbazaar.com.au/ | Name: dtSa Value: - |
|
www.ramadaneidbazaar.com.au/ | Name: dtCookie Value: 9H4IR0PJBN3EJQQR7MCP3MIVPE8AAA61 |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.wbtrk.net
cdn0.erstegroup.com
connect.facebook.net
erste02.talkabot.net
erstegroup01.webtrekk.net
fbc.wcfbc.net
fonts.googleapis.com
fonts.gstatic.com
geid.wbtrk.net
stats.g.doubleclick.net
www.erstebank.hu
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.ramadaneidbazaar.com.au
www.erstebank.hu
185.54.150.115
185.54.150.123
185.54.150.17
185.54.150.79
192.185.98.74
2600:9000:21f3:ce00:1e:1c29:5b40:93a1
2a00:1450:4001:806::2008
2a00:1450:4001:808::200e
2a00:1450:4001:821::2003
2a00:1450:4001:825::2003
2a00:1450:4001:825::2004
2a00:1450:4001:825::200a
2a00:1450:400c:c00::9d
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
40.112.94.66
013bc0e6028fc19a5203948f78b91e9aab69861d592bf931d9b301b586c8bbcc
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
176d91ecc6055ccdb72d7f806082b49bc5eaa68a05e830cc82b76098df32438b
17df9953764dc253ffaa827c72cae2b0eabd9fa973978bbde6befb466a0b8aa0
1ce2676cca1414f461ecff80511f71a96597bdcada4a32ba65e39a7424a096a6
1ef7c0e96d3a74af62cc4603d94c1b376a4437e05c76931cbddc502aa4a807a1
20bd96560c0407f36ca222699b9e34f01b73f6232e358ab49825986e7bcae6f6
2925dd6e202b1361849493445fcee375b9d832c408977ac070f488e3db947ecc
2f6464abdfae3b4d79ea617dc341d24daa972c37584254c35f4e970687a85d4a
32cdac0d485144bee58ae8e38ff15ffed342b18c554b2d2db09424acccb75e69
360aaa51218355da3cb712afcf12e32c73a44db9860dd97d30b9291f61db7f91
3af0ae27f1791aea9da60e94e1cf03291881d516c6b62575a8b7a402b96d299c
43cfb12fac6a246fb4f84c1eceb9702dbc6c2303b3c95de3faa02db1d4c62563
46d18a70bf082526d6618eacd382b3e3d6a20e11a0b6afede198aedd0873b9ed
48d806cb4524d6b7ef0979c885762a31bc8a91b9d840eed4e35e75454fa9012f
49ad0c93012d163e7995ccf8ef866bfa5190589eb8cd1f08ca488d4b8f4a71f7
49fafbcf195581213245c2075e8153fda67ce2f46d484e4333b18a8f857e7c2d
4c1c2e95835201077586a3698cd47806dd18df10d32a1e6cb6aa9e47224a55e3
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
581ea6e59198d6c9ad4482d90508b996ea9c48c816be8adfaf42c1193a4f48cd
5ef468e6b28f8232ff6dc2b54f48a016be6b2776a27b7e5191ab71393637dc57
5f78f4efa398dd96296e8604851ee8d58a6bf1c2ed56d248bce23635bf5001d4
635aad1d0c489ae4b5158c9c0815e798f9ed13db2c6d074acce8957c5afd197d
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
66178b37c0d90c37f36e51fcb7c17437839098a400ae0b125b57797ef4b6eb5d
68432fde67fa80514fc7b0a33a8b3eb6de6b707cfca73514189b04e9969a4aad
6a09a911467176dd791bc48e47afdf139f16efa41abb13c42963110554fa77dc
6a42861ce35463d2c190294968c193050b5b68e8674f44bf51c48f8d4669e602
6cad26e849b3bde70e783777147abde7adc564185a0f5ef49917c00c7c564972
6da7d46e5bbe4439585dbb2061789dc5868de92164ac589ff324f2f89fb9ad08
7135b23cb5e3b911b3b9b4964e27b0e9d69e9b92981898de767126b7963f6875
75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070
7d185886535cf97d8893cdae95b00ef54916cb2c399f9df5b46bdeca386dfb06
80a265bed528211aa708dcd58f7a95db36eeb7f873c6fe4ddab0b3a1dc0973a4
826f24cbabaf8f76965af3e6efd684e8e8b9c37b01b63458e4443554fc2bd0fa
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8f2c2cd8248ba0f79a67fcca0050ec0c58e50e438fffc9c3510f5bba3480628f
981be39924f4c8320f4daa8b8cdd7468455e46a30bd0cfef24ba5c74c2a6b12d
9bc258f9f92c8709a171af362f09d8670c5e28094286f9af9a382b6dd6ab2534
9c75fc225642ad27de970728f7c5b79207d26cf18bd960c553ae1822b644ea28
a048009b50eef5b53278c04ec796d4de21244619fdf2a6e84b61ee7402010998
a12b918de03244a0d1a86980907336d97a72a443f5a9d0dab91a2e77691ad317
a29f17c8bbcbed592383a8d414849f91c4768ffc52662b684783899dd4c18870
a735b1c43fd61434d79b1dba7e830a0457f7160175a8b3aa6ed5592f17832730
a853905f2e25d81e1700d69c40eb9d8bc2004e2f468b19cb47a9216ce732f4de
a8588676c6b6b80eb2df21ca15e3a757876508ba0e8b9dba30966c4e1a65d5dc
b02eb6a63bca577aa26a3d54c450cd179dab7b63e08cb8830411bca8f853c002
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1531cc6b7262c59b213897a7346c23a31da523b854fa7d02d0dc93550a2a647
b5a389a8ce78edc1e569b51c0fb5d8ce4dab2f0763e04464b009f34123899390
bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482
c1a69853198ae592f980806d6d489f43d03ee49f60df58b32ad375c03127703a
c1c24d6a7ce4bd24b1f3f51ab6f74667c94263fa4b109cc3ff32f4f22848087f
cb56202cd7b6931907340602bad44a9084c0dfd678ccaa4444f5e715581f7fe4
cc510e152f2e47dc33646e8554a68e61e5205a7206bc5fbce04254bec0f341c4
d925e635f635de6793f4c26bff7e2d7635ebae7a17eec72125026aa023b795ec
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e432a72dbf568097274c03917b04c128aac09cd0000d7b88c0888a95f4d8b7b2
ec9f812b36409ff598805e94c1f0840bae2364ac5cb9d3086b11882d31528d67
ed07f46416165a4d9ff80ab3db68bfeba101af7a9c5f1ed441578c978280ec87
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2307bf9cc43981955eb34828b12d587c39411c229aa8731e597456e1eb62a58
fc577275ac0aa7950cab9be3e64a5af4d15c46def793b599b488aa086a7b3322