luckytasmanian.com Open in urlscan Pro
64.34.75.144  Malicious Activity! Public Scan

Submitted URL: http://nepalese-gaff.com/RK=2/RS=fHxTnq4hffeHt8EbsRBo.HvyTYw-
Effective URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Submission Tags: 6928719
Submission: On January 20 via api from NL

Summary

This website contacted 9 IPs in 7 countries across 8 domains to perform 21 HTTP transactions. The main IP is 64.34.75.144, located in Mississauga, Canada and belongs to COGECO-PEER1, CA. The main domain is luckytasmanian.com.
TLS certificate: Issued by R3 on December 16th 2020. Valid for: 3 months.
This is the only time luckytasmanian.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

IP Address AS Autonomous System
1 45.121.145.62 55720 (GIGABIT-M...)
9 64.34.75.144 13768 (COGECO-PEER1)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a0b:4d07:102::1 44239 (PROINITY ...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 3 193.41.234.21 16289 (ING-DIREC...)
4 2606:4700:e6:... 13335 (CLOUDFLAR...)
21 9
Domain Requested by
9 luckytasmanian.com nepalese-gaff.com
luckytasmanian.com
4 ka-f.fontawesome.com kit.fontawesome.com
luckytasmanian.com
3 ing.ingdirect.es 1 redirects luckytasmanian.com
1 kit.fontawesome.com luckytasmanian.com
1 ajax.googleapis.com luckytasmanian.com
1 maxcdn.bootstrapcdn.com luckytasmanian.com
1 icono-49d6.kxcdn.com luckytasmanian.com
1 cdnjs.cloudflare.com luckytasmanian.com
1 nepalese-gaff.com
21 9

This site contains no links.

Subject Issuer Validity Valid
*.oscarjamesharding.com
R3
2020-12-16 -
2021-03-16
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-10-21 -
2021-10-20
a year crt.sh
*.kxcdn.com
Thawte RSA CA 2018
2019-07-04 -
2021-09-01
2 years crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA
2020-09-22 -
2021-10-12
a year crt.sh
upload.video.google.com
GTS CA 1O1
2020-12-15 -
2021-03-09
3 months crt.sh
*.fontawesome.com
DigiCert TLS RSA SHA256 2020 CA1
2020-11-13 -
2021-12-14
a year crt.sh
ing.ingdirect.es
DigiCert SHA2 Extended Validation Server CA
2020-07-09 -
2022-07-10
2 years crt.sh

This page contains 1 frames:

Primary Page: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Frame ID: 2047087B4710D36D0A87456FDB63F7B8
Requests: 21 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://nepalese-gaff.com/RK=2/RS=fHxTnq4hffeHt8EbsRBo.HvyTYw- Page URL
  2. https://luckytasmanian.com//wp-admin/includes/info/r4/ Page URL
  3. https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=459... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

21
Requests

95 %
HTTPS

67 %
IPv6

8
Domains

9
Subdomains

9
IPs

7
Countries

297 kB
Transfer

640 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://nepalese-gaff.com/RK=2/RS=fHxTnq4hffeHt8EbsRBo.HvyTYw- Page URL
  2. https://luckytasmanian.com//wp-admin/includes/info/r4/ Page URL
  3. https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11
  • https://ing.ingdirect.es/pfm/assets/images/norton-logo.png HTTP 302
  • https://ing.ingdirect.es/pfm/

21 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
RS=fHxTnq4hffeHt8EbsRBo.HvyTYw-
nepalese-gaff.com/RK=2/
415 B
604 B
Document
General
Full URL
http://nepalese-gaff.com/RK=2/RS=fHxTnq4hffeHt8EbsRBo.HvyTYw-
Protocol
HTTP/1.1
Server
45.121.145.62 , Malaysia, ASN55720 (GIGABIT-MY Gigabit Hosting Sdn Bhd, MY),
Reverse DNS
mta110.reovendorassign.com
Software
Apache /
Resource Hash
27889120fee2d10df97a3e9dbc261e9b62910a240a7017dafae34b39a2d1ee40

Request headers

Host
nepalese-gaff.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 14:14:51 GMT
Server
Apache
Content-Length
415
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Cookie set /
luckytasmanian.com//wp-admin/includes/info/r4/
274 B
651 B
Document
General
Full URL
https://luckytasmanian.com//wp-admin/includes/info/r4/
Requested by
Host: nepalese-gaff.com
URL: http://nepalese-gaff.com/RK=2/RS=fHxTnq4hffeHt8EbsRBo.HvyTYw-
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.75.144 Mississauga, Canada, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
hp314.hostpapa.com
Software
Apache /
Resource Hash
402e5176197e72b4f7e4e031666cd3a1324a35ed0469ddd1c3ad74fee148a0cf

Request headers

Host
luckytasmanian.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Referer
http://nepalese-gaff.com/RK=2/RS=fHxTnq4hffeHt8EbsRBo.HvyTYw-
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://nepalese-gaff.com/RK=2/RS=fHxTnq4hffeHt8EbsRBo.HvyTYw-

Response headers

Date
Wed, 20 Jan 2021 14:14:52 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=da5ca626f8cf0d938321543e256194ef; path=/
Vary
Accept-Encoding,User-Agent
Content-Encoding
br
Content-Length
218
Keep-Alive
timeout=2, max=100
Connection
Keep-Alive
Content-Type
text/html; charset-UTF-8;charset=UTF-8
Primary Request contratando.php
luckytasmanian.com//wp-admin/includes/info/r4/
4 KB
2 KB
Document
General
Full URL
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.75.144 Mississauga, Canada, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
hp314.hostpapa.com
Software
Apache /
Resource Hash
9ef40c2f4aa313c34aab4474e8939b68fb79ff687179486d99db8d8d8427db4d

Request headers

Host
luckytasmanian.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PHPSESSID=da5ca626f8cf0d938321543e256194ef
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/

Response headers

Date
Wed, 20 Jan 2021 14:14:52 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Encoding
br
Content-Length
2013
Keep-Alive
timeout=2, max=99
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/
30 KB
6 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 14:14:52 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
582080
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
content-length
5631
cf-request-id
07c1bf047b0000d6dd64b4e000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UsFAjriyWymxFMtIA9Be4LuRZUoKsRD%2FUhi%2BC%2Fc5AGwRzuGltOASLmgSdyV3j63erd9pvI6TQ6Mp6A4kN0NnW0fPVLlH1ToqqxtOf1HncBOTFpOFtKEsfpxYFwpMkZftxw%3D%3D"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
61496780c923d6dd-FRA
expires
Mon, 10 Jan 2022 14:14:52 GMT
navbar.css
luckytasmanian.com//wp-admin/includes/info/r4/App/css/
6 KB
2 KB
Stylesheet
General
Full URL
https://luckytasmanian.com//wp-admin/includes/info/r4/App/css/navbar.css
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.75.144 Mississauga, Canada, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
hp314.hostpapa.com
Software
Apache /
Resource Hash
f4948dbf00f11bc77beb2b6c5ce4364ba0d8aa73594f969bd525954dc6bca73e

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 14:14:52 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Jan 2021 12:13:38 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=98
Content-Length
2000
body.css
luckytasmanian.com//wp-admin/includes/info/r4/App/css/
1 KB
868 B
Stylesheet
General
Full URL
https://luckytasmanian.com//wp-admin/includes/info/r4/App/css/body.css
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.75.144 Mississauga, Canada, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
hp314.hostpapa.com
Software
Apache /
Resource Hash
b3e7a746100e97655b71495bb0fa83bbcc3f4ded049cd5a36638923c9e75cb09

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 14:14:52 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Jan 2021 12:13:38 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=97
Content-Length
570
icono.min.css
icono-49d6.kxcdn.com/
42 KB
7 KB
Stylesheet
General
Full URL
https://icono-49d6.kxcdn.com/icono.min.css
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software
keycdn-engine /
Resource Hash
af5eb7b630394e61de5d229bb59017bdc45a126a23ecab83012fbd66d1c5332f

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 14:14:52 GMT
content-encoding
br
last-modified
Tue, 11 Oct 2016 16:43:52 GMT
server
keycdn-engine
x-edge-location
defr
etag
W/"57fd16c8-a90a"
vary
Accept-Encoding
access-control-allow-methods
*
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
access-control-allow-headers
*
expires
Wed, 27 Jan 2021 14:14:52 GMT
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/
141 KB
20 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://luckytasmanian.com
Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 14:14:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:34:10 GMT
etag
"1544639650"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
20563
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/
85 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 13:13:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3672
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30399
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Jan 2022 13:13:40 GMT
9870a60e4f.js
kit.fontawesome.com/
11 KB
4 KB
Script
General
Full URL
https://kit.fontawesome.com/9870a60e4f.js
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9be7bf8fbea9c4a0f93fa7a2e2acba510fa6f848f0b49c83301c3ddf51a5ce8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 14:14:52 GMT
content-encoding
gzip
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
cf-cache-status
REVALIDATED
strict-transport-security
max-age=31536000; preload
cf-request-id
07c1bf048c00003237419da000000001
x-request-id
FlpOSMVe5UocdaUC-5eB
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
access-control-allow-methods
GET, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=60, public, must-revalidate
cf-ray
61496780dd493237-FRA
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
val_login.js
luckytasmanian.com//wp-admin/includes/info/r4/App/js/
2 KB
632 B
Script
General
Full URL
https://luckytasmanian.com//wp-admin/includes/info/r4/App/js/val_login.js
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.75.144 Mississauga, Canada, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
hp314.hostpapa.com
Software
Apache /
Resource Hash
adccb506cd605e83c77b54a2f8cc3788ca564aaf3e479a0904ff6007416883a9

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 14:14:52 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Jan 2021 12:13:38 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=100
Content-Length
319
logoING.svg
luckytasmanian.com//wp-admin/includes/info/r4/App/img/
33 KB
13 KB
Image
General
Full URL
https://luckytasmanian.com//wp-admin/includes/info/r4/App/img/logoING.svg
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.75.144 Mississauga, Canada, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
hp314.hostpapa.com
Software
Apache /
Resource Hash
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 14:14:52 GMT
Content-Encoding
br
Last-Modified
Wed, 20 Jan 2021 12:13:38 GMT
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=96
Content-Length
12565
/
ing.ingdirect.es/pfm/
Redirect Chain
  • https://ing.ingdirect.es/pfm/assets/images/norton-logo.png
  • https://ing.ingdirect.es/pfm/
0
0
Image
General
Full URL
https://ing.ingdirect.es/pfm/
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.41.234.21 Madrid, Spain, ASN16289 (ING-DIRECT-SPAIN, ES),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

Date
Wed, 20 Jan 2021 14:14:51 GMT
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubdomains
Content-Type
text/html
Location
https://ing.ingdirect.es/pfm/#login
Connection
keep-alive
Content-Length
138
X-Xss-Protection
1; mode=block
LogoDNIE-trazado.svg
ing.ingdirect.es/pfm/assets/images/
13 KB
5 KB
Image
General
Full URL
https://ing.ingdirect.es/pfm/assets/images/LogoDNIE-trazado.svg
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.41.234.21 Madrid, Spain, ASN16289 (ING-DIRECT-SPAIN, ES),
Reverse DNS
Software
/
Resource Hash
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 14:14:50 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Fri, 15 Jan 2021 14:23:56 GMT
ETag
W/"6001a57c-32db"
Strict-Transport-Security
max-age=31536000; includeSubdomains
Content-Type
image/svg+xml
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
X-Xss-Protection
1; mode=block
footerbanner.png
luckytasmanian.com//wp-admin/includes/info/r4/App/img/
5 KB
5 KB
Image
General
Full URL
https://luckytasmanian.com//wp-admin/includes/info/r4/App/img/footerbanner.png
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.75.144 Mississauga, Canada, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
hp314.hostpapa.com
Software
Apache /
Resource Hash
f3efc08ac2c0a7a9c082d3dd21598b822afea0fa8014530b56f5a0bd8c110fac

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 14:14:52 GMT
Last-Modified
Wed, 20 Jan 2021 12:13:38 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=99
Content-Length
5089
free.min.css
ka-f.fontawesome.com/releases/v5.15.2/css/
59 KB
13 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v5.15.2/css/free.min.css?token=9870a60e4f
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/9870a60e4f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 14:14:52 GMT
via
1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
5126
x-cache
Hit from cloudfront
access-control-allow-methods
GET
content-encoding
br
cf-request-id
07c1bf0570000005b712a81000000001
last-modified
Wed, 13 Jan 2021 18:32:18 GMT
server
cloudflare
etag
W/"4ecc071b77d6b1790fa9fb8a5173f972"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DA5jJoDZarDo89SqftZUj3FSWZ0BgS%2Fd%2FOFyKb9wBMHA8blwN8Rxf%2BKcOLKz3sP9T4v2aKtsiZpglDl5qcFLDOVKvQPzlqvWgU31SAfv%2BNPOlfHA5MCvOCDRC%2FvBsPXfdA%3D%3D"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
FRA6-C1
cf-ray
614967824a4105b7-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
BZgZ5XwIDRdHpMffyhJSQ_HvyISyp_c2ScHAOc8GYH_kDV_Gxu-2vg==
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.2/css/
26 KB
4 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v5.15.2/css/free-v4-shims.min.css?token=9870a60e4f
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/9870a60e4f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 14:14:52 GMT
via
1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
5126
x-cache
Hit from cloudfront
access-control-allow-methods
GET
content-encoding
br
cf-request-id
07c1bf0571000005b7188bd000000001
last-modified
Wed, 13 Jan 2021 18:32:17 GMT
server
cloudflare
etag
W/"1848e71668f42835079e5fa2af6cf4a8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9Ts55cs9A%2FtJ5aJ6HF6w7ora2jBt1BfEsYBnQ%2B%2BpDk9bYHm3XuEHx8ZrEjWBTxfh7VdvtZydbwvXGfe2cNnrsobDuF01H3noWJ8rvVsRx4xY8sV5AAmlCGNYM1AV9LrRqg%3D%3D"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
FRA6-C1
cf-ray
614967824a4405b7-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
9z_bGA5J1kmbk6jN5rRehJkYmEc7fVl_phjp5tW7AHVpVDjsKghU_Q==
banner-login_1164x300.jpg
luckytasmanian.com//wp-admin/includes/info/r4/App/img/
87 KB
87 KB
Image
General
Full URL
https://luckytasmanian.com//wp-admin/includes/info/r4/App/img/banner-login_1164x300.jpg
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/App/css/navbar.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.75.144 Mississauga, Canada, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
hp314.hostpapa.com
Software
Apache /
Resource Hash
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/App/css/navbar.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 14:14:52 GMT
Last-Modified
Wed, 20 Jan 2021 12:13:38 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=100
Content-Length
88791
free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v5.15.2/webfonts/
78 KB
79 KB
Font
General
Full URL
https://ka-f.fontawesome.com/releases/v5.15.2/webfonts/free-fa-solid-900.woff2
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b94af5a5be53424e948d36a705a1169d952ba6b23761aea3098967a643765454

Request headers

Origin
https://luckytasmanian.com
Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 14:14:52 GMT
via
1.1 932fae480d62106deccf09cea69a7db2.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4234
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-methods
GET
content-length
80272
cf-request-id
07c1bf05bd000005b78c83a000000001
last-modified
Wed, 13 Jan 2021 18:39:13 GMT
server
cloudflare
etag
"a156119daf157b8244f7c816f85638cc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=iVp3cdvw1SGHu32RH44mXKoQCOJcgNO2il57wQpatjH4d%2FfuRgVCBbBapuSLx7clXajjWpVnO7NunSCmgulLvQ2ZJFKe0FtNBEUAwsDLjg4%2B2mraKqojhi0IPDyE0XD4eA%3D%3D"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
MXP64-C1
accept-ranges
bytes
cf-ray
61496782cb6305b7-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
VvVpVwRUG84SGaHaOaDx0fyhOfSq2nzV5aOga7gHbHoX-TGz2JwUVw==
free-fa-regular-400.woff2
ka-f.fontawesome.com/releases/v5.15.2/webfonts/
13 KB
14 KB
Font
General
Full URL
https://ka-f.fontawesome.com/releases/v5.15.2/webfonts/free-fa-regular-400.woff2
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:cb1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf114b3206d8f8772f9be31295020a7b2e5fc8ee8e4a924d338c420a63e2b48a

Request headers

Origin
https://luckytasmanian.com
Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/contratando.php?ip=463525154code=316545639&id=4593919&country=827501042
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 14:14:52 GMT
via
1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4234
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-methods
GET
content-length
13596
cf-request-id
07c1bf05be000005b70c26d000000001
last-modified
Wed, 13 Jan 2021 18:39:07 GMT
server
cloudflare
etag
"e9010f368abcaf8b49cae5e87216a2bc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=787Qfe4soNhl8sKccihjU3FAIIKDG4s5p1xBRHny4w4%2BAxCtVAtH1TN0cSHlyQRORj1wr4iO3PWvbYdd7FRGsn7f%2BU8I0grqvRZ9psJIv3y8lQpYLDPjUexp0ckTNyfm5w%3D%3D"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
cf-ray
61496782cb6405b7-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
1EUeWJ31qAKM3BPuuO15NhuKWO3AUU3tuIZcMjmGu-S11t-Jhs7GZg==
button-loading-dark.gif
luckytasmanian.com//wp-admin/includes/info/r4/App/img/
2 KB
3 KB
Image
General
Full URL
https://luckytasmanian.com//wp-admin/includes/info/r4/App/img/button-loading-dark.gif
Requested by
Host: luckytasmanian.com
URL: https://luckytasmanian.com//wp-admin/includes/info/r4/App/css/navbar.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.34.75.144 Mississauga, Canada, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
hp314.hostpapa.com
Software
Apache /
Resource Hash
483c4a0396691993a641ec409c44b8b7e1daab0ae7e2b2944c4bc59520bb7655

Request headers

Referer
https://luckytasmanian.com//wp-admin/includes/info/r4/App/css/navbar.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 14:14:52 GMT
Last-Modified
Wed, 20 Jan 2021 12:13:38 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=98
Content-Length
2545

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| FontAwesomeKitConfig

1 Cookies

Domain/Path Name / Value
luckytasmanian.com/ Name: PHPSESSID
Value: da5ca626f8cf0d938321543e256194ef

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
icono-49d6.kxcdn.com
ing.ingdirect.es
ka-f.fontawesome.com
kit.fontawesome.com
luckytasmanian.com
maxcdn.bootstrapcdn.com
nepalese-gaff.com
193.41.234.21
2001:4de0:ac19::1:b:1a
2606:4700::6810:135e
2606:4700::6812:1734
2606:4700:e6::ac40:cb1c
2a00:1450:4001:803::200a
2a0b:4d07:102::1
45.121.145.62
64.34.75.144
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
27889120fee2d10df97a3e9dbc261e9b62910a240a7017dafae34b39a2d1ee40
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
402e5176197e72b4f7e4e031666cd3a1324a35ed0469ddd1c3ad74fee148a0cf
483c4a0396691993a641ec409c44b8b7e1daab0ae7e2b2944c4bc59520bb7655
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94
9ef40c2f4aa313c34aab4474e8939b68fb79ff687179486d99db8d8d8427db4d
a9be7bf8fbea9c4a0f93fa7a2e2acba510fa6f848f0b49c83301c3ddf51a5ce8
adccb506cd605e83c77b54a2f8cc3788ca564aaf3e479a0904ff6007416883a9
af5eb7b630394e61de5d229bb59017bdc45a126a23ecab83012fbd66d1c5332f
b3e7a746100e97655b71495bb0fa83bbcc3f4ded049cd5a36638923c9e75cb09
b94af5a5be53424e948d36a705a1169d952ba6b23761aea3098967a643765454
bf114b3206d8f8772f9be31295020a7b2e5fc8ee8e4a924d338c420a63e2b48a
d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f3efc08ac2c0a7a9c082d3dd21598b822afea0fa8014530b56f5a0bd8c110fac
f4948dbf00f11bc77beb2b6c5ce4364ba0d8aa73594f969bd525954dc6bca73e