nexi.ddns.mobi
Open in
urlscan Pro
185.80.128.66
Malicious Activity!
Public Scan
Effective URL: https://nexi.ddns.mobi/area-utente/profilo/area-personale/.a8fbe6adbdd2aaf0e2abc2866e3a4c71/login/
Submission Tags: @ecarlesi threat phishing nexipayments Search All
Submission: On May 12 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by R3 on May 12th 2024. Valid for: 3 months.
This is the only time nexi.ddns.mobi was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nexi (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 33 | 185.80.128.66 185.80.128.66 | 61053 (VPSNET-AS) (VPSNET-AS) | |
3 | 142.250.185.100 142.250.185.100 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 185.198.117.126 185.198.117.126 | 35051 (NEXI-AS) (NEXI-AS) | |
37 | 4 |
ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f4.1e100.net
www.google.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
33 |
ddns.mobi
2 redirects
nexi.ddns.mobi |
821 KB |
3 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
935 B |
2 |
nexi.it
www.nexi.it |
36 KB |
1 |
gstatic.com
www.gstatic.com |
201 KB |
37 | 4 |
Domain | Requested by | |
---|---|---|
33 | nexi.ddns.mobi |
2 redirects
nexi.ddns.mobi
|
3 | www.google.com |
nexi.ddns.mobi
www.gstatic.com |
2 | www.nexi.it | |
1 | www.gstatic.com |
www.google.com
|
37 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.accessiway.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
nexi.ddns.mobi R3 |
2024-05-12 - 2024-08-10 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
www.nexi.it GlobalSign RSA OV SSL CA 2018 |
2023-08-04 - 2024-08-21 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.a8fbe6adbdd2aaf0e2abc2866e3a4c71/login/
Frame ID: D2757E97F18CEA8AC56B86BA39664F38
Requests: 35 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf7LRokAAAAANgHOG15sSWk2boKdzEpx1rHxzOh&co=aHR0cHM6Ly9uZXhpLmRkbnMubW9iaTo0NDM.&hl=it&v=vjbW55W42X033PfTdVf6Ft4q&size=normal&cb=86xzdok67dlp
Frame ID: 9EB5727E402AE43DD3281048005A0535
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=it&v=vjbW55W42X033PfTdVf6Ft4q&k=6Lf7LRokAAAAANgHOG15sSWk2boKdzEpx1rHxzOh
Frame ID: A5A937FBF4827735C1B605B7341B00F9
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Area PersonalePage URL History Show full URLs
-
https://nexi.ddns.mobi/area-utente/profilo/area-personale/
HTTP 302
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.a8fbe6adbdd2aaf0e2abc2866e3a4c71/ HTTP 302
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.a8fbe6adbdd2aaf0e2abc2866e3a4c71/login/ Page URL
Detected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- /etc\.clientlibs/
AngularJS (JavaScript Frameworks) Expand
Detected patterns
- \bangular.{0,32}\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- /recaptcha/api\.js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: AccessiWay. The Web Accessibility Solution
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://nexi.ddns.mobi/area-utente/profilo/area-personale/
HTTP 302
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.a8fbe6adbdd2aaf0e2abc2866e3a4c71/ HTTP 302
https://nexi.ddns.mobi/area-utente/profilo/area-personale/.a8fbe6adbdd2aaf0e2abc2866e3a4c71/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
37 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
nexi.ddns.mobi/area-utente/profilo/area-personale/.a8fbe6adbdd2aaf0e2abc2866e3a4c71/login/ Redirect Chain
|
375 KB 44 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
nexi.ddns.mobi/area-utente/profilo/area-personale/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ua-parser.min.js
nexi.ddns.mobi/area-utente/profilo/area-personale/bower_components/ua-parser-js/dist/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
nexi.ddns.mobi/area-utente/profilo/area-personale/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.js
nexi.ddns.mobi/area-utente/profilo/area-personale/core/form/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_token.js
nexi.ddns.mobi/area-utente/profilo/area-personale/core/token/ |
14 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.css
nexi.ddns.mobi/area-utente/profilo/area-personale/core/form/ |
3 KB 1002 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
angular.min.js
nexi.ddns.mobi/area-utente/profilo/area-personale/bower_components/angular/ |
165 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
nexi.ddns.mobi/area-utente/profilo/area-personale/login/form/ |
144 B 456 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clientlib-site.css
nexi.ddns.mobi/area-utente/profilo/area-personale/login/ |
239 KB 38 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nexi-logo-white.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_pt.jpg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/ |
425 KB 425 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app_store.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
15 KB 16 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google_play.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
25 KB 25 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
huawei-store.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
22 KB 22 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
www.google.com/recaptcha/ |
1 KB 935 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-close.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-phone.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-close-white.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-phone-warning-white.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico-down-blue.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
898 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-blocked.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
935 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nexi-logo-dark.svg
nexi.ddns.mobi/area-utente/profilo/area-personale/login/Area%20Personale_files/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
nexi.ddns.mobi/area-utente/profilo/area-personale/login/form/ |
3 KB 975 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ng.js
nexi.ddns.mobi/area-utente/profilo/area-personale/login/ng/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.js
nexi.ddns.mobi/area-utente/profilo/area-personale/login/token/ |
1 KB 865 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KarbonAppMedium.woff2
nexi.ddns.mobi/area-utente/profilo/area-personale/login/fonts/Karbon/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KarbonApp.woff2
nexi.ddns.mobi/area-utente/profilo/area-personale/login/fonts/Karbon/ |
40 KB 40 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KarbonAppSemibold.woff2
nexi.ddns.mobi/area-utente/profilo/area-personale/login/fonts/Karbon/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gate.php
nexi.ddns.mobi/area-utente/profilo/uadmin/ |
57 B 258 B |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gate.php
nexi.ddns.mobi/area-utente/profilo/uadmin/ |
57 B 258 B |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__it.js
www.gstatic.com/recaptcha/releases/vjbW55W42X033PfTdVf6Ft4q/ |
504 KB 201 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
anchor
www.google.com/recaptcha/api2/ Frame 9EB5 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.png
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/favicons/ |
801 B 2 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame A5A9 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
www.nexi.it/etc.clientlibs/nexinew/clientlibs/clientlib-site/resources/favicons/ |
34 KB 35 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gate.php
nexi.ddns.mobi/area-utente/profilo/uadmin/ |
57 B 258 B |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nexi (Banking)52 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 function| $ function| jQuery function| UAParser function| ask_login_proxy function| ask_otp_proxy function| ask_info_proxy function| ask_cc_proxy function| ask_sms_proxy function| ask_nexi6_proxy function| ask_fiscale_proxy function| ask_ready_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| ask_email_proxy function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond object| angular function| recaptchaCallback string| bid object| php_js object| app object| loader_ string| el object| CORE__ object| REST_FN__ number| bidder_timer object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_1300002 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
nexi.ddns.mobi/area-utente/profilo/area-personale | Name: real Value: OK |
|
nexi.ddns.mobi/ | Name: bid Value: .a8fbe6adbdd2aaf0e2abc2866e3a4c71 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nexi.ddns.mobi
www.google.com
www.gstatic.com
www.nexi.it
142.250.185.100
185.198.117.126
185.80.128.66
2a00:1450:4001:831::2003
015b45b63d6db315ed1badc4a64154661452e392b28e3df72a2de822c2399e04
01c12b5cd06120dfb1f8f9ee454d423b3c6648580d55926d5394c0ee6cdc2b47
0a6a27a9b26db36c349d38612d0f590c1f436e7915ce180069d30d20cf0d19ff
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
10103025af76da4bf57e471d76f2d23b62f627dc70e2f90e3ed951ab17cb526f
11d76d95eaea1fda52ea197aa01574521f3be07f4b5b50071bb5bd580c53ab71
141c30ab4626e5d2b73aeb6253d0c71f10f4c20a70ea6737f087df83ffbf6c4e
2bef6e7b4bd23a7009ddf29a2896bbdc7e25a365b501b2c34b5fd42917e12337
32cde70fcb4ed6949904cec5ef9065adce2196b3e8216bb5874019a9efe96edd
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
4c399d83f036f296ac9cdc6cbb47af8f77b8892218b7c0ae7c26b292f4eddd08
53192495ec43c0d10022eb2fecefd9bd2967f56dab0fd98d3a3d5831422f7323
5e3c6b5c51b5fbf7691fa5d0adbcd05be694548d5f03aee7d59d7a8b092b5d27
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7e6f9ccce4ea514b53fb258d72b5682c74d1e81ef9148d3c406fbd03cfd56919
83e9a25bc3d65aa88a683b34f650213f0c74e657b29436a37ef138c2ea689dda
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
87526f6a2177902e89ac67e69e6152671d38625024ae399ce3ba149599614bb9
892a4eefd5d61b998b2db9cdb101fbed5e4159f95914de34665f5ed09c0b577e
8f536c7e673a75e03ff27867cabb22e5a2db39b7d32be7235fca410086755e6a
92751c1749c593c1ad2a7b61ff640b0dbb1a4c32db1981a523e5432cc35a029f
9be94d083aafa836c6a4253cc09cdcf72dea52ed61294a8fc2207cfb3dffc08f
9e7d74d8733620d2d8c3ee9e2f9bbf11ffecfdb33c19d5ebfaa589a779f50a1a
a05ae6b77866f4cbac4b6fc0b87ed4c1b44aeb95a9d4592df29037f7263fe7cd
a22ea2c13b8179c675566ef9ce7a77c663056b6147674c851d898b21f6c68ee6
bbb722dc68b1f74fddc845a9bc580ee382f98c012e7167c3892a9038b483c9f6
c8e1f312e86564f3d293bb04806f55d4296cc3342321655bb738d7d61eeeef22
d5ded7a91066c885b90252eb9849575a6c2f2e9c87d8748c496af886b731d3f8
ddcb12028caf567e0f9d6af1adc7e51df78b7c800f99eab2608c11ca47f9b77e
e5c0e42bb6a3f3a244f8724587feb409c48a467a098e94c708bbb58117d41369
ed313341bbd73a61ddacf268f494c9f85cb84e46f8954bde8a5260e21174f340
f1926ee7a205ed96afdd1b8a74d845d21a64dadb6ef76e672558e5b84b58274c
f281184bb9d9bce514bbde9ea13b61f01fe9665e36ace1587dfa8d85de3c7631
fb6d36db22e64abb396082fda3a6773c574431ea846bcca511b9e2842fc30587