winads.eraofecom.org Open in urlscan Pro
2606:4700:3037::ac43:bfbf  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response winads.eraofecom.org/	9 KB 3 KB	286ms 234ms	Document text/html	2606:4700:3037::ac43:bfbf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://winads.eraofecom.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:bfbf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 127eb5f291a96aee47b004fb644164ee9290eb5b2b5cedb02ac261ab9fb536e2 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, must-revalidate cf-cache-status DYNAMIC cf-ray 7d4d8c54ccb22c33-FRA content-encoding br content-type text/html; charset=UTF-8 date Sat, 10 Jun 2023 00:37:51 GMT expires -1 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z%2BPmq7ULybQmTt1%2FhJDTkE9J8gOB6pcl7fkLewu0%2FAClMh5gq1kr8PwUtDBTTP2pp3QJtn0YRKPJci3RwTRGVz7A10QwKvzBOJbe0q5HUNeIuAmMzqUvazmMzbjWzdwsHJWF%2FpYwYSiUmOyIiUNvsqec%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	css fonts.googleapis.com/	2 KB 906 B	139ms 49ms	Stylesheet text/css	2a00:1450:4001:82a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Quicksand:500,700&display=swap Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 30993ac1c399bc0e63a5a5180dc342f67c994e5c15b844b1d803bd38dcf6b2e1 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Sat, 10 Jun 2023 00:37:51 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Sat, 10 Jun 2023 00:37:51 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 10 Jun 2023 00:37:51 GMT
GET H2	200	slim.css winads.eraofecom.org/css/	7 KB 2 KB	210ms 204ms	Stylesheet text/css	2606:4700:3037::ac43:bfbf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://winads.eraofecom.org/css/slim.css Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:bfbf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ad6a73a3f0fe90a7490cf059ca49d0600e4db67d3124cc24d30f8cc4d51716c6 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 00:37:51 GMT content-encoding br cf-cache-status MISS last-modified Fri, 05 Nov 2021 06:16:47 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"1c0f-5d00496873586-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m9Y3JYtq2ktJtlElSjkR2zNn5lOBIAgciDH%2FpqiqcNO6hJUNto8mKQH%2F3QpF3hcbUgsUvuklKt8LKVYBqN%2BZZgy2KRbH541Kt3L4DXO6xYhKE0hCXz7MCH0j16w%2ByV%2FZmtX%2B%2Fc5r9YtUr%2FgvldzAVKr%2FHA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 7d4d8c565d952c33-FRA alt-svc h3=":443"; ma=86400
GET H2	200	includes.js Show response winads.eraofecom.org/js/	4 KB 2 KB	207ms 202ms	Script application/javascript	2606:4700:3037::ac43:bfbf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://winads.eraofecom.org/js/includes.js Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:bfbf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3ebe0a2693e7fa369a7c3533505cc9f6941ed56739d4f0945c8f3c38ee2cf9df Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 00:37:51 GMT content-encoding br cf-cache-status MISS last-modified Sat, 31 Dec 2022 07:26:08 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"1070-5f11aa1b9dc8b-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gSIBKRNb%2Bo%2FDQNUjOu0zlkzuHEvPcsSFsGLMnTN9qBJJxwqIvij4j68mQGZIRC7bjz8IhLbqM5dGZ7hTLsdOQzWrWxOBsnbrTznxFffzTeqtZCyj%2BsLLyMczHrD2KXGnKMOWjzZ63bleHpU9spIp20p9PA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 7d4d8c565d992c33-FRA alt-svc h3=":443"; ma=86400
GET H2	200	Tracker.js Show response winads.eraofecom.org/js/	5 KB 2 KB	210ms 206ms	Script application/javascript	2606:4700:3037::ac43:bfbf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://winads.eraofecom.org/js/Tracker.js Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:bfbf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 01aa9690b4812e3948f0378c8f6085d2102c8cf5d1aba7ce8939fbed16e0e034 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 00:37:51 GMT content-encoding br cf-cache-status MISS last-modified Sun, 19 Jul 2020 16:19:16 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"133c-5aacdc06cc8b7-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aHPbTJxxW%2BumJctDbhASFe7XXmpiczUw5BmuZ9e3r3J0i81ci900E%2By2MSg7SgI7BvR0KkzHzWiAPW976qFhc%2FoCw5dAMZl0TrXIPDvnTglDW%2FfVtbHm1IKnSJZ5qZZ%2FTmCVR4ihqlB2GiJQDIUCJqApYA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 7d4d8c565d9a2c33-FRA alt-svc h3=":443"; ma=86400
GET H2	200	imports.css winads.eraofecom.org/css/	560 KB 63 KB	416ms 412ms	Stylesheet text/css	2606:4700:3037::ac43:bfbf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://winads.eraofecom.org/css/imports.css Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:bfbf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 06ce24ee44c2013804799b6d895751b845bd969ddd53f5b3384c59741567ae84 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 00:37:52 GMT content-encoding br cf-cache-status MISS last-modified Thu, 10 Nov 2022 11:45:39 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"8c049-5ed1c4ff45811-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EcdmbrrXME54MpqScv9eGXdRDLhK8M6qLvpswUZiydJ1UMITwPNPjLhhLTzegUlEuA30klKTiqM5b8s0yzZhWHOWU%2FDqUjiqgEbQJyu9tLPAzTZ6Z8Jcd1YXeIGgvq5l%2BFU4pglP6YBpX%2BpLAynMqMby1A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 7d4d8c565d972c33-FRA alt-svc h3=":443"; ma=86400
GET H2	200	plans.css winads.eraofecom.org/css/	32 KB 7 KB	212ms 208ms	Stylesheet text/css	2606:4700:3037::ac43:bfbf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://winads.eraofecom.org/css/plans.css Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:bfbf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 23f59a1062708b80e63dfc8d8ac52fa5987eacd312f61ffe02d279699a5bc879 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 00:37:51 GMT content-encoding br cf-cache-status MISS last-modified Mon, 04 Jul 2022 08:28:11 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"8145-5e2f6843b12c5-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lzilpbu62vmR9%2F%2BkQpby4PEeFiw7ttGGqANtAGf7bEeHz5JJcrSXQMSId6qis1IIsJGR54cSyOxFFEosl1mRtpOPkQ8t%2FFKAzIXmlR64yUdpZ90yVeB2nZPHoiSsS2%2B887UA5dD%2BZqV7AHEhSSlZ4fZm9w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 7d4d8c565d982c33-FRA alt-svc h3=":443"; ma=86400
GET H3	200	winAds-landscape-lg-b.png winads.eraofecom.org/images/	21 KB 22 KB	309ms 308ms	Image image/png	2606:4700:3037::ac43:bfbf CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://winads.eraofecom.org/images/winAds-landscape-lg-b.png Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:bfbf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8838619a3e9a8a87b8636f8d91ddb682fafb12ca5aa630804ae83f9f7451e773 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 00:37:52 GMT cf-cache-status MISS last-modified Tue, 09 Feb 2021 10:26:59 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "5517-5bae4b9fcefb5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OUOfNQvOnBhUvtMS%2B90fchnt7uPpMGUzYWaUFDTafDimN1QP2S5Ytmb4GbdVR73eDz6fN3ffp0LSxN5f5M9SU3eblIjIrK9xYOrVe8ldZ1Iq4aUXKLHbucOseApV8a2%2F%2FkpX4eCqa8%2BHU1codO3E%2FonlYw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 7d4d8c580b3f6904-FRA alt-svc h3=":443"; ma=86400 content-length 21783
GET H2	200	analytics.js Show response www.google-analytics.com/	51 KB 21 KB	136ms 38ms	Script text/javascript	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/js/includes.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Fri, 09 Jun 2023 23:04:48 GMT last-modified Mon, 17 Apr 2023 22:36:01 GMT server Golfe2 age 5584 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20737 expires Sat, 10 Jun 2023 01:04:48 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	108 KB 28 KB	33ms 9ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/js/includes.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 64816ef42196992f1120608cafa36df8e03c81064551abb6f23bc00f69bf6727 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Sat, 10 Jun 2023 00:37:52 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27810 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug aqBh9kcqy67U6WhqNLy4p2J0uQdnLyjkG8RVi73H8AJ3oRIPYU/ys+OE8Rni5Y1R4IiaZHdMKsnRaUp/2zN4oA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-trip-id 1679558926 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	hotjar-1647270.js Show response static.hotjar.com/c/	9 KB 4 KB	69ms 40ms	Script application/javascript	18.66.97.49 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-1647270.js?sv=6 Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/js/includes.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.97.49 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-97-49.fra56.r.cloudfront.net Software / Resource Hash fa046cefd38b54541ba3806dcd733034fc959c4a698ae311eb13e8d00c12767b Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 00:37:52 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=2592000; includeSubDomains via 1.1 3a3c1dcacd115187f53f40028ae4bd24.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P2 etag W/108b49da58b22bf1c0d99020d93bd06e vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=60 x-cache-hit 1 cross-origin-resource-policy cross-origin x-amz-cf-id 2MAIJWfZM5thWa8S2bajanpzM263f8Eb5XpJ9k-ZFmmBxJp1WcRgGA==
GET H3	200	hexa2.jpg winads.eraofecom.org/images/	45 KB 45 KB	395ms 395ms	Image image/jpeg	2606:4700:3037::ac43:bfbf CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://winads.eraofecom.org/images/hexa2.jpg Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/css/slim.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:bfbf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6338966d4d001672199b791b3255ae315202bcd91e1f97112e38ffa61f36e099 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/css/slim.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 00:37:52 GMT cf-cache-status MISS last-modified Fri, 24 Jul 2020 15:18:12 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "b26d-5ab317b38d830" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AuS2jRjsL1NcfMHd2iF%2Fe8kDLUipQwD7Kj580Y%2Bc1Fl1EB6J4YzT1uKQjT%2FLpTH2S3VtOnIBj7XF8polEHjDRiZmWw72YmII1isrb6XhE1Ddx6aSAt5Uj2XbKwVCTRBL3WCUFUoDRaYEaoZf7k4nmlh98Q%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control max-age=14400 accept-ranges bytes cf-ray 7d4d8c593bdb6904-FRA alt-svc h3=":443"; ma=86400 content-length 45677
GET H2	200	6xKtdSZaM9iE8KbpRA_hK1QN.woff2 fonts.gstatic.com/s/quicksand/v30/	25 KB 26 KB	115ms 36ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/quicksand/v30/6xKtdSZaM9iE8KbpRA_hK1QN.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Quicksand:500,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8b166007d6f54c33b3ea10ea23572bc3166f55f365840d3cbd6ef7b5dcf6674e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://winads.eraofecom.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 03 Jun 2023 17:02:56 GMT x-content-type-options nosniff age 545696 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 25672 x-xss-protection 0 last-modified Mon, 18 Jul 2022 19:12:08 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 02 Jun 2024 17:02:56 GMT
GET H2	200	1476784645704645 Show response connect.facebook.net/signals/config/	300 KB 86 KB	162ms 161ms	Script application/x-javascript	2a03:2880:f084:d:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1476784645704645?v=2.9.107&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f84c324b31db0771c94fafc5b13526e02a1e63e3ca14bc190d66838984024949 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Sat, 10 Jun 2023 00:37:52 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug gUqjZVCMuvB+IIfihmxNv8tijrJU8LScD27CoY7to5o8EvBc5wYTfUrq4Amg/EjbSVmVphkxsGjXIQ5964HL1g== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-trip-id 1679558926 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	modules.842e148a127be39dcaed.js Show response script.hotjar.com/	269 KB 69 KB	46ms 10ms	Script application/javascript	52.222.236.122 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.842e148a127be39dcaed.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1647270.js?sv=6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.236.122 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-236-122.fra56.r.cloudfront.net Software / Resource Hash 4179ea59ca86f07d474bedf959a49c3f3fce5ccbabb4e0673996bc003a4946fc Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Fri, 09 Jun 2023 13:37:07 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=2592000; includeSubDomains via 1.1 d9bcd0a29e17b9290f8c9f1617335954.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P4 age 39645 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 69977 last-modified Fri, 09 Jun 2023 13:37:05 GMT etag "5d95e6104846f0eff8897a265f973c2e" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-robots-tag none x-amz-cf-id pfEnHUSLZf6NQOfngA2Nxs850EU7a-zdFcwU3y6s5zQocIOUTsL-hw==
POST H2	200	collect Show response www.google-analytics.com/j/	15 B 224 B	45ms 45ms	XHR text/plain	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j100&a=2006093144&t=pageview&_s=1&dl=https%3A%2F%2Fwinads.eraofecom.org%2F&ul=en-us&de=UTF-8&dt=Win%20Ads&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=189884964&gjid=1841572897&cid=907583871.1686357472&tid=UA-126210467-2&_gid=1844184076.1686357472&_r=1&_slc=1&z=1714736237 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e311b9b7cc4b8ce6e1f3a2a76f847e5d565571ef492516306c59fdb0592ae141 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://winads.eraofecom.org/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Sat, 10 Jun 2023 00:37:52 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://winads.eraofecom.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	visit-data Show response in.hotjar.com/api/v2/client/sites/1647270/	148 B 323 B	136ms 38ms	XHR application/json	185.48.120.161 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://in.hotjar.com/api/v2/client/sites/1647270/visit-data?sv=6 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.842e148a127be39dcaed.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.48.120.161 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-185-48-120-161.eu-west-1.compute.amazonaws.com Software / Resource Hash 8bb4bb6cbba0b098d67a24992eb1180257f23f2cb38dd8cc4a9acfd99b1fd699 Request headers Referer https://winads.eraofecom.org/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Content-Type text/plain; charset=UTF-8 Response headers date Sat, 10 Jun 2023 00:37:52 GMT content-encoding br vary Accept-Encoding access-control-max-age 86400 content-type application/json access-control-allow-origin * cache-control no-cache, no-store access-control-allow-credentials true
GET H2	200	js Show response www.googletagmanager.com/gtag/	206 KB 74 KB	137ms 54ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-0NHNLB4Z56&cx=c&_slc=1 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 61ca1ad86ca6354dec706abd68dea4ef8625c88166b9f99e8aaa6552d3a3e2e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 00:37:52 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 75472 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Sat, 10 Jun 2023 00:37:52 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	35ms 7ms	Image text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1476784645704645&ev=PageView&dl=https%3A%2F%2Fwinads.eraofecom.org%2F&rl=&if=false&ts=1686357472433&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1686357472432.994692214&it=1686357472241&coo=false&rqm=GET Requested by Host: winads.eraofecom.org URL: https://winads.eraofecom.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Sat, 10 Jun 2023 00:37:52 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
POST H2	200	/ Show response content.hotjar.io/	56 B 161 B	129ms 29ms	XHR application/json	18.202.72.98 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://content.hotjar.io/?gzip=1 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.842e148a127be39dcaed.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 18.202.72.98 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-202-72-98.eu-west-1.compute.amazonaws.com Software / Resource Hash 9c8bb755cc71823265d08c7e5eb69ac6f5ec309e0b1ce1b5e16437190043b2be Request headers Referer https://winads.eraofecom.org/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Content-Type text/plain; charset=UTF-8 Response headers access-control-allow-origin * date Sat, 10 Jun 2023 00:37:52 GMT content-length 56 vary Origin content-type application/json
POST H2	204	collect region1.google-analytics.com/g/	0 257 B	52ms 17ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-0NHNLB4Z56&gtm=45je3671&_p=2006093144&cid=907583871.1686357472&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBA&ngs=1&_s=1&sid=1686357472&sct=1&seg=0&dl=https%3A%2F%2Fwinads.eraofecom.org%2F&dt=Win%20Ads&en=page_view&_fv=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-0NHNLB4Z56&cx=c&_slc=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers pragma no-cache date Sat, 10 Jun 2023 00:37:52 GMT server Golfe2 content-type text/plain access-control-allow-origin https://winads.eraofecom.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 54 B	7ms 7ms	Image text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1476784645704645&ev=Microdata&dl=https%3A%2F%2Fwinads.eraofecom.org%2F&rl=&if=false&ts=1686357473936&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Win%20Ads%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.107&r=stable&ec=1&o=30&fbp=fb.1.1686357472432.994692214&it=1686357472241&coo=false&es=automatic&tm=3&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://winads.eraofecom.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Sat, 10 Jun 2023 00:37:53 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend object| tracking undefined| Tawk_API undefined| Tawk_LoadStart string| GoogleAnalyticsObject function| ga function| fbq function| _fbq function| hj object| _hjSettings function| Tracker object| urlParams object| shopName function| yooo object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| dataLayer object| google_tag_manager

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.eraofecom.org/	1970-01-20 12:27:23	Name: _gid Value: GA1.2.1844184076.1686357472
			.eraofecom.org/	1970-01-20 12:25:57	Name: _gat Value: 1
			.eraofecom.org/	1970-01-20 21:11:33	Name: _hjSessionUser_1647270 Value: eyJpZCI6ImE4MGIxZjgwLTM3ZWQtNTBjOC05MGUyLTA1MjdiYzdhZjczYyIsImNyZWF0ZWQiOjE2ODYzNTc0NzIzNzksImV4aXN0aW5nIjpmYWxzZX0=
			.eraofecom.org/	1970-01-20 12:25:59	Name: _hjFirstSeen Value: 1
			.eraofecom.org/	1970-01-20 12:25:57	Name: _hjIncludedInSessionSample_1647270 Value: 1
			.eraofecom.org/	1970-01-20 12:25:59	Name: _hjSession_1647270 Value: eyJpZCI6ImU4MjM3NTA2LWZhZmItNDU0YS05MjAxLWMwZTQ0ODEyZWJjMSIsImNyZWF0ZWQiOjE2ODYzNTc0NzIzODcsImluU2FtcGxlIjp0cnVlfQ==
			.eraofecom.org/	1970-01-20 12:25:59	Name: _hjAbsoluteSessionInProgress Value: 0
			.eraofecom.org/	1970-01-20 14:35:33	Name: _fbp Value: fb.1.1686357472432.994692214
			.eraofecom.org/	1970-01-20 22:01:57	Name: _ga_0NHNLB4Z56 Value: GS1.1.1686357472.1.0.1686357472.0.0.0
			.eraofecom.org/	1970-01-20 22:01:57	Name: _ga Value: GA1.1.907583871.1686357472

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
content.hotjar.io
fonts.googleapis.com
fonts.gstatic.com
in.hotjar.com
region1.google-analytics.com
script.hotjar.com
static.hotjar.com
winads.eraofecom.org
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
18.202.72.98
18.66.97.49
185.48.120.161
2001:4860:4802:32::36
2606:4700:3037::ac43:bfbf
2a00:1450:4001:808::200e
2a00:1450:4001:812::2003
2a00:1450:4001:82a::200a
2a00:1450:4001:831::2008
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
52.222.236.122
01aa9690b4812e3948f0378c8f6085d2102c8cf5d1aba7ce8939fbed16e0e034
06ce24ee44c2013804799b6d895751b845bd969ddd53f5b3384c59741567ae84
127eb5f291a96aee47b004fb644164ee9290eb5b2b5cedb02ac261ab9fb536e2
23f59a1062708b80e63dfc8d8ac52fa5987eacd312f61ffe02d279699a5bc879
30993ac1c399bc0e63a5a5180dc342f67c994e5c15b844b1d803bd38dcf6b2e1
3ebe0a2693e7fa369a7c3533505cc9f6941ed56739d4f0945c8f3c38ee2cf9df
4179ea59ca86f07d474bedf959a49c3f3fce5ccbabb4e0673996bc003a4946fc
61ca1ad86ca6354dec706abd68dea4ef8625c88166b9f99e8aaa6552d3a3e2e7
6338966d4d001672199b791b3255ae315202bcd91e1f97112e38ffa61f36e099
64816ef42196992f1120608cafa36df8e03c81064551abb6f23bc00f69bf6727
8838619a3e9a8a87b8636f8d91ddb682fafb12ca5aa630804ae83f9f7451e773
8b166007d6f54c33b3ea10ea23572bc3166f55f365840d3cbd6ef7b5dcf6674e
8bb4bb6cbba0b098d67a24992eb1180257f23f2cb38dd8cc4a9acfd99b1fd699
9c8bb755cc71823265d08c7e5eb69ac6f5ec309e0b1ce1b5e16437190043b2be
ad6a73a3f0fe90a7490cf059ca49d0600e4db67d3124cc24d30f8cc4d51716c6
e311b9b7cc4b8ce6e1f3a2a76f847e5d565571ef492516306c59fdb0592ae141
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
f84c324b31db0771c94fafc5b13526e02a1e63e3ca14bc190d66838984024949
fa046cefd38b54541ba3806dcd733034fc959c4a698ae311eb13e8d00c12767b