preoff.net
Open in
urlscan Pro
2606:4700:3031::6815:6c1
Malicious Activity!
Public Scan
Effective URL: https://preoff.net/lowen_de/?aff_id=801894&offer_id=800643&aff_source=2020&transaction_id=c1m7HFj9fCxpcAJRsjzAhNoru...
Submission: On December 24 via api from BE — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 9th 2021. Valid for: a year.
This is the only time preoff.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Lion's Den Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 2606:4700:303... 2606:4700:3037::6815:5c0d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 34.90.180.192 34.90.180.192 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
1 1 | 35.204.218.225 35.204.218.225 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
1 1 | 2606:4700:303... 2606:4700:3037::6815:139d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 2606:4700:303... 2606:4700:3030::6815:916 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
17 | 2606:4700:303... 2606:4700:3031::6815:6c1 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:215... 2600:9000:2156:7600:d:2875:66c0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 54.75.98.211 54.75.98.211 | 16509 (AMAZON-02) (AMAZON-02) | |
26 | 8 |
ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: 192.180.90.34.bc.googleusercontent.com
coffespres.com |
ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: 225.218.204.35.bc.googleusercontent.com
desklegger.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-75-98-211.eu-west-1.compute.amazonaws.com
server-api.push77-api.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
preoff.net
preoff.net |
863 KB |
2 |
push77-api.com
server-api.push77-api.com |
628 B |
2 |
cloudflare.com
cdnjs.cloudflare.com |
54 KB |
2 |
bootstrapcdn.com
netdna.bootstrapcdn.com |
83 KB |
2 |
algatv.com
1 redirects
algatv.com |
1016 B |
1 |
push77-sdk.com
cdn.push77-sdk.com |
51 KB |
1 |
googleapis.com
ajax.googleapis.com |
86 KB |
1 |
blestaurls.com
1 redirects
blestaurls.com |
1 KB |
1 |
livefetch.biz
1 redirects
livefetch.biz |
967 B |
1 |
desklegger.com
1 redirects
desklegger.com |
769 B |
1 |
coffespres.com
1 redirects
coffespres.com |
289 B |
26 | 11 |
Domain | Requested by | |
---|---|---|
17 | preoff.net |
algatv.com
preoff.net |
2 | server-api.push77-api.com |
cdn.push77-sdk.com
|
2 | cdnjs.cloudflare.com |
preoff.net
|
2 | netdna.bootstrapcdn.com |
preoff.net
netdna.bootstrapcdn.com |
2 | algatv.com | 1 redirects |
1 | cdn.push77-sdk.com |
preoff.net
|
1 | ajax.googleapis.com |
preoff.net
|
1 | blestaurls.com | 1 redirects |
1 | livefetch.biz | 1 redirects |
1 | desklegger.com | 1 redirects |
1 | coffespres.com | 1 redirects |
26 | 11 |
This site contains links to these domains. Also see Links.
Domain |
---|
avrlinks.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-05 - 2022-07-04 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
*.push77-sdk.com Amazon |
2021-09-06 - 2022-10-05 |
a year | crt.sh |
*.push77-api.com Amazon |
2021-09-19 - 2022-10-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://preoff.net/lowen_de/?aff_id=801894&offer_id=800643&aff_source=2020&transaction_id=c1m7HFj9fCxpcAJRsjzAhNoruh6&aff_sub2=228628267&goal_id=1008&xparam=electoffers.com/bitqt/&entity=lol&country_code=GB&trk_sys_id=10&test=0
Frame ID: 778977D1A0C3E80E641A99A69E3EEB3F
Requests: 26 HTTP requests in this frame
Screenshot
Page Title
BildPage URL History Show full URLs
- https://algatv.com/rd/c6453TQnRV118411xHxB25tMd62495rlCA245 Page URL
-
https://algatv.com/track/c6453TQnRV118411xHxB25tMd62495rlCA245
HTTP 302
https://coffespres.com/?a=2020&oc=13996&c=39628&m=3&s1=12&s2=245-6453&s3=118411-25-62495 HTTP 302
https://desklegger.com/?a=2020&oc=13996&c=39628&m=3&s1=12&s2=245-6453&s3=118411-25-62495&ckmguid=7b... HTTP 302
https://livefetch.biz/?affiliate_id=1894&offer_id=643&sys_id=0&aff_source=2020&aff_sub2=228628267&... HTTP 302
https://blestaurls.com/aff_el?url=https://preoff.net/lowen_de/&aff_id=1894&offer_id=643&aff_source=... HTTP 302
https://preoff.net/lowen_de/?aff_id=801894&offer_id=800643&aff_source=2020&transaction_id=c1m7H... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Terms and Conditions
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://algatv.com/rd/c6453TQnRV118411xHxB25tMd62495rlCA245 Page URL
-
https://algatv.com/track/c6453TQnRV118411xHxB25tMd62495rlCA245
HTTP 302
https://coffespres.com/?a=2020&oc=13996&c=39628&m=3&s1=12&s2=245-6453&s3=118411-25-62495 HTTP 302
https://desklegger.com/?a=2020&oc=13996&c=39628&m=3&s1=12&s2=245-6453&s3=118411-25-62495&ckmguid=7b985368-367e-4757-a167-5cb370a5133c HTTP 302
https://livefetch.biz/?affiliate_id=1894&offer_id=643&sys_id=0&aff_source=2020&aff_sub2=228628267&entity=lol HTTP 302
https://blestaurls.com/aff_el?url=https://preoff.net/lowen_de/&aff_id=1894&offer_id=643&aff_source=2020&transaction_id=c1m7HFj9fCxpcAJRsjzAhNoruh6&aff_sub2=228628267&goal_id=1008&xparam=electoffers.com%2Fbitqt%2F&entity=lol HTTP 302
https://preoff.net/lowen_de/?aff_id=801894&offer_id=800643&aff_source=2020&transaction_id=c1m7HFj9fCxpcAJRsjzAhNoruh6&aff_sub2=228628267&goal_id=1008&xparam=electoffers.com/bitqt/&entity=lol&country_code=GB&trk_sys_id=10&test=0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
c6453TQnRV118411xHxB25tMd62495rlCA245
algatv.com/rd/ |
235 B 693 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
preoff.net/lowen_de/ Redirect Chain
|
483 KB 289 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
preoff.net/lowen_de/css/ |
13 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 86 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
netdna.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
35.bild.png
preoff.net/lowen_de/images/ |
656 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
header-right.png
preoff.net/lowen_de/images/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lions_main_ch.jpg
preoff.net/lowen_de/images/ |
61 KB 62 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lions3_ch.jpg
preoff.net/lowen_de/images/ |
91 KB 91 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lions7_ch.jpg
preoff.net/lowen_de/images/ |
121 KB 121 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
deposit.jpg
preoff.net/lowen_de/images/ |
25 KB 25 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lions4_ch.jpg
preoff.net/lowen_de/images/ |
111 KB 111 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
day2.jpg
preoff.net/lowen_de/images/ |
50 KB 51 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
day3.jpg
preoff.net/lowen_de/images/ |
24 KB 24 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
netdna.bootstrapcdn.com/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hyperform.min.js
cdnjs.cloudflare.com/ajax/libs/hyperform/0.8.15/ |
31 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
prof1.jpg
preoff.net/lowen_de/images/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
prof2.jpg
preoff.net/lowen_de/images/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
prof3.jpg
preoff.net/lowen_de/images/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
prof4.jpg
preoff.net/lowen_de/images/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
prof5.jpg
preoff.net/lowen_de/images/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
184dc9ab-6565-4fbf-a6a5-27cb70a870e3.jpg
preoff.net/lowen_de/images/ |
62 KB 62 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lib.min.js
cdn.push77-sdk.com/v1/ |
148 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
6bf905bd-820f-47c1-938c-e9700e44e056
server-api.push77-api.com/v1_0/applications/ |
0 0 |
Preflight
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6bf905bd-820f-47c1-938c-e9700e44e056
server-api.push77-api.com/v1_0/applications/ |
337 B 628 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utils.js
cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.0/js/ |
239 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
69 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Lion's Den Scam (Online)90 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery function| date_en function| date_it function| date_de function| date_de_v1 function| date_no function| date_se function| date_fi function| date_da function| date_ar function| date_nl function| date_pl function| date_br function| date_es function| date_cz function| date_ice function| date_lt function| date_hr function| date_ee function| date_ru function| date_fr function| date_tr function| date_slov function| date_gr string| ajrequrl string| absroot string| bc_country string| bc_country_iso string| access_account number| external_phone_verification number| external_email_verification boolean| valid_email boolean| valid_phone string| full_number_national string| error_display string| postAction boolean| display_waiting_text string| registration_complete string| su_country_iso function| hyperform function| _toConsumableArray function| _slice function| _slicedToArray function| _extends object| countryData function| activate_client_error function| clean_error function| get_dial_code function| handleChange function| reset_phone function| false_phone_handler function| true_phone_handler function| check_phone_ok function| checkEmail function| reset_email function| false_email_handler function| true_email_handler function| check_email_valid object| itihash object| inputhash object| inputemailhash function| suToggleFormSubmit object| ParsleyExtend object| ParsleyConfig object| psly object| Parsley object| ParsleyUtils object| ParsleyValidator object| ParsleyUI string| inputEventPatched object| parsley object| intlTelInputGlobals function| intlTelInput function| rdTopMe number| send_aj string| captcha function| _ function| WebPush object| webpush string| appId object| data object| webPush boolean| isMobileExist undefined| imported function| checkCk function| getCK function| setCK object| intlTelInputUtils5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.desklegger.com/ | Name: som Value: QmPbbNhrhF5QHQwjH3D/fK44KkQFGE1HfFyftD4Y1USQT0fF3l/QnA== |
|
.desklegger.com/ | Name: tfl Value: SKo3lafB+uvWJ/yq37Czzq44KkQFGE1HfFyftD4Y1USQT0fF3l/QnA== |
|
.desklegger.com/ | Name: c13957 Value: QmPbbNhrhF5RPbAukfwaloyxG7acaYk9DCk9/f6jbUanBMpWM/BIgw== |
|
blestaurls.com/ | Name: click_time Value: "2|1:0|10:1640345783|10:click_time|16:MTY0MDM0NTc4NA==|be44bd38ff099838d361763e4097a23ef09bb070fc943d99fedaabc44d4e39a8" |
|
blestaurls.com/ | Name: redirect_url Value: "2|1:0|10:1640345783|12:redirect_url|304:aHR0cHM6Ly9wcmVvZmYubmV0L2xvd2VuX2RlLz9hZmZfaWQ9ODAxODk0Jm9mZmVyX2lkPTgwMDY0MyZhZmZfc291cmNlPTIwMjAmdHJhbnNhY3Rpb25faWQ9YzFtN0hGajlmQ3hwY0FKUnNqekFoTm9ydWg2JmFmZl9zdWIyPTIyODYyODI2NyZnb2FsX2lkPTEwMDgmeHBhcmFtPWVsZWN0b2ZmZXJzLmNvbS9iaXRxdC8mZW50aXR5PWxvbCZjb3VudHJ5X2NvZGU9R0ImdHJrX3N5c19pZD0xMCZ0ZXN0PTA=|9ab96b0bb563b35dfd4e2a9dd0b16883a9a0e27a18df41b52c66e8ec3471491e" |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
algatv.com
blestaurls.com
cdn.push77-sdk.com
cdnjs.cloudflare.com
coffespres.com
desklegger.com
livefetch.biz
netdna.bootstrapcdn.com
preoff.net
server-api.push77-api.com
2600:9000:2156:7600:d:2875:66c0:93a1
2606:4700:3030::6815:916
2606:4700:3031::6815:6c1
2606:4700:3037::6815:139d
2606:4700:3037::6815:5c0d
2606:4700::6810:135e
2606:4700::6812:acf
2a00:1450:4001:82f::200a
34.90.180.192
35.204.218.225
54.75.98.211
0a012cf808a24573168308916092d2d4bd3f2b4af8e16b59167013cc77acee55
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1707346b93ea4f91be70ba1d144c800813af2ef6d7bf2a9785665d2e9764b4c8
185599b7df5e8e2e2405e84f96f5d3d0c0d33d44ac514d4d12b01d394351a2d8
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
5e4a39e9f9298e25b326bd92f08b9cca6b15f0d617677c8ef2a6a3c037a8a0a1
633fc26f9154de2d682c4100f4a740802c49ea494744b50f0f60859df8878e10
70d81524ff46cf40ab5b8dafa8597489819bed792aeffde58837e55b99013464
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7d36963228d9129e9c593f7fe1c707055836ae5d56da63bc414cccc93903aa67
83afac21101ff25697edc7ce0071874f4a7e9c976f281986bb03e0ec68465381
90367a822fb360ae9d67bd92fa573fd6f39da4e96b82a9d36d58e6ca7c3a8687
acaefecc2a438420ae02baa357bb498ac4abec71c80ba9e3c2b7079cacf256c2
b341067c48a48df3d1667f878b8621159eb33f26b48e4a2ac0fdaaa1fd3a64f5
c14a7dd8e831631260e6a74227c34cf0916ad316c55a13838c6d6d72c0ebb25c
ca7574f9e77e6f63f3de627e733b81246f6147ae25915da0125c6cc4002f2eda
cc1e848a3372f5fc645a2842dce0c9ce8b54442c43dd3b221449e4eb4c91ded6
cf06aa43f7e6cad834d0dc3d3690973ec93bda861b9465b81743b7ddcfe10ef5
df99f7229bbfb0bdf5ed771fca5acc2fcbe96e41429bc2b2451f238c42d3f948
e321cfe3bd1524754d15f31fe7e99e3f9c02e953e9d7fedde9387402c374275a
e57cf4957488eccd1e8cd85d8ac9df40eee132f599e1a1f4b031c98faa9c7288
e74d84027f1adf0a36f037825fad478ad9f81745630ca0f2125c4336130a1f6f
e867182fe5ddcea7ff1946dc2c3b3536e29800fcba3923743eba4fa6fed574a6
f5653349d4d9eade79c3484fc521672332ffba22afbf1022e80ecb56973814c4
f6894acedc5915b51c9f1857f0da8ea062475edaff3b391b7cd7ffdf7115ad91