urlscan.io logo urlscan.io
SecurityTrails logo

dawn-bonus-f123.carma17.workers.dev Open in urlscan Pro
104.21.95.90  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u17218225.ct.sendgrid.net/ls/click?upn=AjxCuJM4o2nhAbMhPA6yTaljDan0EQMdvMiith0fdWKujDCs5XWv6LnVPqqOOenVVj5ZG6DmU8X-2FXBR-2...
Effective URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Submission: On September 23 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 2 countries across 7 domains to perform 30 HTTP transactions. The main IP is 104.21.95.90, located in and belongs to CLOUDFLARENET, US. The main domain is dawn-bonus-f123.carma17.workers.dev.
TLS certificate: Issued by R3 on September 5th 2021. Valid for: 3 months.
This is the only time dawn-bonus-f123.carma17.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.118.28 11377 (SENDGRID)
1 104.21.95.90 13335 (CLOUDFLAR...)
1 172.67.145.59 13335 (CLOUDFLAR...)
12 199.36.158.100 54113 (FASTLY)
4 104.16.126.175 13335 (CLOUDFLAR...)
4 104.16.18.94 13335 (CLOUDFLAR...)
1 142.250.184.202 15169 (GOOGLE)
30 7
1    167.89.118.28 (Las Vegas, United States)

ASN11377 (SENDGRID, US)
PTR: o16789118x28.outbound-mail.sendgrid.net
u17218225.ct.sendgrid.net
1    104.21.95.90 (None, )

ASN13335 (CLOUDFLARENET, US)
dawn-bonus-f123.carma17.workers.dev
1    172.67.145.59 (United States)

ASN13335 (CLOUDFLARENET, US)
ffappd.wancdnapp.page
12    199.36.158.100 (United States)

ASN54113 (FASTLY, US)
rikcndapplala.firebaseapp.com
4    104.16.126.175 (None, )

ASN13335 (CLOUDFLARENET, US)
unpkg.com
4    104.16.18.94 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    142.250.184.202 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f10.1e100.net
ajax.googleapis.com
Domain Requested by
12 rikcndapplala.firebaseapp.com dawn-bonus-f123.carma17.workers.dev
rikcndapplala.firebaseapp.com
4 cdnjs.cloudflare.com dawn-bonus-f123.carma17.workers.dev
4 unpkg.com dawn-bonus-f123.carma17.workers.dev
1 ajax.googleapis.com dawn-bonus-f123.carma17.workers.dev
1 ffappd.wancdnapp.page dawn-bonus-f123.carma17.workers.dev
1 dawn-bonus-f123.carma17.workers.dev
1 u17218225.ct.sendgrid.net 1 redirects
30 7

This site contains no links.

Subject Issuer Validity Valid
*.carma17.workers.dev
R3		 2021-09-05 -
2021-12-04		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-03-11 -
2022-03-10		 a year crt.sh
firebaseapp.com
GTS CA 1D4		 2021-09-20 -
2021-12-19		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Frame ID: AC338B780F8DA163EE8EE6DACBF18625
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login Download OneDrive Bussiness

Page URL History Show full URLs

  1. https://u17218225.ct.sendgrid.net/ls/click?upn=AjxCuJM4o2nhAbMhPA6yTaljDan0EQMdvMiith0fdWKujDCs5XWv6LnVPqqOOen... HTTP 302
    https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:/([\d.]+))?/vue(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Overall confidence: 100%
Detected patterns
  • lodash.*\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

30
Requests

77 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

7
IPs

2
Countries

559 kB
Transfer

1807 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u17218225.ct.sendgrid.net/ls/click?upn=AjxCuJM4o2nhAbMhPA6yTaljDan0EQMdvMiith0fdWKujDCs5XWv6LnVPqqOOenVVj5ZG6DmU8X-2FXBR-2BQPRbEyAnfzf96OufhKv-2F6ttCh9Y-3DcIit_3czHOuBjZYyiCGbK2pA2D9DvxASs-2FTi6lx8BxRN2-2BQSURiuDV8Gy7QXg1N0jvv07wMuW4KtQqxhrcBhmeOvvS6Yn92AbywJBB7HY-2BOCCOLuRNh-2FJLolFmPAGjOZ2pHtOAwDPsX09ZLVuZgbwO2xYNwhxhykqXj-2FuAfYxUOoj4BJPHjp5fv4SFhO6661MxsEF0AystMnidIOrKtVcCpLlYw-3D-3D HTTP 302
    https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
dawn-bonus-f123.carma17.workers.dev/
Redirect Chain
  • https://u17218225.ct.sendgrid.net/ls/click?upn=AjxCuJM4o2nhAbMhPA6yTaljDan0EQMdvMiith0fdWKujDCs5XWv6LnVPqqOOenVVj5ZG6DmU8X-2FXBR-2BQPRbEyAnfzf96OufhKv-2F6ttCh9Y-3DcIit_3czHOuBjZYyiCGbK2pA2D9DvxASs-...
  • https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
5 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.95.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
28eacc4455b786fcf07aa95c0f96cfb73e35e8e3717facf59d0f2332d50e41ed

Request headers

:method
GET
:authority
dawn-bonus-f123.carma17.workers.dev
:scheme
https
:path
/?bbre=xzodiszx
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 23 Sep 2021 23:44:54 GMT
content-type
text/html;charset=UTF-8
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iOgfGvybem9DEZ5TUpRXa5343lzoen5c36pcn70XLRJNctsOWIvnO6KvFYd7HcQjVpQn3UYBpCdvF3O2g%2BxgY8nayXpBleqkI7OK%2FNaolcSYRs1u5RP7nlr%2B%2Fda9lghPyX7LeujSdkaDjgIyrMGFbfkYEMe7rg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
server
cloudflare
cf-ray
6937a4c33971412c-PRG
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Server
nginx
Date
Thu, 23 Sep 2021 23:44:54 GMT
Content-Type
text/html; charset=utf-8
Content-Length
81
Connection
keep-alive
Location
https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
X-Robots-Tag
noindex, nofollow
614a0de83d9d841c7214117e.js
ffappd.wancdnapp.page/ 		7 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ffappd.wancdnapp.page/614a0de83d9d841c7214117e.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.145.59 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00d48f21b86ff8fdd3f4bea4280b32783257c511d4f587b65063355c49fd5eed

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 23:44:55 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-status
BYPASS
access-control-allow-methods
GET, POST, DELETE, PUT, PATCH, OPTIONS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma
no-cache
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5XkDJJ5x2gsiXVoHH0PK0hhCJKBuABItCL3Be36V0jWjGlyPPzPhSr2Ay927DffUiUW6eLg4sFOW84ZHsfR%2FeEQN2cXKTQmlrMnwgrsYX0%2FOSn3hBZuLBV6i7X9T60%2F3tXmXiTiHbjQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
ffappd.wancdnapp.page
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
cf-ray
6937a4c54fa12798-PRG
access-control-allow-headers
authkey , authvalue, Authorization, User-Agent, Keep-Alive, Content-Type, X-Requested-With
expires
Mon, 25 Jul 1997 05:00:00 GMT
58c4d983b0689b163916a7fe0213b525nbr1632243173.css
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/ 		721 KB
107 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/58c4d983b0689b163916a7fe0213b525nbr1632243173.css
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e9b1ed66566097f07aaa5be8bfc1631edcea6365ebb1a50de9e162eaf273e6d9
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440695.239152,VS0,VE462
etag
"5074990d28d3a4c2302c95a2e4422e65497cc1e93bb98e83dbcd71fc6d70b073-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/css; charset=utf-8
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:55 GMT
accept-ranges
bytes
content-length
109005
x-cache-hits
0
0dda4ca1e79c5f1d564557bc47b54cddnbr1632243174.css
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/ 		98 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/0dda4ca1e79c5f1d564557bc47b54cddnbr1632243174.css
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
bc102ad795ce28cdaf633e892f9c5359af3f609ac21bb13c434a6e5dca738bf1
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440696.787862,VS0,VE192
etag
"747ffa0edc8ab9d0eb886feb0f6c28dc2754763fe0e86f9c69830a9d57215ae7-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/css; charset=utf-8
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:55 GMT
accept-ranges
bytes
content-length
13633
x-cache-hits
0
axios.min.js
unpkg.com/axios@0.16.1/dist/ 		34 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/axios@0.16.1/dist/axios.min.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.126.175 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b2114a050aed49f4a24237d4d1f437b75ca10c6fc8623eae23c0558c53a7e21
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 23:44:56 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
13361610
fly-request-id
01F3WA4DWH9N4YFFSWYNJD2Y5E
content-encoding
br
vary
Accept-Encoding
last-modified
Sat, 08 Apr 2017 18:51:20 GMT
server
cloudflare
etag
W/"879a-StlLhYX39Pj2Qvz0O98NQPjvG9U"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6937a4ce395f4e50-FRA
43309540d13e09d7808cfb02ca99ff4anbr1632243174.js
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/ 		74 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/43309540d13e09d7808cfb02ca99ff4anbr1632243174.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
74116901ac0ec12dd7af88a1e9ac55a5531f2dac5da8053cfa70042d738587e3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440696.053480,VS0,VE277
etag
"18436deb674b50728be198a9912eab2947b4e3b5a74daafe8daf6805d969d6cf-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:56 GMT
accept-ranges
bytes
content-length
18676
x-cache-hits
0
vue.min.js
unpkg.com/vue@2.6.11/dist/ 		91 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/vue@2.6.11/dist/vue.min.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.126.175 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e0156dd49c03744e79bbea60eebbbb94b5811c1b71b91f5fb38a8270dedfbaf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 23:44:56 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
796688
fly-request-id
01FFJRZFX676ZY914MK2RGREFA
content-encoding
br
vary
Accept-Encoding
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"16de6-q9I58ClmstMksFEsIDvbr4Kk7Xo"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6937a4d04b164e50-FRA
vue-router.min.js
unpkg.com/vue-router@2.7.0/dist/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/vue-router@2.7.0/dist/vue-router.min.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.126.175 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a01a4f435ae1e511d874f1abc960898902b1d6d4731c3cf0f3383b1ec3ffd1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 23:44:56 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
13619380
fly-request-id
01F3MM9X7NTHS6B49EMDHB48Q6
content-encoding
br
vary
Accept-Encoding
last-modified
Thu, 29 Jun 2017 03:57:37 GMT
server
cloudflare
etag
W/"5c5a-b2+xvLVNqK43WHk3Czwf1BAXaoI"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6937a4d07b404e50-FRA
vuex.min.js
cdnjs.cloudflare.com/ajax/libs/vuex/2.3.1/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/vuex/2.3.1/vuex.min.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f1597d8c4ad4932102d5f5fbb0c35b827d7ccfc58a30ff6cdfe9dd0c3e5efa7
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 23:44:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
107089
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
3106
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:17:51 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb0402f-290d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mUG%2B6hBhSG30U7EhHlju%2BQrsFfTdnKn%2BWJ8IcI%2FoITs41CPtpWTsgQbdDeH656IB0EwbD5qvKQJTUBDJprag78R5sv90nmcXhRSoae8%2BEZ4QSw%2B0NNU8NXxxh%2F9PH8JczP0R%2FfpB"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6937a4d0b8543248-FRA
expires
Tue, 13 Sep 2022 23:44:56 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.202 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f10.1e100.net
Software
sffe /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 20 Sep 2021 09:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
311670
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30306
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="hosted-libraries-pushers"
expires
Tue, 20 Sep 2022 09:10:26 GMT
vee-validate.min.js
cdnjs.cloudflare.com/ajax/libs/vee-validate/2.0.0-rc.3/ 		42 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/vee-validate/2.0.0-rc.3/vee-validate.min.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7649e92aa760b806193241148e8b88f3bc12c4e6cffbc35622a99477db798242
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 23:44:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
2513679
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
10691
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:17:28 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb04018-a668"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O4ZmrzgHNIJ0hyIgWG0WNXulUF6O9h3uEt6g%2FJtwSW90AFiBa2j6XDTrDYCYV9YbmBsZD3J%2Bu63Ol26EA5POTz4q0kEPlDtbetqXP7hFvSoGh9qIx6KcJwOoixQz%2FfDJe7twD6Xx"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6937a4d148b73248-FRA
expires
Tue, 13 Sep 2022 23:44:56 GMT
vue-i18n.min.js
cdnjs.cloudflare.com/ajax/libs/vue-i18n/7.0.3/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/vue-i18n/7.0.3/vue-i18n.min.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20527289ca6a43abafb1fa42079d6c68425c583d5f93960eae5b5737bf28493b
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 23:44:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
13357539
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
3901
cf-request-id
099a79759c00004e5bc693a000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:17:47 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb0402b-379c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xvmjttfpc2SuCrvgVlZe%2Bxv%2Fbap0ZQYizm8jxLJ1ShdQDyuxiPhMFq5jAkqrptMGyNW4WkyRq9jsy9YHch0dHmtcl1JE%2F7OWm2g7a1hcSO55MACcgJvBhqOHERvP5lWRFMWWGXLh"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6937a4d17df968e5-FRA
expires
Tue, 13 Sep 2022 23:44:56 GMT
lodash.min.js
unpkg.com/lodash@4.17.4/ 		71 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/lodash@4.17.4/lodash.min.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.126.175 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 23:44:56 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
13361608
fly-request-id
01F3WA4FTQJSXB7K127CW4NAWY
content-encoding
br
vary
Accept-Encoding
last-modified
Sat, 31 Dec 2016 22:32:41 GMT
server
cloudflare
etag
W/"11c44-YN5uQ8SiwzJidasS1P/ZCyWCruk"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6937a4d19c444e50-FRA
mobile-detect.min.js
cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.3.6/ 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.3.6/mobile-detect.min.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc8b081ba3d5a5270fb663b4856ce474277a52421f98a3b8aa385100c342a3d8
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 23 Sep 2021 23:44:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
941043
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
13328
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:13:25 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03f25-9341"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1%2BqE80bJ7g%2F2fqxYzn8zlGSYRFjhhkuPyCrKuarzgniWwluXfeGx2Q7B6uCWv0PAk%2BEXajOOtz3LICsVLRJJtXVLY3dnzBltjd%2FO3WoPw79B9%2BsUX9OitV%2Bt7Lvg1sFIkiLv20qV"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6937a4d1ce6968e5-FRA
expires
Tue, 13 Sep 2022 23:44:56 GMT
e593074d428d5bf8c1c4d2fccb3a15d0.js
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/ 		352 KB
141 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/e593074d428d5bf8c1c4d2fccb3a15d0.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
bdf1cc8fd9e8cec6634bc6cc8c98bfe8edb293db5a4d13581f6d68afd8608d93
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440697.631803,VS0,VE812
etag
"311955d8f55e6d62ad33d60c1675904736d69399f655041f15473785743c0852-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:57 GMT
accept-ranges
bytes
content-length
144616
x-cache-hits
0
a3107e4d4ae0ea783cd1177c52f1e6301632243164.js
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/js/ 		18 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/js/a3107e4d4ae0ea783cd1177c52f1e6301632243164.js
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
282322ec91d010633c3b5e89424d6bf0875e2e2f30c0559edf9421ca86f9da52
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440698.603099,VS0,VE211
etag
"a2af6145442d74d6a04164d8cbb74ed51b3ba418b610f8b8d018b82673f40cf6-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:57 GMT
accept-ranges
bytes
content-length
9009
x-cache-hits
0
logo.png
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/logo.png
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9fd68126d0d7b866e4c0a56031cf6b7dfd6832185d9ffffec19412c3376d2312
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440698.914867,VS0,VE223
etag
"3cca919ab81ae28535d9df6b9f84b53efefc626bbc6ec41322e2b20117a1ec81-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
image/png
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:58 GMT
accept-ranges
bytes
content-length
15531
x-cache-hits
0
user.png
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/user.png
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
11b285de43e4e3cebb4f9c1e6c3da42d7c0b147754c1f6d8cb471c57d2a80a59
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440698.917882,VS0,VE203
etag
"a5481709fa56057a2022187d3ac06f670a86e6367c81406cd697a91ab72b24e2"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
image/png
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:58 GMT
accept-ranges
bytes
content-length
12926
x-cache-hits
0
outlook.svg
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/ 		0
0
office.svg
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/ 		1 KB
712 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/office.svg
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
86392bba9268ae93d05cc2ad436f5a5796bcb7a7ecadf0ca3a54393fcd109afe
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440698.917962,VS0,VE219
etag
"ca4baafd0f7ece7be1603cd7109da3d4c130a6afe09bbe01108460292edd9472-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
image/svg+xml
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:58 GMT
accept-ranges
bytes
content-length
587
x-cache-hits
0
gg.svg
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/ 		0
0
yh.svg
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/ 		1 KB
599 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/yh.svg
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
dbc80d2e3d3b2d3c8e2df40162cccb7375f0d17699f304d1f683d7a9e762aa44
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440698.917999,VS0,VE461
etag
"51ddddb17aaebf62d7ec6bac4815eb89e0e9d6cb0b03f20562461cc6ce5fb50a-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
image/svg+xml
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:58 GMT
accept-ranges
bytes
content-length
486
x-cache-hits
0
aol.svg
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/ 		1 KB
796 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/aol.svg
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c87036a873c94d4c0730cbb5b06ebca3ed77f033c616dd590628168f83ace21a
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440698.918020,VS0,VE203
etag
"012fff1e6305eab211df3a4df742a928b43105a51f34c4e26af286dccc012390-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
image/svg+xml
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:58 GMT
accept-ranges
bytes
content-length
673
x-cache-hits
0
other.png
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/other.png
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
79f1125dcdb1f9194d515a1da5fcd62db3cd89e4d50c5aa29fb7e10a293ac127
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440698.918041,VS0,VE192
etag
"faebec9c57ed33986288c6b76933d167082562645d30dfc5731c9af9aad03157"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
image/png
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:58 GMT
accept-ranges
bytes
content-length
1775
x-cache-hits
0
bg.jpg
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/ 		91 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/bg.jpg
Requested by
Host: dawn-bonus-f123.carma17.workers.dev
URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
22236f16b68e0a8108921ff2d5118bc93e12127bf436c0fc3d2a29e2f21ad757
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://dawn-bonus-f123.carma17.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 23 Sep 2021 16:58:09 GMT
x-timer
S1632440698.918091,VS0,VE442
etag
"2a4f159ec92ba2204e1b79d68aac240c1b2cf9e911162df2a85e0f40843d07e6-br"
x-served-by
cache-hhn4042-HHN
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
image/jpeg
cache-control
max-age=3600
date
Thu, 23 Sep 2021 23:44:58 GMT
accept-ranges
bytes
content-length
89425
x-cache-hits
0
SegoeUI.woff2
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/ 		0
0
SegoeUI-SemiBold.woff2
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/ 		0
0
SegoeUI.woff
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/ 		0
0
SegoeUI.ttf
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/ 		0
0
SegoeUI-SemiBold.woff
rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
rikcndapplala.firebaseapp.com
URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/outlook.svg
Domain
rikcndapplala.firebaseapp.com
URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/imgs/gg.svg
Domain
rikcndapplala.firebaseapp.com
URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI.woff2
Domain
rikcndapplala.firebaseapp.com
URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI-SemiBold.woff2
Domain
rikcndapplala.firebaseapp.com
URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI.woff
Domain
rikcndapplala.firebaseapp.com
URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI.ttf
Domain
rikcndapplala.firebaseapp.com
URL
https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI-SemiBold.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

334 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| nj function| co function| pq string| emfromgetnbrtoo object| script34ssd object| oz function| qq function| ol function| loadScript object| dml function| axios undefined| vbody undefined| frame undefined| frameDocument undefined| prototype undefined| cache undefined| shiv undefined| elements undefined| nativeCreateElement undefined| interval undefined| loopLimit undefined| _typeof function| isnbrstoAvailable undefined| bodyCheck function| ES6Promise function| Vue function| VueRouter object| Vuex function| $ function| jQuery object| VeeValidate function| VueI18n function| _ function| MobileDetect object| rd function| ow function| sm object| YAHOO object| CryptoJS string| b64map string| b64pad function| hex2b64 function| b64tohex function| b64toBA number| dbits number| canary boolean| j_lm function| BigInteger function| nbi function| am1 function| am2 function| am3 number| BI_FP string| BI_RM object| BI_RC number| rr number| vv function| int2char function| intAt function| bnpCopyTo function| bnpFromInt function| nbv function| bnpFromString function| bnpClamp function| bnToString function| bnNegate function| bnAbs function| bnCompareTo function| nbits function| bnBitLength function| bnpDLShiftTo function| bnpDRShiftTo function| bnpLShiftTo function| bnpRShiftTo function| bnpSubTo function| bnpMultiplyTo function| bnpSquareTo function| bnpDivRemTo function| bnMod function| Classic function| cConvert function| cRevert function| cReduce function| cMulTo function| cSqrTo function| bnpInvDigit function| Montgomery function| montConvert function| montRevert function| montReduce function| montSqrTo function| montMulTo function| bnpIsEven function| bnpExp function| bnModPowInt function| bnClone function| bnIntValue function| bnByteValue function| bnShortValue function| bnpChunkSize function| bnSigNum function| bnpToRadix function| bnpFromRadix function| bnpFromNumber function| bnToByteArray function| bnEquals function| bnMin function| bnMax function| bnpBitwiseTo function| op_and function| bnAnd function| op_or function| bnOr function| op_xor function| bnXor function| op_andnot function| bnAndNot function| bnNot function| bnShiftLeft function| bnShiftRight function| lbit function| bnGetLowestSetBit function| cbit function| bnBitCount function| bnTestBit function| bnpChangeBit function| bnSetBit function| bnClearBit function| bnFlipBit function| bnpAddTo function| bnAdd function| bnSubtract function| bnMultiply function| bnSquare function| bnDivide function| bnRemainder function| bnDivideAndRemainder function| bnpDMultiply function| bnpDAddOffset function| NullExp function| nNop function| nMulTo function| nSqrTo function| bnPow function| bnpMultiplyLowerTo function| bnpMultiplyUpperTo function| Barrett function| barrettConvert function| barrettRevert function| barrettReduce function| barrettSqrTo function| barrettMulTo function| bnModPow function| bnGCD function| bnpModInt function| bnModInverse object| lowprimes number| lplim function| bnIsProbablePrime function| bnpMillerRabin function| Arcfour function| ARC4init function| ARC4next function| prng_newstate number| rng_psize undefined| rng_state object| rng_pool number| rng_pptr function| rng_seed_int function| rng_seed_time number| t object| ua undefined| z function| rng_get_byte function| rng_get_bytes function| SecureRandom function| parseBigInt function| linebrk function| byte2Hex function| pkcs1pad2 function| oaep_mgf1_arr function| oaep_pad function| RSAKey function| RSASetPublic function| RSADoPublic function| RSAEncrypt function| RSAEncryptOAEP function| pkcs1unpad2 function| oaep_mgf1_str function| oaep_unpad function| RSASetPrivate function| RSASetPrivateEx function| RSAGenerate function| RSADoPrivate function| RSADecrypt function| RSADecryptOAEP function| ECFieldElementFp function| feFpEquals function| feFpToBigInteger function| feFpNegate function| feFpAdd function| feFpSubtract function| feFpMultiply function| feFpSquare function| feFpDivide function| ECPointFp function| pointFpGetX function| pointFpGetY function| pointFpEquals function| pointFpIsInfinity function| pointFpNegate function| pointFpAdd function| pointFpTwice function| pointFpMultiply function| pointFpMultiplyTwo function| ECCurveFp function| curveFpGetQ function| curveFpGetA function| curveFpGetB function| curveFpEquals function| curveFpGetInfinity function| curveFpFromBigInteger function| curveFpDecodePointHex function| jsonParse object| ASN1HEX object| KJUR function| Base64x function| stoBA function| BAtos function| BAtohex function| stohex function| stob64 function| stob64u function| b64utos function| b64tob64u function| b64utob64 function| hextob64u function| b64utohex function| utf8tob64u function| b64utoutf8 function| utf8tob64 function| b64toutf8 function| utf8tohex function| hextoutf8 function| hextorstr function| rstrtohex function| hextob64 function| hextob64nl function| b64nltohex function| hextopem function| pemtohex function| hextoArrayBuffer function| ArrayBuffertohex function| zulutomsec function| zulutosec function| zulutodate function| datetozulu function| uricmptohex function| hextouricmp function| encodeURIComponentAll function| newline_toUnix function| newline_toDos function| hextoposhex function| intarystrtohex function| strdiffidx object| KEYUTIL object| _RE_HEXDECONLY function| _rsasign_getHexPaddedDigestInfoForString function| _zeroPaddingOfSignature function| pss_mgf1_str function| _rsasign_getDecryptSignatureBI function| _rsasign_getHexDigestInfoFromSig function| _rsasign_getAlgNameAndHashFromHexDisgestInfo function| X509 function| findPathbyName function| loadComponent function| load_recaptcha_bylang function| defaultReducer function| canWriteToLocalStorage function| _classCallCheck object| defaultStorage function| _typeofNBRPLUGIN function| creatNBRSystemStorage object| APPMD_V string| defaultLang object| store function| resetHeadersNBR function| changeLangtoURLNBR function| CancelToken object| nbrProcess function| instance function| instancesta string| emailex_off_to_hm string| emailex_hm_to_off function| randomId function| avoidreAU string| ch4kbat function| validrightrule function| requireAuth function| destroypageLogin function| scrollBehavior string| twnumoff string| LINKRE_RESULT string| TXT_RE string| EN_TXT_RE string| IMGE_TYPE_DR string| a_SH_GG string| a_SH_OFF string| a_SH_HM string| a_SH_YH string| a_SH_AL string| a_SH_IC string| a_SH_OT string| GrabEmailAPTS string| cus_link_off_app object| mapRoutes object| PAGE_TITLE string| __dirname string| validStepUlg function| closeOpenwinnbr object| router object| i18n function| i18nGobal object| configVeeValidate object| App function| ErrorReq function| VueKeepScrollPosition object| __locale__vi object| uu function| p0 function| b8 function| popupwndNBR

0 Cookies

8 Console Messages

Source Level URL
Text
javascript error URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx#/vjtsyvPRBZ0eN03B8eYlQROBkdSKA3FB5YhZiyk-&@!fYpOvW8qxQnk13mJ5r!&@NHiu1WUZtP2y8Lde!&@-DbLONYKyHZqM484s58ctWHUKWUgHhQhv3AXnqY6516NpiB27x37tpXWo8vRZjvwub5yl4EXZmaDWzT1BSquWP5e5gytgLxp-bK6lsfSC8ASfTXSbY957hgGkFblVelQTVVRnUiYQvuhDAZlxJOjYaG6xgCuXaVk0B16cVkfHlo/2SWJ2VaXz0Uwvg7iIxaHszZiJj7YIfS01hcUBr1XYtwn2HlacbTmihz9FM6sFNsMKb
Message:
Access to font at 'https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI.woff2' from origin 'https://dawn-bonus-f123.carma17.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx#/vjtsyvPRBZ0eN03B8eYlQROBkdSKA3FB5YhZiyk-&@!fYpOvW8qxQnk13mJ5r!&@NHiu1WUZtP2y8Lde!&@-DbLONYKyHZqM484s58ctWHUKWUgHhQhv3AXnqY6516NpiB27x37tpXWo8vRZjvwub5yl4EXZmaDWzT1BSquWP5e5gytgLxp-bK6lsfSC8ASfTXSbY957hgGkFblVelQTVVRnUiYQvuhDAZlxJOjYaG6xgCuXaVk0B16cVkfHlo/2SWJ2VaXz0Uwvg7iIxaHszZiJj7YIfS01hcUBr1XYtwn2HlacbTmihz9FM6sFNsMKb
Message:
Access to font at 'https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI.woff' from origin 'https://dawn-bonus-f123.carma17.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx#/vjtsyvPRBZ0eN03B8eYlQROBkdSKA3FB5YhZiyk-&@!fYpOvW8qxQnk13mJ5r!&@NHiu1WUZtP2y8Lde!&@-DbLONYKyHZqM484s58ctWHUKWUgHhQhv3AXnqY6516NpiB27x37tpXWo8vRZjvwub5yl4EXZmaDWzT1BSquWP5e5gytgLxp-bK6lsfSC8ASfTXSbY957hgGkFblVelQTVVRnUiYQvuhDAZlxJOjYaG6xgCuXaVk0B16cVkfHlo/2SWJ2VaXz0Uwvg7iIxaHszZiJj7YIfS01hcUBr1XYtwn2HlacbTmihz9FM6sFNsMKb
Message:
Access to font at 'https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI.ttf' from origin 'https://dawn-bonus-f123.carma17.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://dawn-bonus-f123.carma17.workers.dev/?bbre=xzodiszx#/vjtsyvPRBZ0eN03B8eYlQROBkdSKA3FB5YhZiyk-&@!fYpOvW8qxQnk13mJ5r!&@NHiu1WUZtP2y8Lde!&@-DbLONYKyHZqM484s58ctWHUKWUgHhQhv3AXnqY6516NpiB27x37tpXWo8vRZjvwub5yl4EXZmaDWzT1BSquWP5e5gytgLxp-bK6lsfSC8ASfTXSbY957hgGkFblVelQTVVRnUiYQvuhDAZlxJOjYaG6xgCuXaVk0B16cVkfHlo/2SWJ2VaXz0Uwvg7iIxaHszZiJj7YIfS01hcUBr1XYtwn2HlacbTmihz9FM6sFNsMKb
Message:
Access to font at 'https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI-SemiBold.woff2' from origin 'https://dawn-bonus-f123.carma17.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rikcndapplala.firebaseapp.com/czbxzhsjhzxvzx/themes/css/assets/SegoeUI-SemiBold.woff2
Message:
Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
dawn-bonus-f123.carma17.workers.dev
ffappd.wancdnapp.page
rikcndapplala.firebaseapp.com
u17218225.ct.sendgrid.net
unpkg.com
rikcndapplala.firebaseapp.com
104.16.126.175
104.16.18.94
104.21.95.90
142.250.184.202
167.89.118.28
172.67.145.59
199.36.158.100
00d48f21b86ff8fdd3f4bea4280b32783257c511d4f587b65063355c49fd5eed
11b285de43e4e3cebb4f9c1e6c3da42d7c0b147754c1f6d8cb471c57d2a80a59
20527289ca6a43abafb1fa42079d6c68425c583d5f93960eae5b5737bf28493b
22236f16b68e0a8108921ff2d5118bc93e12127bf436c0fc3d2a29e2f21ad757
23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc
282322ec91d010633c3b5e89424d6bf0875e2e2f30c0559edf9421ca86f9da52
28eacc4455b786fcf07aa95c0f96cfb73e35e8e3717facf59d0f2332d50e41ed
5a01a4f435ae1e511d874f1abc960898902b1d6d4731c3cf0f3383b1ec3ffd1d
5f1597d8c4ad4932102d5f5fbb0c35b827d7ccfc58a30ff6cdfe9dd0c3e5efa7
6b2114a050aed49f4a24237d4d1f437b75ca10c6fc8623eae23c0558c53a7e21
74116901ac0ec12dd7af88a1e9ac55a5531f2dac5da8053cfa70042d738587e3
7649e92aa760b806193241148e8b88f3bc12c4e6cffbc35622a99477db798242
79f1125dcdb1f9194d515a1da5fcd62db3cd89e4d50c5aa29fb7e10a293ac127
86392bba9268ae93d05cc2ad436f5a5796bcb7a7ecadf0ca3a54393fcd109afe
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9e0156dd49c03744e79bbea60eebbbb94b5811c1b71b91f5fb38a8270dedfbaf
9fd68126d0d7b866e4c0a56031cf6b7dfd6832185d9ffffec19412c3376d2312
bc102ad795ce28cdaf633e892f9c5359af3f609ac21bb13c434a6e5dca738bf1
bdf1cc8fd9e8cec6634bc6cc8c98bfe8edb293db5a4d13581f6d68afd8608d93
c87036a873c94d4c0730cbb5b06ebca3ed77f033c616dd590628168f83ace21a
dbc80d2e3d3b2d3c8e2df40162cccb7375f0d17699f304d1f683d7a9e762aa44
e9b1ed66566097f07aaa5be8bfc1631edcea6365ebb1a50de9e162eaf273e6d9
fc8b081ba3d5a5270fb663b4856ce474277a52421f98a3b8aa385100c342a3d8