www.casinobonusnerds.com Open in urlscan Pro
72.52.231.61  Malicious Activity! Public Scan

URL: https://www.casinobonusnerds.com/submit.htm
Submission: On June 04 via manual from US

Summary

This website contacted 8 IPs in 3 countries across 5 domains to perform 25 HTTP transactions. The main IP is 72.52.231.61, located in Lansing, United States and belongs to LIQUIDWEB - Liquid Web, L.L.C, US. The main domain is www.casinobonusnerds.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 16th 2018. Valid for: 3 months.
This is the only time www.casinobonusnerds.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Charles Schwab (Financial)

Domain & IP information

IP Address AS Autonomous System
4 72.52.231.61 32244 (LIQUIDWEB)
8 104.109.77.211 20940 (AKAMAI-ASN1)
3 104.109.80.74 20940 (AKAMAI-ASN1)
1 4 52.31.176.161 16509 (AMAZON-02)
1 34.250.11.232 16509 (AMAZON-02)
1 63.140.43.7 15224 (OMNITURE)
1 1 66.117.28.86 15224 (OMNITURE)
1 66.117.29.3 15224 (OMNITURE)
25 8
Domain Requested by
8 www.schwab.com www.casinobonusnerds.com
4 dpm.demdex.net 1 redirects www.casinobonusnerds.com
4 www.casinobonusnerds.com www.casinobonusnerds.com
3 content.schwab.com www.casinobonusnerds.com
1 schwab.tt.omtrdc.net www.schwab.com
1 cm.everesttech.net 1 redirects
1 smetric.schwab.com www.schwab.com
1 schwab.demdex.net www.schwab.com
25 8
Subject Issuer Validity Valid
casinobonusnerds.com
cPanel, Inc. Certification Authority
2018-04-16 -
2018-07-15
3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh

This page contains 2 frames:

Primary Page: https://www.casinobonusnerds.com/submit.htm
Frame ID: B8D79FA22852B99AEEFB6A7160004701
Requests: 26 HTTP requests in this frame

Frame: https://schwab.demdex.net/dest5.html?d_nsid=0
Frame ID: A18C5F741791409310DC8F5A81B907F2
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Unix/i

Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Overall confidence: 100%
Detected patterns
  • headers server /mod_ssl(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
  • headers server /mod_ssl(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

25
Requests

20 %
HTTPS

0 %
IPv6

5
Domains

8
Subdomains

8
IPs

3
Countries

1152 kB
Transfer

1389 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5DB5123F5245B1D20A490D45%40AdobeOrg&d_nsid=0&ts=1528124995654 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5DB5123F5245B1D20A490D45%40AdobeOrg&d_nsid=0&ts=1528124995654
Request Chain 15
  • https://cm.everesttech.net/cm/dd?d_uuid=62770731697323560990718964591056949105 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=WxVWQwAAA0BnURKk

25 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request submit.htm
www.casinobonusnerds.com/
270 KB
270 KB
Document
General
Full URL
https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.231.61 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash
f1a92d79af5fda8ee5c95c98dcc2c95bf0f293460082998e017be69ff0fa9824

Request headers

Host
www.casinobonusnerds.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
B8D79FA22852B99AEEFB6A7160004701

Response headers

Date
Mon, 04 Jun 2018 19:09:56 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified
Mon, 04 Jun 2018 17:37:18 GMT
ETag
"ffdc9-436e8-56dd4629ab00d"
Accept-Ranges
bytes
Content-Length
276200
Keep-Alive
timeout=2, max=100
Connection
Keep-Alive
Content-Type
text/html
ps-megachan.css
www.schwab.com/public/file/PS-MEGACHAN-CSS/
72 KB
18 KB
Stylesheet
General
Full URL
https://www.schwab.com/public/file/PS-MEGACHAN-CSS/ps-megachan.css
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
SPDY
Server
104.109.77.211 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-77-211.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/7.5 /
Resource Hash
504610eeb987b9ea65b6ded34ec9ed5fc422f7a203b6de465b2253b05262bc87
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Mon, 04 Jun 2018 15:09:55 GMT
content-encoding
gzip
server
Microsoft-IIS/7.5
cache-control
private
vary
Accept-Encoding
content-type
text/css
status
200
x-n
S
content-length
18689
x-xss-protection
1; mode=block
main.css
www.schwab.com/public/file/PSR-HOME-STYLES-SCRIPTS/
90 KB
21 KB
Stylesheet
General
Full URL
https://www.schwab.com/public/file/PSR-HOME-STYLES-SCRIPTS/main.css?v=18
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
SPDY
Server
104.109.77.211 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-77-211.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/7.5 /
Resource Hash
cdcbb697df5a05bb487be0789cb1e1e926c09a992bec22ec8afc474020151781
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Mon, 04 Jun 2018 15:09:55 GMT
content-encoding
gzip
server
Microsoft-IIS/7.5
cache-control
private
vary
Accept-Encoding
content-type
text/css
status
200
x-n
S
content-length
21003
x-xss-protection
1; mode=block
asset
www.schwab.com/system/
149 KB
53 KB
Script
General
Full URL
https://www.schwab.com/system/asset?cmsid=TEALIUM-UTAG-SYNC&filename=hbx.js
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
SPDY
Server
104.109.77.211 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-77-211.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
40ef82e98624b5d258ce363eddf4c5166bd8184a34cf4469836fd4cf4f118fab
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Jun 2018 15:09:55 GMT
content-encoding
gzip
vary
Accept-Encoding
p3p
CP="CAO CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELi OUR DEL SAMi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA GOV"
status
200
cache-control
no-cache
content-type
text/html; charset=utf-8
content-length
53631
x-xss-protection
1; mode=block
expires
-1
asset
www.schwab.com/system/
17 KB
6 KB
Script
General
Full URL
https://www.schwab.com/system/asset?cmsid=PS-TAG-HEADER&filename=hbx.js
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
SPDY
Server
104.109.77.211 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-77-211.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d1f0f7538e4698980f28bdf9d279e8730d37ca780448465214f44261c3782ad2
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Jun 2018 15:09:55 GMT
content-encoding
gzip
vary
Accept-Encoding
p3p
CP="CAO CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELi OUR DEL SAMi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA GOV"
status
200
cache-control
no-cache
content-type
text/html; charset=utf-8
content-length
5431
x-xss-protection
1; mode=block
expires
-1
GlanceCobrowseLoader_3.2.2M.js
content.schwab.com/glance/
6 KB
3 KB
Script
General
Full URL
https://content.schwab.com/glance/GlanceCobrowseLoader_3.2.2M.js
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Server
104.109.80.74 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-80-74.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ce18412ac1c6650c3ec74f0b04e93765c09d932c363cb934630854155db80403

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Mon, 04 Jun 2018 15:09:55 GMT
Content-Encoding
gzip
Last-Modified
Tue, 02 Feb 2016 19:14:17 GMT
Server
Apache
ETag
"32ede0528eb83a1f6c98c3cef4ce0a85:1454440457"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2784
mn_bank.png
www.schwab.com/public/file/P-9166016/
7 KB
7 KB
Image
General
Full URL
https://www.schwab.com/public/file/P-9166016/mn_bank.png?cv12
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
SPDY
Server
104.109.77.211 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-77-211.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/7.5 /
Resource Hash
8bd7f3d04ac1bfcdfdf07776742d699fdf3232d25e40fe398f870981051dcfaa
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

status
200
date
Mon, 04 Jun 2018 15:09:55 GMT
cache-control
private
server
Microsoft-IIS/7.5
content-length
6697
x-xss-protection
1; mode=block
content-type
image/png
SPOT-TS-logo.png
www.schwab.com/public/file/P-9166045/
0
105 B
Image
General
Full URL
https://www.schwab.com/public/file/P-9166045/SPOT-TS-logo.png?cv12
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
SPDY
Server
104.109.77.211 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-77-211.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

status
404
pragma
no-cache
date
Mon, 04 Jun 2018 15:09:55 GMT
cache-control
no-cache
content-length
0
x-xss-protection
1; mode=block
expires
-1
spotlight_snapshot.png
www.schwab.com/public/file/P-9166082/
13 KB
13 KB
Image
General
Full URL
https://www.schwab.com/public/file/P-9166082/spotlight_snapshot.png?cv12
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
SPDY
Server
104.109.77.211 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-77-211.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/7.5 /
Resource Hash
427d8ed34c23d72d26ff061a83a8315e04474869e5a2f6341c30c7eb522171b7
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

status
200
date
Mon, 04 Jun 2018 15:09:55 GMT
cache-control
private
server
Microsoft-IIS/7.5
content-length
13628
x-xss-protection
1; mode=block
content-type
image/png
logo.png
www.schwab.com/public/file/P-6040152/
3 KB
3 KB
Image
General
Full URL
https://www.schwab.com/public/file/P-6040152/logo.png
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
SPDY
Server
104.109.77.211 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-77-211.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/7.5 /
Resource Hash
3121c5e5c65ad15b1af74fcdf3f59ec2b6440e181d93d69e71fc12b384a3a07e
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

status
200
date
Mon, 04 Jun 2018 15:09:55 GMT
cache-control
private
server
Microsoft-IIS/7.5
content-length
2830
x-xss-protection
1; mode=block
content-type
image/png
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5DB5123F5245B1D20A490D45%40AdobeOrg&d_nsid=0&ts=1528124995654
  • https://dpm.demdex.net/id/rd?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5DB5123F5245B1D20A490D45%40AdobeOrg&d_nsid=0&ts=1528124995654
0
-1 B
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5DB5123F5245B1D20A490D45%40AdobeOrg&d_nsid=0&ts=1528124995654
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Server
52.31.176.161 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-176-161.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Jun 2018 15:09:55 GMT
Access-Control-Allow-Origin
https://www.casinobonusnerds.com
X-TID
sEv88W4AR4Y=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5DB5123F5245B1D20A490D45%40AdobeOrg&d_nsid=0&ts=1528124995654
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 2009 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 04 Jun 2018 15:09:55 GMT
Access-Control-Allow-Origin
https://www.casinobonusnerds.com
X-TID
sEv88W4AR4Y=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5DB5123F5245B1D20A490D45%40AdobeOrg&d_nsid=0&ts=1528124995654
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 2009 00:00:00 GMT
truncated
/
386 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d5eb426fbea54853b836619b6aef2d0065743e724b7ca529287da760a55b1737

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2ccc4d3be744a29473fefe2f313fdae488f460b85a47e8427f748358a54ba048

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml
rd
dpm.demdex.net/id/
1 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5DB5123F5245B1D20A490D45%40AdobeOrg&d_nsid=0&ts=1528124995654
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Server
52.31.176.161 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-176-161.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
75e123e13960de7026f6e2772b12824c0051a7d999915f088159ce0b0b4354b8

Request headers

X-DevTools-Emulate-Network-Conditions-Client-Id
B8D79FA22852B99AEEFB6A7160004701
Origin
https://www.casinobonusnerds.com
Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
irl1-prod-dcs-0a8f79799.edge-irl1.demdex.com 5.29.7.20180524080813 3ms
Pragma
no-cache
Date
Mon, 04 Jun 2018 15:09:55 GMT
Content-Encoding
gzip
X-TID
2vf331MTS/g=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.casinobonusnerds.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=UTF-8
Content-Length
604
Expires
Thu, 01 Jan 2009 00:00:00 GMT
Cookie set dest5.html
schwab.demdex.net/ Frame A18C
0
0
Document
General
Full URL
https://schwab.demdex.net/dest5.html?d_nsid=0
Requested by
Host: www.schwab.com
URL: https://www.schwab.com/system/asset?cmsid=TEALIUM-UTAG-SYNC&filename=hbx.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.250.11.232 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-250-11-232.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
schwab.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.casinobonusnerds.com/submit.htm
Accept-Encoding
gzip, deflate
Cookie
demdex=62770731697323560990718964591056949105
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
B8D79FA22852B99AEEFB6A7160004701
Referer
https://www.casinobonusnerds.com/submit.htm

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Date
Mon, 04 Jun 2018 15:09:55 GMT
DCS
irl1-prod-dcs-09c425612.edge-irl1.demdex.com 5.29.7.20180524080813 0ms
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Mon, 04 Jun 2018 14:40:03 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Set-Cookie
demdex=62770731697323560990718964591056949105;Path=/;Domain=.demdex.net;Expires=Sat, 01-Dec-2018 15:09:55 GMT
Vary
Accept-Encoding, User-Agent
X-TID
iYiUCcItQaA=
Content-Length
2944
Connection
keep-alive
id
smetric.schwab.com/
49 B
473 B
XHR
General
Full URL
https://smetric.schwab.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=5DB5123F5245B1D20A490D45%40AdobeOrg&mid=66504287267961700680193077574056670246&ts=1528124995806
Requested by
Host: www.schwab.com
URL: https://www.schwab.com/system/asset?cmsid=TEALIUM-UTAG-SYNC&filename=hbx.js
Protocol
HTTP/1.1
Server
63.140.43.7 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
schwab.com.ssl.d1.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
2297d9eea9fb0134028421af9fe92003b0df79e3d04a019cc14ce04f14099011

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
Origin
https://www.casinobonusnerds.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Mon, 04 Jun 2018 15:09:55 GMT
Server
Omniture DC/2.0.0
xserver
www95
Vary
Origin
Access-Control-Allow-Methods
GET, POST, DELETE
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
https://www.casinobonusnerds.com
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/x-javascript
Keep-Alive
timeout=15
Content-Length
49
X-C
ms-6.2.1
ibs:dpid=411&dpuuid=WxVWQwAAA0BnURKk
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=62770731697323560990718964591056949105
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=WxVWQwAAA0BnURKk
42 B
767 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=WxVWQwAAA0BnURKk
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Server
52.31.176.161 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-176-161.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.casinobonusnerds.com/submit.htm
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

DCS
irl1-prod-dcs-038b7f5c6.edge-irl1.demdex.com 5.29.7.20180524080813 3ms
Pragma
no-cache
Date
Mon, 04 Jun 2018 15:09:55 GMT
X-TID
20J4+FXOTaU=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 2009 00:00:00 GMT

Redirect headers

Date
Mon, 04 Jun 2018 15:09:55 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=WxVWQwAAA0BnURKk
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
glasswall-1800.jpg
content.schwab.com/web/retail/public/psr/phome/
366 KB
366 KB
Image
General
Full URL
https://content.schwab.com/web/retail/public/psr/phome/glasswall-1800.jpg
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Server
104.109.80.74 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-80-74.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8cdc3d1c60574ffc323834e4b542db0c611d8a6ec0f884ea3c7469cb64831b42

Request headers

Referer
https://www.schwab.com/public/file/PSR-HOME-STYLES-SCRIPTS/main.css?v=18
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Mon, 04 Jun 2018 15:09:55 GMT
Last-Modified
Thu, 21 Sep 2017 16:55:46 GMT
Server
Apache
ETag
"c493026091d9f42eaaaa800e3c06171f:1506012946"
Content-Type
image/jpeg
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
374366
Schwab-Icon-Font-v0-5.woff
www.schwab.com/public/file/P-7047451/
0
0

CharlesModern-Regular.woff
www.schwab.com/public/file/P-6220301/
0
0

CharlesModern-Light.woff
www.casinobonusnerds.com/public/file/P-6220301/
0
0
Font
General
Full URL
https://www.casinobonusnerds.com/public/file/P-6220301/CharlesModern-Light.woff
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.231.61 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.6.31
Resource Hash

Request headers

Pragma
no-cache
Origin
https://www.casinobonusnerds.com
Accept-Encoding
gzip, deflate
Host
www.casinobonusnerds.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
*/*
Referer
https://www.casinobonusnerds.com/submit.htm
Cookie
check=true; AMCVS_5DB5123F5245B1D20A490D45%40AdobeOrg=1; AMCV_5DB5123F5245B1D20A490D45%40AdobeOrg=-894706358%7CMCIDTS%7C17687%7CMCMID%7C66504287267961700680193077574056670246%7CMCAAMLH-1528729795%7C6%7CMCAAMB-1528729795%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1528132195s%7CNONE%7CvVersion%7C2.3.0
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://www.casinobonusnerds.com/submit.htm
Origin
https://www.casinobonusnerds.com

Response headers

Date
Mon, 04 Jun 2018 19:09:57 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By
PHP/5.6.31
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<https://www.casinobonusnerds.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive
timeout=2, max=99
Expires
Wed, 11 Jan 1984 05:00:00 GMT
json
schwab.tt.omtrdc.net/m2/schwab/mbox/
97 B
158 B
XHR
General
Full URL
https://schwab.tt.omtrdc.net/m2/schwab/mbox/json?mbox=SchwabMB&mboxSession=7fa9d59ff03a486780d846461b26f534&mboxPC=&mboxPage=bd9d4a714b2f424bbe9cf3c5dcf0ab34&mboxVersion=1.2.1&mboxCount=1&mboxTime=1528124995844&mboxHost=www.casinobonusnerds.com&mboxURL=https%3A%2F%2Fwww.casinobonusnerds.com%2Fsubmit.htm&mboxReferrer=&browserHeight=1200&browserWidth=1585&browserTimeOffset=0&screenHeight=1200&screenWidth=1600&colorDepth=24&mboxMCGVID=66504287267961700680193077574056670246&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCAVID=&mboxMCGLH=6&vst.trk=metric.schwab.com&vst.trks=smetric.schwab.com&mboxMCSDID=407334A173B0DE8A-2AABE40683CCBE2A
Requested by
Host: www.schwab.com
URL: https://www.schwab.com/system/asset?cmsid=TEALIUM-UTAG-SYNC&filename=hbx.js
Protocol
SPDY
Server
66.117.29.3 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
/
Resource Hash
34fbe3b76beb314f10d06817a207bfe50f43c72228ca01e1061d3c5e504be457

Request headers

Accept
application/json
Referer
https://www.casinobonusnerds.com/submit.htm
Origin
https://www.casinobonusnerds.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Jun 2018 15:09:55 GMT
status
200
vary
Origin
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.casinobonusnerds.com
cache-control
no-cache
access-control-allow-credentials
true
timing-allow-origin
*
content-length
97
x-application-context
edge:prod,prod-prod26,prod-prod26-app,prod26:11180
Schwab-Icon-Font-v0-5.ttf
www.schwab.com/public/file/P-7047451/
0
0

Schwab-Icon-Font-v0-5.ttf
www.casinobonusnerds.com/public/file/P-7047451/
0
0
Font
General
Full URL
https://www.casinobonusnerds.com/public/file/P-7047451/Schwab-Icon-Font-v0-5.ttf
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.231.61 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.6.31
Resource Hash

Request headers

Pragma
no-cache
Origin
https://www.casinobonusnerds.com
Accept-Encoding
gzip, deflate
Host
www.casinobonusnerds.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
*/*
Referer
https://www.casinobonusnerds.com/submit.htm
Cookie
check=true; AMCVS_5DB5123F5245B1D20A490D45%40AdobeOrg=1; AMCV_5DB5123F5245B1D20A490D45%40AdobeOrg=-894706358%7CMCIDTS%7C17687%7CMCMID%7C66504287267961700680193077574056670246%7CMCAAMLH-1528729795%7C6%7CMCAAMB-1528729795%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1528132195s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C2.3.0; mbox=session#7fa9d59ff03a486780d846461b26f534#1528126856
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://www.casinobonusnerds.com/submit.htm
Origin
https://www.casinobonusnerds.com

Response headers

Date
Mon, 04 Jun 2018 19:09:58 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By
PHP/5.6.31
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<https://www.casinobonusnerds.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive
timeout=2, max=100
Expires
Wed, 11 Jan 1984 05:00:00 GMT
CharlesModern-Regular.ttf
www.schwab.com/public/file/P-6220301/
0
0

cta-bg.png
content.schwab.com/web/retail/public/psr/phome/
389 KB
390 KB
Image
General
Full URL
https://content.schwab.com/web/retail/public/psr/phome/cta-bg.png?1491596890
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Server
104.109.80.74 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-80-74.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f33ddc0a9e27aa7ca2dcab943ee75f9ac4945d2acc40e43d281ca7e0e9cab27e

Request headers

Referer
https://www.schwab.com/public/file/PSR-HOME-STYLES-SCRIPTS/main.css?v=18
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Mon, 04 Jun 2018 15:09:55 GMT
Last-Modified
Fri, 18 Aug 2017 15:37:57 GMT
Server
Apache
ETag
"14a8118304be0d2ea3bce5f7edad4b43:1503070677"
Content-Type
image/png
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
398706
CharlesModern-Light.ttf
www.casinobonusnerds.com/public/file/P-6220301/
0
0
Font
General
Full URL
https://www.casinobonusnerds.com/public/file/P-6220301/CharlesModern-Light.ttf
Requested by
Host: www.casinobonusnerds.com
URL: https://www.casinobonusnerds.com/submit.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.231.61 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.6.31
Resource Hash

Request headers

Pragma
no-cache
Origin
https://www.casinobonusnerds.com
Accept-Encoding
gzip, deflate
Host
www.casinobonusnerds.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
*/*
Referer
https://www.casinobonusnerds.com/submit.htm
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://www.casinobonusnerds.com/submit.htm
Origin
https://www.casinobonusnerds.com

Response headers

Date
Mon, 04 Jun 2018 19:09:59 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By
PHP/5.6.31
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<https://www.casinobonusnerds.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive
timeout=2, max=100
Expires
Wed, 11 Jan 1984 05:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.schwab.com
URL
https://www.schwab.com/public/file/P-7047451/Schwab-Icon-Font-v0-5.woff
Domain
www.schwab.com
URL
https://www.schwab.com/public/file/P-6220301/CharlesModern-Regular.woff
Domain
www.schwab.com
URL
https://www.schwab.com/public/file/P-7047451/Schwab-Icon-Font-v0-5.ttf
Domain
www.schwab.com
URL
https://www.schwab.com/public/file/P-6220301/CharlesModern-Regular.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Charles Schwab (Financial)

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| APTload string| testDomain object| cPattern string| targetLocation string| waEnvId string| tmsActiveDomain string| tmsActiveDomainDWT string| proactiveChatHost string| reactiveChatHost object| re undefined| waLanguage string| waDcType string| waDcCat string| waCategoryName string| waPageName function| $ function| jQuery function| checkJQ function| targetPageParams object| visitor function| Visitor object| s_c_il number| s_c_in object| adobe object| _AT function| mboxCreate function| mboxDefine function| mboxUpdate boolean| wa_enable number| hexcase string| b64pad number| chrsz string| sendBid boolean| wa_global_disable function| SHA256 function| getCookie function| fetchBrowserId function| base64ToAscii function| mkTmsCookie function| str2ab function| bin2String function| createGuid object| scatAccounts object| utag_data object| TagParameters object| GLANCE string| netHostUrl number| responsiveWidth function| setChanHeaderWidth object| CHANCONF function| handleIframeMsg function| sendToChild function| LaunchContactUsOverlay function| loadOverlayJSForContactUs function| SetTop function| WebAnalyticsCall function| ContactUsOverlayCall object| Schwab

0 Cookies

2 Console Messages

Source Level URL
Text
console-api log URL: https://www.schwab.com/system/asset?cmsid=TEALIUM-UTAG-SYNC&filename=hbx.js(Line 3)
Message:
VisitorAPI.js 2.3.0 loaded
console-api log URL: https://www.schwab.com/system/asset?cmsid=TEALIUM-UTAG-SYNC&filename=hbx.js(Line 3)
Message:
at.js v1.2.1 loaded

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cm.everesttech.net
content.schwab.com
dpm.demdex.net
schwab.demdex.net
schwab.tt.omtrdc.net
smetric.schwab.com
www.casinobonusnerds.com
www.schwab.com
www.schwab.com
104.109.77.211
104.109.80.74
34.250.11.232
52.31.176.161
63.140.43.7
66.117.28.86
66.117.29.3
72.52.231.61
2297d9eea9fb0134028421af9fe92003b0df79e3d04a019cc14ce04f14099011
2ccc4d3be744a29473fefe2f313fdae488f460b85a47e8427f748358a54ba048
3121c5e5c65ad15b1af74fcdf3f59ec2b6440e181d93d69e71fc12b384a3a07e
34fbe3b76beb314f10d06817a207bfe50f43c72228ca01e1061d3c5e504be457
40ef82e98624b5d258ce363eddf4c5166bd8184a34cf4469836fd4cf4f118fab
427d8ed34c23d72d26ff061a83a8315e04474869e5a2f6341c30c7eb522171b7
504610eeb987b9ea65b6ded34ec9ed5fc422f7a203b6de465b2253b05262bc87
75e123e13960de7026f6e2772b12824c0051a7d999915f088159ce0b0b4354b8
8bd7f3d04ac1bfcdfdf07776742d699fdf3232d25e40fe398f870981051dcfaa
8cdc3d1c60574ffc323834e4b542db0c611d8a6ec0f884ea3c7469cb64831b42
cdcbb697df5a05bb487be0789cb1e1e926c09a992bec22ec8afc474020151781
ce18412ac1c6650c3ec74f0b04e93765c09d932c363cb934630854155db80403
d1f0f7538e4698980f28bdf9d279e8730d37ca780448465214f44261c3782ad2
d5eb426fbea54853b836619b6aef2d0065743e724b7ca529287da760a55b1737
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1a92d79af5fda8ee5c95c98dcc2c95bf0f293460082998e017be69ff0fa9824
f33ddc0a9e27aa7ca2dcab943ee75f9ac4945d2acc40e43d281ca7e0e9cab27e