www.crm.krakenbtc.com Open in urlscan Pro
190.115.21.99  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.crm.krakenbtc.com/	22 KB 6 KB	469ms 172ms	Document text/html	190.115.21.99 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Full URL https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.21.99 , Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 5d6f4bd4619e5650ef57ba4c218e486a23ed6624b5482a35b8e38f37d007025e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers :method GET :authority www.crm.krakenbtc.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 server ddos-guard content-security-policy upgrade-insecure-requests; set-cookie __ddg1=LsYWAQ9zSa02fhO63W7n; Domain=.krakenbtc.com; HttpOnly; Path=/; Expires=Thu, 12-Aug-2021 02:38:41 GMT date Wed, 12 Aug 2020 02:38:42 GMT last-modified Mon, 20 Jul 2020 18:40:08 GMT accept-ranges bytes content-type text/html content-encoding br vary Accept-Encoding
GET H2	200	all.css use.fontawesome.com/releases/v5.1.0/css/	45 KB 11 KB	69ms 20ms	Stylesheet text/css	23.111.9.35 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.1.0/css/all.css Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.crm.krakenbtc.com/ Origin https://www.crm.krakenbtc.com Response headers date Wed, 12 Aug 2020 02:38:42 GMT content-encoding gzip last-modified Wed, 20 Jun 2018 20:19:16 GMT server NetDNA-cache/2.2 status 200 etag W/"826c57385f3d35cfed5478ba7b1f5c03" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type text/css access-control-allow-origin * access-control-max-age 3000 cache-control max-age=31556926 x-cache HIT
GET H2	200	style.css www.crm.krakenbtc.com/	1 MB 17 KB	244ms 241ms	Stylesheet text/css	190.115.21.99 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Full URL https://www.crm.krakenbtc.com/style.css Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.21.99 , Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash df552b1816c82f29ef8a2c982f7c1dbd47bb5c054ed7f85ae91adcee5b2eb240 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; content-encoding br last-modified Sun, 12 Jul 2020 21:38:48 GMT server ddos-guard date Wed, 12 Aug 2020 02:38:42 GMT vary Accept-Encoding content-type text/css status 200 accept-ranges bytes
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	21ms 7ms	Script text/javascript	2a00:1450:4001:819::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 06 Aug 2020 21:11:46 GMT content-encoding gzip x-content-type-options nosniff age 451616 status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 06 Aug 2021 21:11:46 GMT
GET H2	200	jquery-ui.js Show response code.jquery.com/ui/1.11.4/	460 KB 112 KB	31ms 8ms	Script application/javascript	2001:4de0:ac19::1:b:3a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/ui/1.11.4/jquery-ui.js Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 0c8e8d7408611519ceda4e759ae9987834a17addc8f0028241ffed7fb0113612 Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 02:38:42 GMT content-encoding gzip last-modified Wed, 11 Mar 2015 13:03:17 GMT server nginx status 200 etag W/"55003d15-72e44" vary Accept-Encoding x-hw 1597199922.dop019.fr8.t,1597199922.cds208.fr8.hn,1597199922.cds125.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 114093
GET H2	200	jquery.cookie.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/	1 KB 1 KB	34ms 11ms	Script application/javascript	2606:4700::6810:84e5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 02:38:42 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT age 16136446 status 200 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 048221cbc10000062921b6a200000001 served-in-seconds 0.001 timing-allow-origin * last-modified Thu, 17 May 2018 09:20:12 GMT server cloudflare etag W/"5afd494c-514" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000; includeSubDomains content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 cf-ray 5c16d2593a050629-FRA expires Mon, 02 Aug 2021 02:38:42 GMT
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 20 KB	282ms 8ms	Stylesheet text/css	2001:4de0:ac19::1:b:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.crm.krakenbtc.com/ Origin https://www.crm.krakenbtc.com Response headers date Wed, 12 Aug 2020 02:38:42 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 12 Dec 2018 18:34:10 GMT status 200 etag "1544639650" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 20563
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	36ms 13ms	Script application/javascript	2606:4700::6810:84e5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.crm.krakenbtc.com/ Origin https://www.crm.krakenbtc.com Response headers date Wed, 12 Aug 2020 02:38:42 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT age 16136446 status 200 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 048221cbc20000d6c5a4a48200000001 served-in-seconds 0.001 timing-allow-origin * last-modified Thu, 17 May 2018 09:25:14 GMT server cloudflare etag W/"5afd4a7a-4af4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000; includeSubDomains content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 cf-ray 5c16d2593babd6c5-FRA expires Mon, 02 Aug 2021 02:38:42 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 13 KB	287ms 13ms	Script text/javascript	2001:4de0:ac19::1:b:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.crm.krakenbtc.com/ Origin https://www.crm.krakenbtc.com Response headers date Wed, 12 Aug 2020 02:38:42 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 12 Dec 2018 18:33:52 GMT status 200 etag "1544639632" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 13105
GET H2	200	logo.png www.crm.krakenbtc.com/img/	15 KB 15 KB	174ms 174ms	Image image/png	190.115.21.99 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Show image Full URL https://www.crm.krakenbtc.com/img/logo.png Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.21.99 , Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash f97ce0b13bfba88e2dd41ae318574b9892d8ea8acf32dd8b711500dc9d805f79 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; last-modified Sun, 12 Jul 2020 21:32:28 GMT server ddos-guard date Wed, 12 Aug 2020 02:38:42 GMT content-type image/png status 200 accept-ranges bytes content-length 15397
GET H2	200	qr.png www.crm.krakenbtc.com/img/	93 KB 94 KB	174ms 173ms	Image image/png	190.115.21.99 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Show image Full URL https://www.crm.krakenbtc.com/img/qr.png Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.21.99 , Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash af85ecda991301506af958c6a5e3ae8780eb292f70e59d9415c0b30c41c3dc06 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; last-modified Sun, 12 Jul 2020 21:41:42 GMT server ddos-guard date Wed, 12 Aug 2020 02:38:42 GMT content-type image/png status 200 accept-ranges bytes content-length 95721
GET H2	200	clipboard.js Show response www.crm.krakenbtc.com/js/	13 KB 4 KB	173ms 171ms	Script application/javascript	190.115.21.99 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Full URL https://www.crm.krakenbtc.com/js/clipboard.js Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.21.99 , Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 8d8c57ab9d01a67977288c3597656e37fa7fe2422f059ca16bb6295943aef864 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; content-encoding br last-modified Thu, 18 Jun 2020 15:31:22 GMT server ddos-guard date Wed, 12 Aug 2020 02:38:42 GMT vary Accept-Encoding content-type application/javascript status 200 accept-ranges bytes
GET		email-decode.min.js tomleebtc.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/	0 0
GET H2	200	jquery-3.3.1.js Show response code.jquery.com/	265 KB 79 KB	8ms 8ms	Script application/javascript	2001:4de0:ac19::1:b:3a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.js Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 02:38:42 GMT content-encoding gzip last-modified Sat, 20 Jan 2018 17:26:44 GMT server nginx status 200 etag W/"5a637bd4-42587" vary Accept-Encoding x-hw 1597199922.dop019.fr8.t,1597199922.cds208.fr8.hn,1597199922.cds165.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 80268
GET H2	200	loader.js Show response www.smartsuppchat.com/	20 KB 7 KB	84ms 23ms	Script application/javascript	195.181.175.55 CDN77
General Check archive.org Show headers Download Go to Full URL https://www.smartsuppchat.com/loader.js? Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.55 Frankfurt am Main, Germany, ASN60068 (CDN77, GB), Reverse DNS frankfurt-53.cdn77.com Software CDN77-Turbo / Resource Hash 8f8623ce264bbed4ea9aee4f415048baa26b45e75018b1e982ec2066da90aa17 Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-77-nzt AcO1rzU9bE3vCgAAAA== date Wed, 12 Aug 2020 02:38:42 GMT content-encoding br last-modified Fri, 07 Aug 2020 14:38:32 GMT server CDN77-Turbo x-edge-pop frankfurtDE etag W/"5f2d6768-50e5" x-cache HIT content-type application/javascript status 200 cache-control max-age=300, public, s-maxage=60 x-edge-ip 195.181.175.53 x-age 10 expires Fri, 07 Aug 2020 14:44:20 GMT
GET H2	200	css fonts.googleapis.com/	8 KB 781 B	16ms 15ms	Stylesheet text/css	2a00:1450:4001:81f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Inter:400,500,600,700&disInter=swap Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash f47d5cb08bf0d82d2af5081e24666562581598081b47bf64e824312916a8f8a7 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 12 Aug 2020 02:38:42 GMT server ESF date Wed, 12 Aug 2020 02:38:42 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 12 Aug 2020 02:38:42 GMT
GET H2	200	bg.jpg www.crm.krakenbtc.com/img/	25 KB 25 KB	176ms 176ms	Image image/jpeg	190.115.21.99 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Show image Full URL https://www.crm.krakenbtc.com/img/bg.jpg Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.21.99 , Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 57c9c7301e2477140739290c2dd46e9165d950c6562267c91b99d1e0affa1ea4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://www.crm.krakenbtc.com/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; last-modified Sun, 12 Jul 2020 21:37:30 GMT server ddos-guard date Wed, 12 Aug 2020 02:38:42 GMT content-type image/jpeg status 200 accept-ranges bytes content-length 25353
GET H2	200	UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2 fonts.gstatic.com/s/inter/v2/	36 KB 36 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:817::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/inter/v2/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2 Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f9bba27460b9836abf81fb74f66ce01b11aeebe183706bbc116ed2fdcb04433d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Inter:400,500,600,700&disInter=swap Origin https://www.crm.krakenbtc.com Response headers date Sat, 08 Aug 2020 03:33:57 GMT x-content-type-options nosniff last-modified Fri, 26 Jun 2020 02:37:45 GMT server sffe age 342285 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36564 x-xss-protection 0 expires Sun, 08 Aug 2021 03:33:57 GMT
GET H2	200	fa-regular-400.woff2 use.fontawesome.com/releases/v5.1.0/webfonts/	15 KB 15 KB	21ms 20ms	Font font/woff2	23.111.9.35 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.1.0/webfonts/fa-regular-400.woff2 Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 1669bec36f12c35a00a2d23cf71b6061c85b8435f5c26445aab338f88dfe6629 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://use.fontawesome.com/releases/v5.1.0/css/all.css Origin https://www.crm.krakenbtc.com Response headers date Wed, 12 Aug 2020 02:38:42 GMT last-modified Wed, 20 Jun 2018 20:19:32 GMT server NetDNA-cache/2.2 status 200 etag "a3715c6fe264a51f1d9260b447ff46bc" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * access-control-max-age 3000 cache-control max-age=31556926 x-cache HIT accept-ranges bytes content-length 14952
GET H2	200	fa-solid-900.woff2 use.fontawesome.com/releases/v5.1.0/webfonts/	58 KB 59 KB	21ms 21ms	Font font/woff2	23.111.9.35 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.1.0/webfonts/fa-solid-900.woff2 Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://use.fontawesome.com/releases/v5.1.0/css/all.css Origin https://www.crm.krakenbtc.com Response headers date Wed, 12 Aug 2020 02:38:42 GMT last-modified Wed, 20 Jun 2018 20:19:36 GMT server NetDNA-cache/2.2 status 200 etag "18d2347ab2a9f40ca2247cdb03303d84" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * access-control-max-age 3000 cache-control max-age=31556926 x-cache HIT accept-ranges bytes content-length 59572
GET H2	200	12e51d9a0b8aa6c47ce3de2e4bd9870d7fa8b89a.json Show response bootstrap.smartsuppchat.com/widget/	824 B 1 KB	69ms 23ms	XHR application/json	52.28.221.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bootstrap.smartsuppchat.com/widget/12e51d9a0b8aa6c47ce3de2e4bd9870d7fa8b89a.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.28.221.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-28-221-109.eu-central-1.compute.amazonaws.com Software / Resource Hash dc956e1417d2b24231cf14f230f168e6f427ef3e9c962951dfc4a50731c623d3 Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers x-version 9e4836d5c2326c1fca49bdaac0d7fb7d1f9cf6af date Wed, 12 Aug 2020 02:38:42 GMT x-hit redis status 200 etag "338-RGbdIRS6QRts4Q7KCE35S1P4jmA" vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, max-age=0, must-revalidate content-length 824
GET H2	200	ready.png www.crm.krakenbtc.com/img/	19 KB 19 KB	173ms 172ms	Image image/png	190.115.21.99 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Show image Full URL https://www.crm.krakenbtc.com/img/ready.png Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.21.99 , Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash 17e334c2acc930caec9424cb87c1d714fc5b059091064413cadb3edb31109019 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://www.crm.krakenbtc.com/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; last-modified Thu, 18 Jun 2020 15:31:14 GMT server ddos-guard date Wed, 12 Aug 2020 02:38:43 GMT content-type image/png status 200 accept-ranges bytes content-length 18990
GET H2	200	trade.png www.crm.krakenbtc.com/img/	5 KB 5 KB	176ms 176ms	Image image/png	190.115.21.99 DDOS-GUARD CORP.
General Check archive.org Show headers Download Go to Show image Full URL https://www.crm.krakenbtc.com/img/trade.png Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.21.99 , Belize, ASN262254 (DDOS-GUARD CORP., BZ), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash b3f1f99c245c84a35df49ca9ab77961beae8d2b943d32227765f3a92fb1e2c46 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Request headers Referer https://www.crm.krakenbtc.com/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests; last-modified Thu, 18 Jun 2020 15:30:58 GMT server ddos-guard date Wed, 12 Aug 2020 02:38:43 GMT content-type image/png status 200 accept-ranges bytes content-length 5488
GET H2	200	asset-manifest.json Show response widget-v2.smartsuppcdn.com/	2 KB 676 B	92ms 24ms	XHR application/json	195.181.175.51 CDN77
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/asset-manifest.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.51 Frankfurt am Main, Germany, ASN60068 (CDN77, GB), Reverse DNS frankfurt-50.cdn77.com Software CDN77-Turbo / Resource Hash 270d94b98a7b905d2d213e22853de0d6fe5b3091ea07861ffe0ab09ea799fc24 Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers x-77-nzt AcO1rzKwiG79OQAAAA== date Wed, 12 Aug 2020 02:38:43 GMT content-encoding br last-modified Thu, 30 Jul 2020 10:20:11 GMT server CDN77-Turbo x-edge-pop frankfurtDE etag W/"5f229edb-69e" status 200 x-cache HIT content-type application/json access-control-allow-origin * cache-control max-age=300, public, s-maxage=60 x-edge-ip 195.181.175.50 x-age 57 expires Thu, 30 Jul 2020 10:29:56 GMT
GET H2	200	runtime-main.71c2d1a1.js Show response widget-v2.smartsuppcdn.com/static/js/ Frame A334	2 KB 1 KB	72ms 23ms	Script application/javascript	195.181.175.51 CDN77
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/static/js/runtime-main.71c2d1a1.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.51 Frankfurt am Main, Germany, ASN60068 (CDN77, GB), Reverse DNS frankfurt-50.cdn77.com Software CDN77-Turbo / Resource Hash 9091db1455a4bb261d6bfac67a3a325df3e4265967457a5cb6aaa9cc3ed9ca1c Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-77-nzt AcO1rzLJr1L9Q7YQAA== date Wed, 12 Aug 2020 02:38:43 GMT content-encoding br last-modified Thu, 30 Jul 2020 10:20:11 GMT server CDN77-Turbo x-edge-pop frankfurtDE etag W/"5f229edb-982" status 200 x-cache HIT content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable x-edge-ip 195.181.175.50 x-age 1095235 expires Fri, 30 Jul 2021 10:24:48 GMT
GET H2	200	3.21f1e778.chunk.js Show response widget-v2.smartsuppcdn.com/static/js/ Frame A334	755 KB 200 KB	116ms 68ms	Script application/javascript	195.181.175.51 CDN77
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/static/js/3.21f1e778.chunk.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.51 Frankfurt am Main, Germany, ASN60068 (CDN77, GB), Reverse DNS frankfurt-50.cdn77.com Software CDN77-Turbo / Resource Hash edca540f5d5cafddd635a986b5272b1e10e5ca7a24f17124521795600f544072 Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-77-nzt AcO1rzKrkY39Q7YQAA== date Wed, 12 Aug 2020 02:38:43 GMT content-encoding br last-modified Thu, 30 Jul 2020 10:20:11 GMT server CDN77-Turbo x-edge-pop frankfurtDE etag W/"5f229edb-bca89" status 200 x-cache HIT content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable x-edge-ip 195.181.175.50 x-age 1095235 expires Fri, 30 Jul 2021 10:24:48 GMT
GET H2	200	main.78cd201b.chunk.js Show response widget-v2.smartsuppcdn.com/static/js/ Frame A334	102 KB 25 KB	137ms 88ms	Script application/javascript	195.181.175.51 CDN77
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/static/js/main.78cd201b.chunk.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.51 Frankfurt am Main, Germany, ASN60068 (CDN77, GB), Reverse DNS frankfurt-50.cdn77.com Software CDN77-Turbo / Resource Hash 12d94c236b90046b41efe2a1fb8713bed04bda56c619f7ffd0694a076ededa47 Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-77-nzt AcO1rzLnDWX9Q7YQAA== date Wed, 12 Aug 2020 02:38:43 GMT content-encoding br last-modified Thu, 30 Jul 2020 10:20:11 GMT server CDN77-Turbo x-edge-pop frankfurtDE etag W/"5f229edb-19978" status 200 x-cache HIT content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable x-edge-ip 195.181.175.50 x-age 1095235 expires Fri, 30 Jul 2021 10:24:48 GMT
GET H2	200	en.json Show response widget-v2.smartsuppcdn.com/translates/ Frame A334	4 KB 2 KB	24ms 24ms	Fetch application/json	195.181.175.51 CDN77
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/translates/en.json?v=2.2.31 Requested by Host: widget-v2.smartsuppcdn.com URL: https://widget-v2.smartsuppcdn.com/static/js/main.78cd201b.chunk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.51 Frankfurt am Main, Germany, ASN60068 (CDN77, GB), Reverse DNS frankfurt-50.cdn77.com Software CDN77-Turbo / Resource Hash 49280b3eae3ec3cfcd21963a24f819d23b69979af4f8f57a589b202a130e20e3 Request headers Referer https://www.crm.krakenbtc.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-77-nzt AcO1rzIE1g39O7YQAA== date Wed, 12 Aug 2020 02:38:43 GMT content-encoding br last-modified Thu, 30 Jul 2020 10:19:01 GMT server CDN77-Turbo x-edge-pop frankfurtDE etag W/"5f229e95-e26" status 200 x-cache HIT content-type application/json access-control-allow-origin * cache-control max-age=31536000, public, immutable x-edge-ip 195.181.175.50 x-age 1095227 expires Fri, 30 Jul 2021 10:24:56 GMT
GET H2	206	blackberry2.mp3 widget-v2.smartsuppcdn.com/assets/sounds/ Frame A334	9 KB 9 KB	25ms 25ms	Media audio/mpeg	195.181.175.51 CDN77
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/assets/sounds/blackberry2.mp3 Requested by Host: www.crm.krakenbtc.com URL: https://www.crm.krakenbtc.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.181.175.51 Frankfurt am Main, Germany, ASN60068 (CDN77, GB), Reverse DNS frankfurt-50.cdn77.com Software CDN77-Turbo / Resource Hash 713a1269cbe341333f360d6767939d33c6dc04754fe9028b34deb6ac59e0fc1a Request headers Referer https://www.crm.krakenbtc.com/ Accept-Encoding identity;q=1, *;q=0 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Range bytes=0- Response headers date Wed, 12 Aug 2020 02:38:43 GMT x-edge-pop frankfurtDE x-cache HIT status 206 x-age 6600954 Content-Length 9135 x-77-nzt AcO1rzJNSe79+rhkAA== Content-Range bytes 0-9134/9135 last-modified Wed, 27 May 2020 14:47:47 GMT server CDN77-Turbo etag "5ece7d93-23af" content-type audio/mpeg access-control-allow-origin * cache-control max-age=31536000, public, immutable x-edge-ip 195.181.175.50 expires Thu, 27 May 2021 17:02:49 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

tomleebtc.com

URL

https://tomleebtc.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _smartsupp function| smartsupp function| $ function| jQuery function| Popper object| bootstrap string| currentX string| currentY number| movementConstant string| WALLET function| randomString number| divCounter function| genDiv function| ClipboardJS object| btns object| clipboard function| setImmediate function| clearImmediate boolean| SMARTSUPP_LOADED object| $smartsupp function| random function| uuidv4 function| bet function| removeArr function| addLink function| sub function| newtr function| insertAfter function| updateTrans object| times function| setProgress number| ctd object| tr string| INT string| OUT string| TXID string| TXID2 string| INCIN string| INOUT

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.krakenbtc.com/	1970-01-19 20:25:35	Name: __ddg1 Value: LsYWAQ9zSa02fhO63W7n

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bootstrap.smartsuppchat.com
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
tomleebtc.com
use.fontawesome.com
widget-v2.smartsuppcdn.com
www.crm.krakenbtc.com
www.smartsuppchat.com
tomleebtc.com
190.115.21.99
195.181.175.51
195.181.175.55
2001:4de0:ac19::1:b:2a
2001:4de0:ac19::1:b:3a
23.111.9.35
2606:4700::6810:84e5
2a00:1450:4001:817::2003
2a00:1450:4001:819::200a
2a00:1450:4001:81f::200a
52.28.221.109
0c8e8d7408611519ceda4e759ae9987834a17addc8f0028241ffed7fb0113612
12d94c236b90046b41efe2a1fb8713bed04bda56c619f7ffd0694a076ededa47
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1669bec36f12c35a00a2d23cf71b6061c85b8435f5c26445aab338f88dfe6629
17e334c2acc930caec9424cb87c1d714fc5b059091064413cadb3edb31109019
270d94b98a7b905d2d213e22853de0d6fe5b3091ea07861ffe0ab09ea799fc24
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
49280b3eae3ec3cfcd21963a24f819d23b69979af4f8f57a589b202a130e20e3
57c9c7301e2477140739290c2dd46e9165d950c6562267c91b99d1e0affa1ea4
5d6f4bd4619e5650ef57ba4c218e486a23ed6624b5482a35b8e38f37d007025e
713a1269cbe341333f360d6767939d33c6dc04754fe9028b34deb6ac59e0fc1a
8d8c57ab9d01a67977288c3597656e37fa7fe2422f059ca16bb6295943aef864
8f8623ce264bbed4ea9aee4f415048baa26b45e75018b1e982ec2066da90aa17
9091db1455a4bb261d6bfac67a3a325df3e4265967457a5cb6aaa9cc3ed9ca1c
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9
af85ecda991301506af958c6a5e3ae8780eb292f70e59d9415c0b30c41c3dc06
b3f1f99c245c84a35df49ca9ab77961beae8d2b943d32227765f3a92fb1e2c46
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
dc956e1417d2b24231cf14f230f168e6f427ef3e9c962951dfc4a50731c623d3
df552b1816c82f29ef8a2c982f7c1dbd47bb5c054ed7f85ae91adcee5b2eb240
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
edca540f5d5cafddd635a986b5272b1e10e5ca7a24f17124521795600f544072
f47d5cb08bf0d82d2af5081e24666562581598081b47bf64e824312916a8f8a7
f97ce0b13bfba88e2dd41ae318574b9892d8ea8acf32dd8b711500dc9d805f79
f9bba27460b9836abf81fb74f66ce01b11aeebe183706bbc116ed2fdcb04433d