www.18plusstream.net
Open in
urlscan Pro
2a05:d018:244:5200::ab
Malicious Activity!
Public Scan
Effective URL: https://www.18plusstream.net/c/4c8a669b83e6c2d3?&click_id=tpqmy5f1c9e3d4a9ab566869878&s1=22014&s2=1120016&s3=backuser&s5=&lp=...
Submission: On July 25 via manual from IN
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 27th 2020. Valid for: 3 months.
This is the only time www.18plusstream.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
ASN15169 (GOOGLE, US)
www.googletagservices.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
adservice.google.de | |
adservice.google.com | |
pagead2.googlesyndication.com |
ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f130.1e100.net
securepubads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN15169 (GOOGLE, US)
1ee65a1802695e11552d92664fdc7c09.safeframe.googlesyndication.com |
ASN15169 (GOOGLE, US)
tpc.googlesyndication.com |
ASN16509 (AMAZON-02, US)
onxgoa.datetofcuk.net | |
www.18plusstream.net |
ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-80.deploy.static.akamaitechnologies.com
cdn-bimi.akamaized.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
akamaized.net
cdn-bimi.akamaized.net |
2 MB |
6 |
googlesyndication.com
1ee65a1802695e11552d92664fdc7c09.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com |
11 KB |
2 |
cm-trk3.com
1 redirects
go.cm-trk3.com |
1 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
2 |
doubleclick.net
securepubads.g.doubleclick.net |
90 KB |
2 |
googletagmanager.com
www.googletagmanager.com |
58 KB |
1 |
gstatic.com
fonts.gstatic.com |
14 KB |
1 |
googleapis.com
fonts.googleapis.com |
475 B |
1 |
18plusstream.net
www.18plusstream.net |
3 KB |
1 |
datetofcuk.net
1 redirects
onxgoa.datetofcuk.net |
936 B |
1 |
virsx.com
1 redirects
virsx.com |
379 B |
1 |
perfectjourney.club
1 redirects
track2.perfectjourney.club |
530 B |
1 |
grin23.info
grin23.info |
1 KB |
1 |
google.com
adservice.google.com |
168 B |
1 |
google.de
adservice.google.de |
168 B |
1 |
googletagservices.com
www.googletagservices.com |
16 KB |
1 |
v.ht
v.ht |
2 KB |
32 | 17 |
Domain | Requested by | |
---|---|---|
11 | cdn-bimi.akamaized.net |
www.18plusstream.net
|
3 | tpc.googlesyndication.com |
securepubads.g.doubleclick.net
tpc.googlesyndication.com |
2 | go.cm-trk3.com |
1 redirects
grin23.info
|
2 | pagead2.googlesyndication.com |
securepubads.g.doubleclick.net
|
2 | www.google-analytics.com |
www.googletagmanager.com
v.ht |
2 | securepubads.g.doubleclick.net |
www.googletagservices.com
securepubads.g.doubleclick.net |
2 | www.googletagmanager.com |
v.ht
www.18plusstream.net |
1 | fonts.gstatic.com |
www.18plusstream.net
|
1 | fonts.googleapis.com |
www.18plusstream.net
|
1 | www.18plusstream.net |
go.cm-trk3.com
|
1 | onxgoa.datetofcuk.net | 1 redirects |
1 | virsx.com | 1 redirects |
1 | track2.perfectjourney.club | 1 redirects |
1 | grin23.info |
v.ht
|
1 | 1ee65a1802695e11552d92664fdc7c09.safeframe.googlesyndication.com |
securepubads.g.doubleclick.net
|
1 | adservice.google.com |
www.googletagservices.com
|
1 | adservice.google.de |
www.googletagservices.com
|
1 | www.googletagservices.com |
v.ht
|
1 | v.ht | |
32 | 19 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.v.ht Let's Encrypt Authority X3 |
2020-07-01 - 2020-09-29 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1O1 |
2020-07-07 - 2020-09-29 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-07-07 - 2020-09-29 |
3 months | crt.sh |
*.google.de GTS CA 1O1 |
2020-07-07 - 2020-09-29 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-07-07 - 2020-09-29 |
3 months | crt.sh |
tpc.googlesyndication.com GTS CA 1O1 |
2020-07-07 - 2020-09-29 |
3 months | crt.sh |
grin23.info Let's Encrypt Authority X3 |
2020-07-24 - 2020-10-22 |
3 months | crt.sh |
track.cpamatica.com Let's Encrypt Authority X3 |
2020-07-06 - 2020-10-04 |
3 months | crt.sh |
*.18plusstream.net Let's Encrypt Authority X3 |
2020-05-27 - 2020-08-25 |
3 months | crt.sh |
a248.e.akamai.net DigiCert Secure Site ECC CA-1 |
2019-08-13 - 2020-08-12 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-07-07 - 2020-09-29 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-07-07 - 2020-09-29 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.18plusstream.net/c/4c8a669b83e6c2d3?&click_id=tpqmy5f1c9e3d4a9ab566869878&s1=22014&s2=1120016&s3=backuser&s5=&lp=MJ&j1=1&j2=&j3=1&j4=&j5=&j6=
Frame ID: 77E4DA806A1CA17CC2C3BE2D7467DD43
Requests: 31 HTTP requests in this frame
Frame:
https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: E5B02261BBD68B76AC9415A5F84891A7
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://v.ht/X4Oc Page URL
- https://grin23.info/adult Page URL
-
https://track2.perfectjourney.club/click?pid=3078&offer_id=25
HTTP 302
https://virsx.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=5f1c9e3ceb376e0001452c5c&affpid=3078&re... HTTP 302
https://go.cm-trk3.com/aff_c?offer_id=4177&aff_id=29642&url_id=0&source=3078&click_id=ecef12tghgmmy... HTTP 302
https://go.cm-trk3.com/rd.html?go=https%3A%2F%2Fonxgoa.datetofcuk.net%2Fc%2Fda57dc555e50572d%3Fs1%3... Page URL
-
https://onxgoa.datetofcuk.net/c/da57dc555e50572d?s1=22014&s2=1120016&s3=29642&s5=3078&click_id=42_29642_41...
HTTP 302
https://www.18plusstream.net/c/4c8a669b83e6c2d3?&click_id=tpqmy5f1c9e3d4a9ab566869878&s1=22014&s2=1120016... Page URL
Detected technologies
Google Tag Manager (Tag Managers) ExpandDetected patterns
- html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
- html /<!-- (?:End )?Google Tag Manager -->/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://v.ht/X4Oc Page URL
- https://grin23.info/adult Page URL
-
https://track2.perfectjourney.club/click?pid=3078&offer_id=25
HTTP 302
https://virsx.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=5f1c9e3ceb376e0001452c5c&affpid=3078&referrer=https%3A%2F%2Fgrin23.info%2Fadult&sub1=&sub2=&sub3=&sub4=&sub5=&sub6= HTTP 302
https://go.cm-trk3.com/aff_c?offer_id=4177&aff_id=29642&url_id=0&source=3078&click_id=ecef12tghgmmy0261 HTTP 302
https://go.cm-trk3.com/rd.html?go=https%3A%2F%2Fonxgoa.datetofcuk.net%2Fc%2Fda57dc555e50572d%3Fs1%3D22014%26s2%3D1120016%26s3%3D29642%26s5%3D3078%26click_id%3D42_29642_4177_edc099ef83d08bc8f18cd96d066b4109%26j1%3D1%26j3%3D1 Page URL
-
https://onxgoa.datetofcuk.net/c/da57dc555e50572d?s1=22014&s2=1120016&s3=29642&s5=3078&click_id=42_29642_4177_edc099ef83d08bc8f18cd96d066b4109&j1=1&j3=1
HTTP 302
https://www.18plusstream.net/c/4c8a669b83e6c2d3?&click_id=tpqmy5f1c9e3d4a9ab566869878&s1=22014&s2=1120016&s3=backuser&s5=&lp=MJ&j1=1&j2=&j3=1&j4=&j5=&j6= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 16- https://track2.perfectjourney.club/click?pid=3078&offer_id=25 HTTP 302
- https://virsx.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=5f1c9e3ceb376e0001452c5c&affpid=3078&referrer=https%3A%2F%2Fgrin23.info%2Fadult&sub1=&sub2=&sub3=&sub4=&sub5=&sub6= HTTP 302
- https://go.cm-trk3.com/aff_c?offer_id=4177&aff_id=29642&url_id=0&source=3078&click_id=ecef12tghgmmy0261 HTTP 302
- https://go.cm-trk3.com/rd.html?go=https%3A%2F%2Fonxgoa.datetofcuk.net%2Fc%2Fda57dc555e50572d%3Fs1%3D22014%26s2%3D1120016%26s3%3D29642%26s5%3D3078%26click_id%3D42_29642_4177_edc099ef83d08bc8f18cd96d066b4109%26j1%3D1%26j3%3D1
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
X4Oc
v.ht/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gpt.js
www.googletagservices.com/tag/js/ |
48 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
85 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.de/adsid/ |
109 B 168 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.com/adsid/ |
109 B 168 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pubads_impl_2020072001.js
securepubads.g.doubleclick.net/gpt/ |
253 KB 90 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
45 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/r/ |
35 B 98 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
securepubads.g.doubleclick.net/gampad/ |
410 B 711 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
container.html
1ee65a1802695e11552d92664fdc7c09.safeframe.googlesyndication.com/safeframe/1-0-37/html/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
adult
grin23.info/ |
712 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar
pagead2.googlesyndication.com/getconfig/ |
7 KB 6 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar2.js
tpc.googlesyndication.com/sodar/ |
14 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame E5B0 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gen_204
pagead2.googlesyndication.com/pagead/ |
0 55 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rd.html
go.cm-trk3.com/ Redirect Chain
|
329 B 538 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
4c8a669b83e6c2d3
www.18plusstream.net/c/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
cdn-bimi.akamaized.net/landings/194623/1595422478/css/ |
17 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.min.js
cdn-bimi.akamaized.net/landings/194623/1595422478/js/ |
252 KB 75 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
function.js
cdn-bimi.akamaized.net/landings/194623/1595422478/js/ |
768 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
translate.js
cdn-bimi.akamaized.net/landings/194623/1595422478/js/ |
20 KB 9 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
767 B 475 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
61 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
no.png
cdn-bimi.akamaized.net/landings/194623/1595422478/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yes.png
cdn-bimi.akamaized.net/landings/194623/1595422478/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.jpg
cdn-bimi.akamaized.net/landings/194623/1595422478/images/ |
324 KB 324 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pattern.png
cdn-bimi.akamaized.net/landings/194623/1595422478/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.jpg
cdn-bimi.akamaized.net/landings/194623/1595422478/images/ |
489 KB 490 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.jpg
cdn-bimi.akamaized.net/landings/194623/1595422478/images/ |
355 KB 356 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.jpg
cdn-bimi.akamaized.net/landings/194623/1595422478/images/ |
464 KB 465 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| langs object| dataLayer boolean| exit object| google_tag_manager number| th_bridge_jump_step number| chromeVersion3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.18plusstream.net/ | Name: unique_id Value: 5ec4090a951b3410630113 |
|
www.18plusstream.net/ | Name: scriptHash Value: 411736_22014_1120016 |
|
www.18plusstream.net/ | Name: unique_3084660 Value: unique_3084660 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubdomains; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1ee65a1802695e11552d92664fdc7c09.safeframe.googlesyndication.com
adservice.google.com
adservice.google.de
cdn-bimi.akamaized.net
fonts.googleapis.com
fonts.gstatic.com
go.cm-trk3.com
grin23.info
onxgoa.datetofcuk.net
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
track2.perfectjourney.club
v.ht
virsx.com
www.18plusstream.net
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
172.217.16.130
172.255.248.108
2.16.186.80
2606:4700:3035::ac43:abea
2a00:1450:4001:800::2001
2a00:1450:4001:800::200a
2a00:1450:4001:808::200e
2a00:1450:4001:80b::2008
2a00:1450:4001:816::2001
2a00:1450:4001:818::2003
2a00:1450:4001:81b::2002
2a00:1450:4001:821::2002
2a05:d018:244:5200::ab
37.252.14.34
69.61.26.121
95.216.99.227
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0aa575ab7a50d63721a0bdc438eb3b4e627e372256c9e7007ae2523f02d191e3
2fe7cbf09c6957a5c0c5f6a9a52bd1e61b3aead25847c722f868cac98e90ec14
31e539be75870ad6cec377525eb196ea9fbc423ea53d68c03b2c94b96701bc47
322d600431f53fb186989dad7e4ed1365b0d3012a808cd114390855a0dce16a6
5cbc28ef1cf07ab8956014b581aa2b96baac861237975813702e63c886b0c004
66ef250a284f56f2ffe6fb74c4cf8009626266279d9d1d87f046d0eee0d53a42
68a5c42d56a02f91b11bb8b5d87ef511251df9fa80c12ca2ab8f3832c32b54ce
6bfdecff876226c1e233f71e7b0b1a6e0eb238281a52156c39f051691dd88a43
6ccf5413089e0937ea8c62ed1dffb9a48ec14cc9e4729a2e5dbaff6ac81736a0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
954e12847f46ed105bd1d56cff510d55a82cb14024bcbc629734650d8b57288a
9b5daf91bc0b4b1f63ec35edce8c797ee41fa07dd3619b46177f5ae9ef10d5ef
a378ac8e6fb648ac59bf2172859ddb1e9c8ea396f311d78315d98f7e09a9cac4
b4723b5b14abe7a2062b65bf79b4d5d1e575e786a439e61ff95a38e7e9e140e9
b7d9971cd34cc29f6d6df2a7aa97a371e593f6d0209d70f4665411a796618d5b
bc6998d9501b76f353c2984a0a30bac78f7e2a543848796e738b9b82e3396bc0
c4e62e899d387cd5be4770f35d30a90a4a0b7690e5a70fe510d61192a55df2fb
c5e5742593fb85b25251acdb96a2f0d31ee17b2eb8b6b8c737714ea1efc56a11
e2efe220662dd9a54582aa6ab3f6d9fcaf0341710d0b01aa051fc09258ff9e6e
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
fedd7527d1cceee3052bf4bb62e76d56e8200a115d8a2affae23a125578b7ad1