URL: https://monitoring.premia.finance/
Submission Tags: phishingrod
Submission: On September 17 via api from DE — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2606:4700:20::ac43:4a90, located in United States and belongs to CLOUDFLARENET, US. The main domain is monitoring.premia.finance.
TLS certificate: Issued by WE1 on August 31st 2024. Valid for: 3 months.
This is the only time monitoring.premia.finance was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 11 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
11 2
Apex Domain
Subdomains
Transfer
11 premia.finance
monitoring.premia.finance
57 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 670
7 KB
11 2
Domain Requested by
11 monitoring.premia.finance 1 redirects monitoring.premia.finance
static.cloudflareinsights.com
1 static.cloudflareinsights.com monitoring.premia.finance
11 2

This site contains no links.

Subject Issuer Validity Valid
premia.finance
WE1
2024-08-31 -
2024-11-29
3 months crt.sh
cloudflareinsights.com
WE1
2024-09-03 -
2024-12-02
3 months crt.sh

This page contains 2 frames:

Primary Page: https://monitoring.premia.finance/
Frame ID: BB77E8CDAC845B7FD9B8197230151265
Requests: 9 HTTP requests in this frame

Frame: https://monitoring.premia.finance/cdn-cgi/challenge-platform/h/b/scripts/jsd/388c99dd0998/main.js
Frame ID: 625D291D05DE587A7CC945DCA05584F3
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Premia Monitoring

Detected technologies

Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Page Statistics

11
Requests

91 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

64 kB
Transfer

178 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://monitoring.premia.finance/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://monitoring.premia.finance/cdn-cgi/challenge-platform/h/b/scripts/jsd/388c99dd0998/main.js

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
monitoring.premia.finance/
2 KB
1 KB
Document
General
Full URL
https://monitoring.premia.finance/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
634d7d159052c23ceb5d7abe2683c74f82dfe67e1da3454f45b868c71178f90d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
public, max-age=0
cf-cache-status
DYNAMIC
cf-ray
8c476cc60a56d24a-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 17 Sep 2024 07:36:22 GMT
last-modified
Thu, 21 Sep 2023 13:40:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kodmWt%2B2mohHm48FIHinjRO3uVh9kRgzH7%2F0iEHMBD2e1JbvqZeaKWNtpNZCiqeXLkBGPJXMg10suhRh7jgdD%2FMjUFsW6PeKz%2BsjovLt%2FaKnLLn6aO9m8tAArRyXqMn8VhiyP1Ho%2BtvhuMUwvdAQB%2BWzLPfChFw%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
index-1aeb0a9a.js
monitoring.premia.finance/assets/
140 KB
46 KB
Script
General
Full URL
https://monitoring.premia.finance/assets/index-1aeb0a9a.js
Requested by
Host: monitoring.premia.finance
URL: https://monitoring.premia.finance/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
bf4664ae1a2b4c58bd9bf7761cfacd9f57ede999e3995db7d1e4c0bc26133b24

Request headers

Referer
https://monitoring.premia.finance/
Origin
https://monitoring.premia.finance
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 07:36:22 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Thu, 21 Sep 2023 13:40:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"23130-18ab7f8cad0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=emqiP%2BE3JMDsHtuYTvO7uFiOtzfQxYibl2sXPIExPlh2PpZ5ik%2BHKieZ8Eyrh%2BYtmHo5aVW4eBXxifoj5LQULy1LMthebTonc6JwwbdCwMjGMCO6iScUXDjLbdu%2F49OOMGWwKGckOmrlUPC9y6T0s2YRBEPwmA0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=14400
cf-ray
8c476cc68acad24a-FRA
index-f97a1f98.css
monitoring.premia.finance/assets/
6 KB
2 KB
Stylesheet
General
Full URL
https://monitoring.premia.finance/assets/index-f97a1f98.css
Requested by
Host: monitoring.premia.finance
URL: https://monitoring.premia.finance/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
f97a1f98743ba4c6ae70d6efa0e63d658138b1f9cd7fc4129d0e3fea22a866ba

Request headers

Referer
https://monitoring.premia.finance/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 07:36:22 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Thu, 21 Sep 2023 13:40:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"17fb-18ab7f8cad0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0X6vllxeexA4Lfx4sp231TxKC3gtmTMGNhLiU52PrTCEobcMeth31lmldXEv2%2FKDeRLyubrP1EUIvNXorPsZfUelkbRAFzm71Lcj2vd0xJrn5xUwBJhD8KE2FPN063J%2Fo%2FjuxxRO6OVyP7jXsfKEbnNhtNJlbus%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=UTF-8
cache-control
public, max-age=14400
cf-ray
8c476cc68ac9d24a-FRA
vcd15cbe7772f49c399c6a5babf22c1241717689176015
static.cloudflareinsights.com/beacon.min.js/
19 KB
7 KB
Script
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by
Host: monitoring.premia.finance
URL: https://monitoring.premia.finance/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

Referer
https://monitoring.premia.finance/
Origin
https://monitoring.premia.finance
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 07:36:22 GMT
content-encoding
gzip
last-modified
Thu, 06 Jun 2024 15:52:56 GMT
server
cloudflare
etag
W/"2024.6.1"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
8c476cc6b9ac921a-FRA
main.js
monitoring.premia.finance/cdn-cgi/challenge-platform/h/b/scripts/jsd/388c99dd0998/ Frame 625D
Redirect Chain
  • https://monitoring.premia.finance/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://monitoring.premia.finance/cdn-cgi/challenge-platform/h/b/scripts/jsd/388c99dd0998/main.js?
8 KB
4 KB
Script
General
Full URL
https://monitoring.premia.finance/cdn-cgi/challenge-platform/h/b/scripts/jsd/388c99dd0998/main.js?
Protocol
H2
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7aa008dbe86e9a158b587489e742bdafdce76a5a977c094cdc3ba47b0f5bfe4f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 07:36:22 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yu%2F%2FXiYvHNOXbtHiRebO3kqgvOghzg6LmHo0TaD5OJEDXfvaqKEhWYnKK3pN2t7%2BVD4nNKQXVbef%2BPLuqyUCpEl6vgyapJ%2FrKvQDL3%2FWyae1HgTiGLXL9OoEsjU%2FG84EjvrFF%2Bsfi%2BjuG%2BPPREF2NkUTdb1GNv0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray
8c476cc76b83d24a-FRA

Redirect headers

date
Tue, 17 Sep 2024 07:36:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xD7XmCR0F5RHoPUFUhKk5fhaMNQ9sUVHILio6sRsxU1VE0By%2BfbFXlgNhoIp2Z2thtziSvS2Wu1uK4tki%2Bwf1VzYA16lLxJUbhc4I3lks8Qhk6KZADc6zJd4V4UaTUPK4kQ%2BiF5vwyW7Hpqp2tRXGAyggLRH2iE%3D"}],"group":"cf-nel","max_age":604800}
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/388c99dd0998/main.js?
access-control-allow-origin
*
cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray
8c476cc74b68d24a-FRA
content-length
0
me
monitoring.premia.finance/api/auth/
2 B
371 B
Fetch
General
Full URL
https://monitoring.premia.finance/api/auth/me
Requested by
Host: monitoring.premia.finance
URL: https://monitoring.premia.finance/assets/index-1aeb0a9a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://monitoring.premia.finance/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 07:36:23 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hitSyQb92RSx5rUaq2f9bXu0BCx7KPKUaX9leNaNXPiR%2F0ZBnv8fmrI6%2F9vAXf07H%2B21BkfXcao%2FZ0v76mM3JDbjEBKlNxV%2FJ3YIp579iaT7NVlUZ3j%2F4N29YgMACqiLM83mjPzQNfO5xbBOtyowHCtJDgVayZI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
cf-ray
8c476cc75b78d24a-FRA
content-length
2
premia.svg
monitoring.premia.finance/
809 B
874 B
Image
General
Full URL
https://monitoring.premia.finance/premia.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
945abda69fc6fe44a34068a002eabd84f0dbedacdbd77335263f0f0bdb89960d

Request headers

Referer
https://monitoring.premia.finance/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 07:36:23 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Thu, 21 Sep 2023 13:40:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"329-18ab7f8cad0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iBwfuWQqg0xx8EmQrLKLQsyBVpTFlQSY6rqZKytL4l52VA0OStMwE8vSa%2BBD%2FlCP2EeMo3vhbjreB2ZHZNJw%2Byw3fkkrtEQxpWSKfYEuZHwaWhdOMeD4gZ92cUXoi1qF581FzrohRv%2FAV0DB%2FUNtby3vQbn2KAw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
public, max-age=14400
cf-ray
8c476cc75b7ad24a-FRA
google.svg
monitoring.premia.finance/
1 KB
958 B
Image
General
Full URL
https://monitoring.premia.finance/google.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
c3385c31607280600ff6c1380ec4106ab11caed46acc3ea188b3a23a5ffba7af

Request headers

Referer
https://monitoring.premia.finance/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 07:36:23 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Thu, 21 Sep 2023 13:40:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"491-18ab7f8cad0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7ArSTRtE4tD9ia63FiOF2BBlQ2yQag2iyrYLSPJOLA5eK0cIedcFRpEK8MQ6TrxkILkNlIRxx1GDunzrpHxIfhfIPBpDHNH48tDBJVJqpAUp0tn7soYqGGCiqHS%2BgPsLIxGvEERr26M5uYMnMGWzvl06XOCkMgg%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
public, max-age=14400
cf-ray
8c476cc75b7bd24a-FRA
rum
monitoring.premia.finance/cdn-cgi/
0
188 B
XHR
General
Full URL
https://monitoring.premia.finance/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://monitoring.premia.finance/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
content-type
application/json

Response headers

date
Tue, 17 Sep 2024 07:36:22 GMT
x-content-type-options
nosniff
server
cloudflare
vary
Origin
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
https://monitoring.premia.finance
x-frame-options
DENY
access-control-allow-credentials
true
cf-ray
8c476cc75b7cd24a-FRA
premia.svg
monitoring.premia.finance/
809 B
0
Other
General
Full URL
https://monitoring.premia.finance/premia.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
945abda69fc6fe44a34068a002eabd84f0dbedacdbd77335263f0f0bdb89960d

Request headers

Referer
https://monitoring.premia.finance/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 07:36:23 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Thu, 21 Sep 2023 13:40:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"329-18ab7f8cad0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iBwfuWQqg0xx8EmQrLKLQsyBVpTFlQSY6rqZKytL4l52VA0OStMwE8vSa%2BBD%2FlCP2EeMo3vhbjreB2ZHZNJw%2Byw3fkkrtEQxpWSKfYEuZHwaWhdOMeD4gZ92cUXoi1qF581FzrohRv%2FAV0DB%2FUNtby3vQbn2KAw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
public, max-age=14400
cf-ray
8c476cc75b7ad24a-FRA
8c476cc60a56d24a
monitoring.premia.finance/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 625D
0
838 B
XHR
General
Full URL
https://monitoring.premia.finance/cdn-cgi/challenge-platform/h/b/jsd/r/8c476cc60a56d24a
Requested by
Host: monitoring.premia.finance
URL: https://monitoring.premia.finance/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a90 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 17 Sep 2024 07:36:23 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
8c476cc7ebd8d24a-FRA
content-length
0
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IYuzHE81wViO1UQLkUJ1ZeGRpNs46MtRaEo6SKRrlja6ll14SHW1nbqhuNl%2F8bNHk%2BO%2BcvNid5st%2BAuxxPerLllQ4WZLhvKevORH%2FO23nhuhxKalrNuYhHGzzgzLqYD0LQ6a16kNRQrlw6E4t0KNiScb%2BWvMi%2B0%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| __cfBeacon

2 Cookies

Domain/Path Name / Value
monitoring.premia.finance/ Name: connect.sid
Value: s%3AHUgLhTgP-MkQf1YRvS08ujXYGILXig9G.RT5te62SkV2BIS52ReAuPcVMUXwXyfQx6wfoEGk52yE
.premia.finance/ Name: cf_clearance
Value: j7eiwB9Zu1IF_m77d_cDkWACR3fXcLYTOW0X2YJ7bI0-1726558583-1.2.1.1-K7oFIqYOR.qi.Mf5hh_vmDbW3WMIvVZLPMKbqTkVK5rwm8kjqgwwYGGc0wULxQ75dvB8WOpyYJ_sZyvf3Jt5zOZBxbtAf1fD0FprGiblsvWFUFMXEt5ISKQBlCxHZsRcE4_wZ5XJDJcuzSE.KOH.CYP7yUzPqz1cCew9Wks6EJ_PnIBX7H_3.IL__n.8SSY7UImuFm97IkMxFD2kPsxSXpU0Xbu_xx4guqlq0cZHYiUM7ww_Ocml9bVH_ApuE4eYoAV.FjWeSVBo0BXWVW9umk9DPaR3Cywv1l5ta3CQf7bT6ZRLqfLJKdvxtgKOQPRWFJWR37FqcSGQR_gc7rrLfNOARLUQjnnIl_U6jFO2GTiDgdVkkb5Q4dquoZx15PgK