velvetdrummer.com
Open in
urlscan Pro
2606:4700:3035::6815:24e
Malicious Activity!
Public Scan
Effective URL: https://velvetdrummer.com/ec9997003e8b323fd84b434413d359eb
Submission: On November 28 via manual from FR — Scanned from FR
Summary
TLS certificate: Issued by E1 on November 5th 2023. Valid for: 3 months.
This is the only time velvetdrummer.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Customer Survey Spam (Consumer)Domain & IP information
ASN16509 (AMAZON-02, US)
PTR: ec2-13-56-96-205.us-west-1.compute.amazonaws.com
poste.eventlink.to | |
www.toneden.io | |
fanlink.to |
ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-56.fra56.r.cloudfront.net
st.toneden.io |
ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net
www.googleadservices.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-58.fra60.r.cloudfront.net
sd.toneden.io |
ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-84.fra6.r.cloudfront.net
cdn.evbstatic.com |
ASN32934 (FACEBOOK, US)
connect.facebook.net |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-206-6.fra56.r.cloudfront.net
cdn.amplitude.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-37-226-218.deploy.static.akamaitechnologies.com
analytics.tiktok.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-38-108-41.us-west-2.compute.amazonaws.com
api.amplitude.com |
ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net |
ASN32934 (FACEBOOK, US)
www.facebook.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-21.fra56.r.cloudfront.net
widget.intercom.io |
ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-49.fra60.r.cloudfront.net
js.intercomcdn.com |
ASN57271 (BITWEB-AS, RU)
PTR: 235019.bitweb.ru
restingmanager.com |
ASN13335 (CLOUDFLARENET, US)
trk-essursta.com | |
event.trk-essursta.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
velvetdrummer.com
velvetdrummer.com |
682 KB |
8 |
toneden.io
st.toneden.io — Cisco Umbrella Rank: 265559 sd.toneden.io — Cisco Umbrella Rank: 312823 www.toneden.io — Cisco Umbrella Rank: 295649 |
3 MB |
5 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 35 |
425 KB |
4 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27 region1.google-analytics.com — Cisco Umbrella Rank: 2462 |
21 KB |
4 |
tiktok.com
analytics.tiktok.com — Cisco Umbrella Rank: 742 |
146 KB |
4 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174 |
179 KB |
3 |
trk-essursta.com
trk-essursta.com — Cisco Umbrella Rank: 229296 event.trk-essursta.com |
3 KB |
2 |
intercomcdn.com
js.intercomcdn.com — Cisco Umbrella Rank: 2317 |
274 KB |
2 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 110 |
216 B |
2 |
google.fr
www.google.fr — Cisco Umbrella Rank: 17843 |
563 B |
2 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
563 B |
2 |
doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 |
3 KB |
2 |
amplitude.com
cdn.amplitude.com — Cisco Umbrella Rank: 2690 api.amplitude.com — Cisco Umbrella Rank: 1804 |
21 KB |
2 |
licdn.com
snap.licdn.com — Cisco Umbrella Rank: 778 |
7 KB |
2 |
fanlink.to
fanlink.to — Cisco Umbrella Rank: 368465 |
790 B |
2 |
t.co
1 redirects
t.co — Cisco Umbrella Rank: 607 |
916 B |
1 |
qwartkey.website
1 redirects
qwartkey.website |
671 B |
1 |
restingmanager.com
restingmanager.com |
428 B |
1 |
intercom.io
widget.intercom.io — Cisco Umbrella Rank: 1771 |
3 KB |
1 |
linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 377 |
533 B |
1 |
evbstatic.com
cdn.evbstatic.com — Cisco Umbrella Rank: 20220 |
213 KB |
1 |
googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 145 |
19 KB |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1002 |
426 KB |
1 |
ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 713 |
15 KB |
1 |
twitter.com
1 redirects
platform.twitter.com — Cisco Umbrella Rank: 1186 |
383 B |
1 |
eventlink.to
poste.eventlink.to |
4 KB |
73 | 26 |
Domain | Requested by | |
---|---|---|
17 | velvetdrummer.com |
restingmanager.com
velvetdrummer.com |
5 | www.googletagmanager.com |
st.toneden.io
www.googletagmanager.com www.google-analytics.com velvetdrummer.com |
4 | analytics.tiktok.com |
st.toneden.io
analytics.tiktok.com |
4 | www.toneden.io |
st.toneden.io
|
4 | connect.facebook.net |
poste.eventlink.to
st.toneden.io connect.facebook.net |
2 | event.trk-essursta.com |
trk-essursta.com
|
2 | js.intercomcdn.com |
widget.intercom.io
|
2 | region1.google-analytics.com |
www.googletagmanager.com
|
2 | www.facebook.com |
poste.eventlink.to
|
2 | www.google.fr |
poste.eventlink.to
|
2 | www.google.com |
poste.eventlink.to
|
2 | googleads.g.doubleclick.net |
www.googletagmanager.com
|
2 | www.google-analytics.com |
st.toneden.io
|
2 | snap.licdn.com |
st.toneden.io
snap.licdn.com |
2 | fanlink.to |
st.toneden.io
|
2 | sd.toneden.io |
poste.eventlink.to
sd.toneden.io |
2 | st.toneden.io |
poste.eventlink.to
|
2 | t.co | 1 redirects |
1 | trk-essursta.com |
velvetdrummer.com
|
1 | qwartkey.website | 1 redirects |
1 | restingmanager.com |
st.toneden.io
|
1 | widget.intercom.io |
st.toneden.io
|
1 | px.ads.linkedin.com |
poste.eventlink.to
|
1 | api.amplitude.com |
st.toneden.io
|
1 | cdn.amplitude.com |
st.toneden.io
|
1 | cdn.evbstatic.com |
poste.eventlink.to
|
1 | www.googleadservices.com |
poste.eventlink.to
|
1 | use.fontawesome.com |
poste.eventlink.to
|
1 | static.ads-twitter.com |
poste.eventlink.to
|
1 | platform.twitter.com | 1 redirects |
1 | poste.eventlink.to |
t.co
|
73 | 31 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-10-16 - 2024-10-14 |
a year | crt.sh |
*.eventlink.to R3 |
2023-10-25 - 2024-01-23 |
3 months | crt.sh |
use.fontawesome.com Cloudflare Inc ECC CA-3 |
2023-10-12 - 2024-10-10 |
a year | crt.sh |
toneden.io Amazon RSA 2048 M01 |
2023-03-09 - 2024-04-07 |
a year | crt.sh |
www.googleadservices.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
evbstatic.com Amazon RSA 2048 M02 |
2023-01-31 - 2024-02-29 |
a year | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2023-09-06 - 2023-12-05 |
3 months | crt.sh |
*.toneden.io R3 |
2023-10-25 - 2024-01-23 |
3 months | crt.sh |
*.fanlink.to R3 |
2023-10-25 - 2024-01-23 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
snap.licdn.com DigiCert SHA2 Secure Server CA |
2023-02-01 - 2024-01-31 |
a year | crt.sh |
cdn.amplitude.com Amazon RSA 2048 M01 |
2023-01-12 - 2024-02-11 |
a year | crt.sh |
*.tiktok.com RapidSSL ECC CA 2018 |
2023-07-14 - 2024-08-13 |
a year | crt.sh |
*.amplitude.com COMODO RSA Domain Validation Secure Server CA |
2023-01-23 - 2024-02-14 |
a year | crt.sh |
www.linkedin.com DigiCert SHA2 Secure Server CA |
2023-11-03 - 2024-05-03 |
6 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.google.fr GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.intercom.com Amazon RSA 2048 M02 |
2023-02-14 - 2024-03-14 |
a year | crt.sh |
*.intercomcdn.com Amazon RSA 2048 M01 |
2023-02-21 - 2024-01-29 |
a year | crt.sh |
restingmanager.com R3 |
2023-10-18 - 2024-01-16 |
3 months | crt.sh |
velvetdrummer.com E1 |
2023-11-05 - 2024-02-03 |
3 months | crt.sh |
trk-essursta.com GTS CA 1P5 |
2023-10-19 - 2024-01-17 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://velvetdrummer.com/ec9997003e8b323fd84b434413d359eb
Frame ID: F3549DD7D692EF45C350A517F9D15516
Requests: 66 HTTP requests in this frame
Frame:
https://js.intercomcdn.com/frame-modern.7b8481f7.js
Frame ID: A462AF410515B2D7160470CF318373FF
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
[1] Récompense en attente - chronopost - Nous voulons votre avis!Page URL History Show full URLs
-
http://t.co/Tcyg4IqDlV
HTTP 301
https://t.co/Tcyg4IqDlV Page URL
- https://poste.eventlink.to/DFS54F453rg45ERFSqq9B Page URL
- https://restingmanager.com/0/0/0/87fd724fc24dc06b89494fded2cf6400 Page URL
-
https://qwartkey.website/?s1=350751&s2=1095023206&s3=4542&s4=1&s10=1746
HTTP 302
https://velvetdrummer.com/ec9997003e8b323fd84b434413d359eb Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
animate.css (Web Frameworks) Expand
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Amplitude (Analytics) Expand
Detected patterns
- cdn\.amplitude\.com
Facebook (Widgets) Expand
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/ns\.html[^>]+></iframe>
- <!-- (?:End )?Google Tag Manager -->
- googletagmanager\.com/gtm\.js
- googletagmanager\.com/gtag/js
Linkedin Insight Tag (Analytics) Expand
Detected patterns
- snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://t.co/Tcyg4IqDlV
HTTP 301
https://t.co/Tcyg4IqDlV Page URL
- https://poste.eventlink.to/DFS54F453rg45ERFSqq9B Page URL
- https://restingmanager.com/0/0/0/87fd724fc24dc06b89494fded2cf6400 Page URL
-
https://qwartkey.website/?s1=350751&s2=1095023206&s3=4542&s4=1&s10=1746
HTTP 302
https://velvetdrummer.com/ec9997003e8b323fd84b434413d359eb Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://t.co/Tcyg4IqDlV HTTP 301
- https://t.co/Tcyg4IqDlV
- https://platform.twitter.com/oct.js HTTP 301
- https://static.ads-twitter.com/oct.js
73 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Tcyg4IqDlV
t.co/ Redirect Chain
|
299 B 570 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DFS54F453rg45ERFSqq9B
poste.eventlink.to/ |
7 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
oct.js
static.ads-twitter.com/ Redirect Chain
|
56 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.js
use.fontawesome.com/releases/v5.15.4/js/ |
1 MB 426 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fan-link.css
st.toneden.io/production/stylesheets/ |
403 KB 69 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conversion.js
www.googleadservices.com/pagead/ |
50 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fan-link.js
st.toneden.io/production/javascripts/ |
10 MB 3 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
toneden.loader.js
sd.toneden.io/production/v2/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
neueplak.js
cdn.evbstatic.com/s3-build/perm_001/bf1c05/django/js/src/eb/fonts/ |
296 KB 213 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
202 KB 54 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
events
www.toneden.io/api/v1/analytics/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
record
fanlink.to/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
events
www.toneden.io/api/v1/analytics/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
441 KB 126 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
insight.min.js
snap.licdn.com/li.lms-analytics/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amplitude-8.1.0-min.gz.js
cdn.amplitude.com/libs/ |
64 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
analytics.tiktok.com/i18n/pixel/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
events
www.toneden.io/api/v1/analytics/ |
16 B 580 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
record
fanlink.to/ |
16 B 790 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
events
www.toneden.io/api/v1/analytics/ |
16 B 580 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
toneden.js
sd.toneden.io/production/v2/ |
422 KB 142 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
insight.old.min.js
snap.licdn.com/li.lms-analytics/ |
8 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.MTdjYzNiZDU2MA.js
analytics.tiktok.com/i18n/pixel/static/ |
397 KB 107 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sdk.js
connect.facebook.net/en_US/ |
302 KB 86 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1711912442390284
connect.facebook.net/signals/config/ |
140 KB 36 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
api.amplitude.com/ |
7 B 228 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
194 KB 71 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
px.ads.linkedin.com/ |
0 533 B |
Image
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/974636074/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
identify_bb163.js
analytics.tiktok.com/i18n/pixel/static/ |
135 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
pixel
analytics.tiktok.com/api/v2/ |
0 793 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
15 B 223 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/974636074/ |
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.fr/pagead/1p-user-list/974636074/ |
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
227 KB 81 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
0 31 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
0 185 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 256 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xlku466w
widget.intercom.io/widget/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1071787441/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/1071787441/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.fr/pagead/1p-user-list/1071787441/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
frame-modern.7b8481f7.js
js.intercomcdn.com/ Frame A462 |
514 KB 143 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor-modern.689650c5.js
js.intercomcdn.com/ Frame A462 |
426 KB 131 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
87fd724fc24dc06b89494fded2cf6400
restingmanager.com/0/0/0/ |
134 B 428 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
ec9997003e8b323fd84b434413d359eb
velvetdrummer.com/ Redirect Chain
|
52 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
velvetdrummer.com/assets/vendors/bootstrap-4.5.3/css/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
velvetdrummer.com/assets/vendors/fontawesome/css/ |
58 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.min.css
velvetdrummer.com/assets/css/edmond/ |
57 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
velvetdrummer.com/assets/css/edmond/ |
26 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
msg.v3.js
velvetdrummer.com/inc/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
post2.png
velvetdrummer.com/uploads/archive/company/601/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5d2c44223eadbb79d4ad2f4ce8db5651.png
velvetdrummer.com/fim/1746-FR/ |
17 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e2d19f0f39817b80cb49fc8a0266e50c.gif
velvetdrummer.com/fim/1746-FR/ |
496 KB 497 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f4ac063f3afbc271611a2e3ec3530105.png
velvetdrummer.com/fim/1746-FR/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1e1d1c6f3f7b6e759bc5ba778fb2bbb1.png
velvetdrummer.com/fim/1746-FR/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
email-decode.min.js
velvetdrummer.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery-3.4.1.min.js
velvetdrummer.com/assets/vendors/ |
86 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
velvetdrummer.com/assets/vendors/bootstrap-4.5.3/js/ |
62 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
functions.js
velvetdrummer.com/assets/js/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
intl_functions.js
velvetdrummer.com/assets/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
common.js
velvetdrummer.com/assets/js/edmond/ |
69 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v9e118mez8
trk-essursta.com/scripts/push/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gtm.js
www.googletagmanager.com/ |
178 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
240 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 74 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
ec9997003e8b323fd84b434413d359eb
velvetdrummer.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
v9e118mez8
event.trk-essursta.com/register/event_log/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
v9e118mez8
event.trk-essursta.com/register/event_log/ |
0 0 |
Fetch
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS |
v9e118mez8
event.trk-essursta.com/register/event_log/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
v9e118mez8
event.trk-essursta.com/register/event_log/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- velvetdrummer.com
- URL
- https://velvetdrummer.com/ec9997003e8b323fd84b434413d359eb
- Domain
- event.trk-essursta.com
- URL
- https://event.trk-essursta.com/register/event_log/v9e118mez8
- Domain
- event.trk-essursta.com
- URL
- https://event.trk-essursta.com/register/event_log/v9e118mez8
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Customer Survey Spam (Consumer)131 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| pushCount object| MYCALL string| s1 string| s2 string| fp string| esource string| pshpub string| pshdomain string| pshfingerprint object| dataLayer function| $ function| jQuery object| bootstrap number| refresh_page object| google_tag_manager object| google_tag_data function| datehax function| startTimer number| duration undefined| time undefined| refresh string| rightnow object| currentdate object| months function| startINTSurvey function| startQuestion function| startSurveyDub function| showSurveyDub string| LNG string| CMP string| CNT string| BID string| FNP string| API_URL function| onYouTubeIframeAPIReady object| gaGlobal string| attrChoices string| domain number| count string| pipeline string| zipcode string| state_selected boolean| processing object| states function| birthdayFill function| beforeShowQuestion function| showOfferWall function| createQuestion function| processQuestion function| nextQuestion function| replaceUrlParam function| showModalPopup function| popunder function| confirm_scheddel function| confirm_scheddelnow function| startsurvey number| box_trying boolean| oneclick function| formatPhoneNumber function| switchTypeQuestions function| validatePhone function| validateEmail function| validateZip function| sendZipIp function| validateHeightF function| validateHeightI function| validateWeight function| validateAll function| validateName function| validateLName function| validateBirthday function| days function| daysInMonth function| dashedNumber function| alpha function| validateKeyStrokes function| showStreetState function| leadgenForm function| emailPixel function| showDisclaimer function| preventS function| startSurveyU function| createQuestionU function| switchTypeQuestionsU function| nextQuestionU function| validateData function| showStreetStateU function| c_eff function| cheers function| mfq_tags string| aff_id string| click_id string| Brand string| lpid string| lpow object| prepop string| emailURL string| phoneURL string| zipcodeURL string| cityURL string| stateURL string| languageCode string| countryCode string| popUrl string| questiontx string| of number| advEmail number| email_pixel string| prod_var string| pname_modal number| answered number| prevProgress number| stepsTotal number| progress string| cheerstx string| txt function| urlBase64ToUint8Array function| pullUrlParams function| push_subscribe function| push_subscribe_promise function| setIfNull function| logPushEvent function| push_unsubscribe function| push_init function| setSessionId function| setUtm function| getSessionId function| getUrlVars function| getDomainName function| getStore22 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: 8c171ba1-64a3-46bd-8656-b47173befe26 |
|
.eventlink.to/ | Name: connect.sid Value: s%3A%3AOYKslQXH1KTbVljMgeDVDEHe2oaBZ9DN.HHWq%2B6PJW2EkOUmt6t8id3kQJKEQ1Rkd3Ngtai1JgDs |
|
.tiktok.com/ | Name: _ttp Value: 2Yo711c98vL65fPZClpHo0sbpNP |
|
.eventlink.to/ | Name: amp_cc1dfb Value: _ld7GxNFP5KN98qHyszyR7...1hgb3h967.1hgb3h968.0.1.1 |
|
.eventlink.to/ | Name: amp_cc1dfb_eventlink.to Value: _ld7GxNFP5KN98qHyszyR7...1hgb3h967.1hgb3h96e.0.1.1 |
|
.eventlink.to/ | Name: _gcl_au Value: 1.1.1612330354.1701179860 |
|
.eventlink.to/ | Name: _tt_enable_cookie Value: 1 |
|
.eventlink.to/ | Name: _ttp Value: R79ndKEx0M5DIG2ebEIJmxRNMpX |
|
poste.eventlink.to/ | Name: _ga Value: GA1.1.1797539169.1701179860 |
|
poste.eventlink.to/ | Name: _gid Value: GA1.1.1531199747.1701179860 |
|
poste.eventlink.to/ | Name: _gat_ToneDenTracker Value: 1 |
|
.eventlink.to/ | Name: _fbp Value: fb.1.1701179860465.1427906508 |
|
poste.eventlink.to/ | Name: _ga_3KM8DGF3ZN Value: GS1.1.1701179860.1.0.1701179860.0.0.0 |
|
.linkedin.com/ | Name: bcookie Value: "v=2&0f842cd4-5d75-4470-8a84-3ffefe7c4622" |
|
.linkedin.com/ | Name: lidc Value: "b=VGST04:s=V:r=V:a=V:p=V:g=3066:u=1:x=1:i=1701179860:t=1701266260:v=2:sig=AQHn0NKxkuFjKzT2YYb0E5UEXuCiyBoQ" |
|
.doubleclick.net/ | Name: IDE Value: AHWqTUmIhHEpZc-hFKlbRtVbvDJkBSy6dZkxfhLi3NILnbckGwD2NwRaLapTMhjr |
|
.fanlink.to/ | Name: connect.sid Value: s%3A%3A1Sv1IFylS_fC4LaeEzR_jDTeqweQIxIs.a6axIm08qzA1ybvrbPbeXeMpUXuwop7gNOxQMlgc39E |
|
restingmanager.com/ | Name: uid4542 Value: 1095023206-20231128085742-0f00acb61de28135a7b0c9d5dd9a0a9c-0 |
|
qwartkey.website/ | Name: PHPSESSID Value: 673cfdaab9f147a26e8703a780855cea |
|
velvetdrummer.com/ | Name: PHPSESSID Value: 727eb88b52c7a49cc0d64f9980cb4b65 |
|
.velvetdrummer.com/ | Name: _ga Value: GA1.1.1630078136.1701179865 |
|
.velvetdrummer.com/ | Name: _ga_JMJ044GLKX Value: GS1.1.1701179864.1.0.1701179864.0.0.0 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.tiktok.com
api.amplitude.com
cdn.amplitude.com
cdn.evbstatic.com
connect.facebook.net
event.trk-essursta.com
fanlink.to
googleads.g.doubleclick.net
js.intercomcdn.com
platform.twitter.com
poste.eventlink.to
px.ads.linkedin.com
qwartkey.website
region1.google-analytics.com
restingmanager.com
sd.toneden.io
snap.licdn.com
st.toneden.io
static.ads-twitter.com
t.co
trk-essursta.com
use.fontawesome.com
velvetdrummer.com
widget.intercom.io
www.facebook.com
www.google-analytics.com
www.google.com
www.google.fr
www.googleadservices.com
www.googletagmanager.com
www.toneden.io
event.trk-essursta.com
velvetdrummer.com
104.244.42.133
104.244.42.197
13.32.27.21
13.32.99.58
13.56.96.205
142.250.186.66
146.75.120.157
18.66.147.49
18.66.97.56
2001:4860:4802:34::36
23.37.226.218
2606:2800:234:59:254c:406:2366:268c
2606:4700:3031::6815:1e4b
2606:4700:3035::6815:24e
2606:4700:e2::ac40:8d0d
2620:1ec:21::14
2a00:1450:4001:808::2008
2a00:1450:4001:812::2004
2a00:1450:4001:813::2003
2a00:1450:4001:82b::200e
2a00:1450:4001:830::2002
2a02:26f0:7100::213:c60b
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
2a06:98c1:3120::3
45.133.235.200
52.222.206.6
52.38.108.41
99.86.4.84
01abe855c140a104cb74b4cc391bcbde6be7ab4a6475ca365cd3a7ca09f0d042
0217703b0617d526a5d36c1b01f09b2fd4019fbd29950c94953da797e192cfdc
0d6873d6c25a63ba3dfc58721372035d852f5ae37edb24151e9614b6a059a0de
17862aa3e9849968032a3b5ff35ae96d55f77c024c8964bb277c073c6ccfc6b5
1bb20fa16f2085b80f16ccc00a809185f61d129d34dc3cd5a2681845358f4050
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2a00507dd16a8367892fde60258e5d0005ffe5b1b51bc9ecf874a5ba7972ffec
2d02a9809d9502c0b3272acb73102f5e68eef5812fe1d04b92c1fe34a2bd19c9
3439b61b3c2f87a4f330efa6d87603534a7c153766203d7f8e04f1e8272527a8
34eace17373618f0ef6ad0052c607c2b3a6c02af6a6e0a1d16fa15efb97c139d
3a7ff26e3fea300cdd6456f976a6b7ac113ebc0e88891359313d02f448213ffe
3b19eeb21d7fbd9b8b260e57c2d9198f83732339a9e3cbd5d2264f77e722df26
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
448b2102656fc14a1cd8cc0e30a1d41aca27281ed91b00fb7cf5a23c7d8f8749
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
4ee0a5ff498d86ffddd86f96b3706becfe2890873dfac92f8c2011983d9f7917
50333d4b79b13c41b32dcee91f1b32e13a7d09a3d3a2f576cae0f3980700b34e
5b3086a886aa8649ecbf496ac913a1aa443926cd2fff610be2d136c9598bcd8b
605bfcd889bbe7134f74ba47cba8bfe6710ef6cb1cf8ca9720cac4fe96921b42
62723060de0c92d89ec49f9b3bc1fd54b786111e8ad3451a6cf7ebc8553e7b74
75ebfc0168a8c147fa15ef9d89fbbc16d7365d0c6d98dd49243924d62707d6f1
7fe94c3496b575d3b593506129fad53bda4bb19cd3ce9e772ea8eb377fcb4cd1
810a381036eaf8362a14241ef8dc40eaf48b25888d6c01b16667785d16f51a4b
812ab0e46f86b2ce98ab2425ab2224b90d0845952a1ac0d5abd734b6217e98bf
84be2b664b875c7ec54bda29f605c8288425d24bd443cc35fe2a06211675fbae
929f6b6ca9a0c32b436454d91eb36d10a2a50b827c8b4e710b6829d1cc6f9e8c
a108956152d602466559f66392ce9ea07cbf8c69cdea83778fe1b552e80d59f9
a1d4b01843b9dad68a10bba7ab416fb60cbe6052a223f6bd74cbad286b812b2a
a98b0d22fb50853a6fbb1a665e510a9595d2dae5f86a5774f8f0c2f701955532
aa2d9dbdb6ad5e574030f9a404c7bff18133ac2e53a9ef2ba225b1069316b3db
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
af3bc27aa48d7c777f065183ae66f7c02edbf0489980cc3a305828cd2630471d
b098e7471b4cf9e9a839e33e00ce2b750ce7e3655571c45d4c65e0875a8939de
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
bc4e159fef23b0ce0f2c59b70dc7db507ea4771e8ed0345993fae5356b7ff47f
bdfab04c388dfa92f05be133b12116e79aa0aea3fbffacc82f8a8b650597312d
c65c15e3af0d349af61501f7749076aacef349171d95638bb475f800d8367084
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d1fb8d8337cd22568295b0ed998c85c58f0b4cd083af0b0db21cb0af80002f2d
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
ddc9f495fa5ffd2acaa85dcfc467f54155a759fc7b86b920e6cce7551ceee14d
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de4f24d10562c802963beb120e51b9d37ebdde70708d8c3b38b82e5d1844e619
dea8ea11a3aa9c899fc3ed1a48e81009586b3100f0b67bbe6b9e2bfc1cf3d1a9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea47b2b0198dda53fbec470bc3812a7fb7c92ef57f7bf5eddf2c26dc4a6220b8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef71e9b66e458da94049e3628f603caa53ebd4b03992205bc5fb0d2f356f831c
f3d388dc0747593a603e61b268f0e99961d404b5b879de070f2a5efeb9907b89
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f958e207ed54a74cde78d771c723b7db9eaa59296932ffe13559668f0d9d0acb
fc85702baca03c9e5cea9b68ee081a4fcb99d8ab9c028772dc69e908208128f7