events.turnament-freefire.biz.id
Open in
urlscan Pro
2606:4700:3032::6815:25b4
Malicious Activity!
Public Scan
Submission: On March 27 via api from US — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on March 26th 2024. Valid for: 3 months.
This is the only time events.turnament-freefire.biz.id was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Gaming (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3032::6815:25b4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 118.69.83.73 118.69.83.73 | 18403 (FPT-AS-AP...) (FPT-AS-AP FPT Telecom Company) | |
14 | 172.67.211.68 172.67.211.68 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 2607:f8b0:400... 2607:f8b0:4004:c09::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 169.197.85.95 169.197.85.95 | 26548 (PUREVOLTA...) (PUREVOLTAGE-INC) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
2 | 2607:f8b0:400... 2607:f8b0:4004:c1d::5e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:9000:20e... 2600:9000:20ed:4200:12:3436:3dc0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:1405:400... 2600:1405:4000::1727:e551 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
34 | 12 |
ASN13335 (CLOUDFLARENET, US)
events.turnament-freefire.biz.id |
ASN15169 (GOOGLE, US)
fonts.googleapis.com | |
ajax.googleapis.com |
ASN16509 (AMAZON-02, US)
dl.dir.freefiremobile.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
turnament-freefire.biz.id
events.turnament-freefire.biz.id |
282 KB |
6 |
zing.vn
img.zing.vn — Cisco Umbrella Rank: 352546 |
607 KB |
5 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 112 ajax.googleapis.com — Cisco Umbrella Rank: 728 |
61 KB |
2 |
gstatic.com
fonts.gstatic.com |
71 KB |
1 |
pinimg.com
i.pinimg.com — Cisco Umbrella Rank: 1962 |
67 KB |
1 |
freefiremobile.com
dl.dir.freefiremobile.com — Cisco Umbrella Rank: 17621 |
256 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1216 |
32 KB |
1 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 10549 |
83 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4208 |
8 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 389 |
7 KB |
34 | 10 |
Domain | Requested by | |
---|---|---|
15 | events.turnament-freefire.biz.id |
events.turnament-freefire.biz.id
|
6 | img.zing.vn |
events.turnament-freefire.biz.id
img.zing.vn |
3 | fonts.googleapis.com |
events.turnament-freefire.biz.id
img.zing.vn |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | ajax.googleapis.com |
events.turnament-freefire.biz.id
|
1 | i.pinimg.com |
events.turnament-freefire.biz.id
|
1 | dl.dir.freefiremobile.com |
events.turnament-freefire.biz.id
|
1 | code.jquery.com |
events.turnament-freefire.biz.id
|
1 | i.ibb.co |
events.turnament-freefire.biz.id
|
1 | stackpath.bootstrapcdn.com |
events.turnament-freefire.biz.id
|
1 | cdnjs.cloudflare.com |
events.turnament-freefire.biz.id
|
34 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
turnament-freefire.biz.id GTS CA 1P5 |
2024-03-26 - 2024-06-24 |
3 months | crt.sh |
*.zing.vn DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-06-13 - 2024-07-13 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-02-26 - 2024-05-20 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-03-27 - 2024-06-25 |
3 months | crt.sh |
ibb.co R3 |
2024-02-07 - 2024-05-07 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-26 - 2024-05-20 |
3 months | crt.sh |
dl.dir.freefiremobile.com Amazon RSA 2048 M03 |
2023-11-29 - 2024-12-27 |
a year | crt.sh |
i2.pinimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-05-03 - 2024-05-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://events.turnament-freefire.biz.id/
Frame ID: 2E23AC43B316D4DE815EAD6BA5849F58
Requests: 36 HTTP requests in this frame
Screenshot
Page Title
FREE FIRE - Turnamen OnlineDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
34 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
events.turnament-freefire.biz.id/ |
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
img.zing.vn/products/pubgm/skin-2020/dist/main/ |
815 KB 467 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
events.turnament-freefire.biz.id/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
facebook.css
events.turnament-freefire.biz.id/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
twitter.css
events.turnament-freefire.biz.id/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
5 KB 782 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
material-design-iconic-font.css
cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/ |
83 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
3 KB 725 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
facebook_icon.png
events.turnament-freefire.biz.id/img/login/ |
78 KB 78 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
facebook_text.png
events.turnament-freefire.biz.id/img/login/ |
28 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FF.webp
i.ibb.co/2NwFDMk/ |
83 KB 83 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
twitter_text.png
events.turnament-freefire.biz.id/img/login/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
email-decode.min.js
events.turnament-freefire.biz.id/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.10.2.min.js
code.jquery.com/ |
91 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ |
82 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.3/ |
82 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
img.zing.vn/products/pubgm/skin-2020/dist/main/ |
321 KB 118 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
popup.js
events.turnament-freefire.biz.id/js/ |
500 B 608 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
showHide.js
events.turnament-freefire.biz.id/js/ |
1 KB 725 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
content.js
events.turnament-freefire.biz.id/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
counter.js
events.turnament-freefire.biz.id/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
google.js
events.turnament-freefire.biz.id/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
buktup.js
events.turnament-freefire.biz.id/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
10 KB 914 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg-nav.png
img.zing.vn/products/pubgm/skin-2020/dist/main/images/bg/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg-bottom-banner-home.png
img.zing.vn/products/pubgm/skin-2020/dist/main/images/bg/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
493 KB 493 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2
fonts.gstatic.com/s/robotocondensed/v27/ |
50 KB 50 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ieVo2ZhZI2eCN5jzbjEETS9weq8-_d6T_POl0fRJeyWyosBO5Xw.woff2
fonts.gstatic.com/s/robotocondensed/v27/ |
20 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_sprites-nav.png
img.zing.vn/products/pubgm/skin-2020/dist/main/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c1b18d56fc986c97cf554ac00e96f7de.jpg
dl.dir.freefiremobile.com/common/web_event/official2.ff.garena.all/20243/ |
255 KB 256 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f39184fea757b1aa735ce4edc5ce334a.jpg
i.pinimg.com/564x/f3/91/84/ |
67 KB 67 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
introducing.jpg
events.turnament-freefire.biz.id/img/ |
161 KB 162 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon.ico
img.zing.vn/products/pubgm/ |
4 KB 5 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Gaming (Entertainment)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal function| $ function| jQuery object| lazySizes object| __core-js_shared__ object| core function| account_login function| close_account_login function| facebook_login function| twitter_login function| close_facebook_login function| close_twitter_login function| showFbPassword function| hideFbPassword function| showTwitterPassword function| hideTwitterPassword0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
dl.dir.freefiremobile.com
events.turnament-freefire.biz.id
fonts.googleapis.com
fonts.gstatic.com
i.ibb.co
i.pinimg.com
img.zing.vn
stackpath.bootstrapcdn.com
104.17.24.14
104.18.11.207
118.69.83.73
169.197.85.95
172.67.211.68
2600:1405:4000::1727:e551
2600:9000:20ed:4200:12:3436:3dc0:93a1
2606:4700:3032::6815:25b4
2607:f8b0:4004:c09::5f
2607:f8b0:4004:c1d::5e
2a04:4e42:200::649
092a3cd5f86b3f039feefdeb86694cd16ae545af214cfda614bdbbe2d1bde401
09491a5e5027abba01aaa649050fe0370c818a9ede357fa72b4798c2d491116f
096419a5c82a883441ece55e606bf1f9c4c8c7d8679549d70610a46691cd1cb9
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
10aaa743106aab5b136c4e6291660dd25368a94ed25a9be4e95cfee8ea28ea3d
11063067ff0c3cacc6acfca8dbfee98f3d72d862eff1471aa66ba4965110c47b
163aad2fec6b167bec769c24b4156222392ebf25b9377d9278e20b811bc24d06
169b6989c2800b5e81484935edf18b73e67f02adf21aec680832884bbce5d653
1be5d05ce6faad469f7f9c5a5879f2d9f8d267b60eb394e92c19217268bcea8f
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
286b689e6def6e4f0e84c5ab255bc8798d1b393378dbfd3fcd8ac1130fe346af
498f589cd376a4801a684b81f38229386b8b2f849ab48ee6f644cc19513eacfd
4c5e70219e34e87735a3b1b930dd0ae8e344bef36b1732780d8a2ac0571c0be7
517edd119c5b2719e6ac4b30bf1fd864a6395179a41d273c0afc0696e7495d8e
6ccc9ba9f900461b0dca79ef95c6472e781a886a723bb6d8493dcfc23059c187
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8023fc37af7de956061342860b38dd1646ce1f1fa7ecc2ce703e2b544b2bd283
81f8bb9a081a560ab65989a821591ecbfc47987203dce7a87cf3d4aab9908705
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
8fdf25dae27911773057ffdb2bd187a34d9242c548cbcd7b74d84dbf9c4c3dbe
948d25dc34ee935a5254468691714c9f2e53a2927652a077c2ca84cb03fa4895
94d33c38dccb2749d18b9631332a1759e0c2a39396be48e5f42c7f7e2cd56cab
9630e76557e35f8ce91bf74cac9b7d418715151c6715bd4a6d618749ee181868
a126cf1f79c44498d6316628e5e31efb5ca12692eb8f614ef3ff1bbba29241c5
a20af21afb394e0efb04bb292e5faaf2684003d2d94d71122b8f98c69fb68870
a55cf88f8ef6533e8058b8f66090401fbabb9e2d00135adcac9635d3dd0f91cb
cbf29fc3dabcae2776c41fba2ae5826f4fef75f26e5b44e565029a9631d6fc47
cbfc929b005b468835c50e4c16b2fe61676e3a17ca6057086326ab8a1cb0f160
e24997d9dd686a11dd2fee4c1cc399c05fe374de0718b8eb063eebcaa3d5b0e2
f37d6f502a5a961ac5c3f17c8d58685ff6b0dc0f69c2dcdd379ccabc96ec3bf2
f9e873ed49fe5fafdd56758d55af1a1ab8321c44e5e2f50f17a981af4af45e2a