URL: https://refund.lt/
Submission: On August 03 via automatic, source certstream-suspicious — Scanned from NL

Summary

This website contacted 7 IPs in 3 countries across 4 domains to perform 22 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is refund.lt.
TLS certificate: Issued by WE1 on August 3rd 2024. Valid for: 3 months.
This is the only time refund.lt was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 15 188.114.97.3 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 192.0.77.37 2635 (AUTOMATTIC)
2 192.0.76.3 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
2 192.0.77.2 2635 (AUTOMATTIC)
22 7
Apex Domain
Subdomains
Transfer
15 refund.lt
refund.lt
217 KB
5 wp.com
c0.wp.com — Cisco Umbrella Rank: 12302
stats.wp.com — Cisco Umbrella Rank: 4519
i0.wp.com — Cisco Umbrella Rank: 5176
pixel.wp.com — Cisco Umbrella Rank: 4225
54 KB
2 gstatic.com
fonts.gstatic.com
82 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110
3 KB
22 4
Domain Requested by
15 refund.lt 1 redirects refund.lt
2 i0.wp.com refund.lt
2 fonts.gstatic.com fonts.googleapis.com
1 pixel.wp.com refund.lt
1 stats.wp.com refund.lt
1 c0.wp.com refund.lt
1 fonts.googleapis.com refund.lt
22 7

This site contains no links.

Subject Issuer Validity Valid
refund.lt
WE1
2024-08-03 -
2024-11-01
3 months crt.sh
upload.video.google.com
WR2
2024-07-30 -
2024-10-22
3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA
2023-11-28 -
2024-12-28
a year crt.sh
*.gstatic.com
WR2
2024-07-30 -
2024-10-22
3 months crt.sh

This page contains 1 frames:

Primary Page: https://refund.lt/
Frame ID: 790527082FA971C5A12CAC871E763A82
Requests: 23 HTTP requests in this frame

Screenshot

Page Title

Pagrindinis - Gauti kompensaciją kai skrydis atšauktas ar atidėtas

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

22
Requests

95 %
HTTPS

33 %
IPv6

4
Domains

7
Subdomains

7
IPs

3
Countries

355 kB
Transfer

1636 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21
  • https://refund.lt/favicon.ico HTTP 302
  • https://refund.lt/wp-includes/images/w-logo-blue-white-bg.png

22 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
refund.lt/
50 KB
12 KB
Document
General
Full URL
https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a245f9d38f865a907cbdf24b3fe6d72845c06df4933bc35ac8d0fa53bbf44ed7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8ad92c9998503644-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 03 Aug 2024 20:49:26 GMT
last-modified
Sat, 03 Aug 2024 11:45:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mQIA40dwlXvOCH6MLUJf1%2FfSRNLUcVnlbFzHwSuUswKGyCQz4n%2F4yBJAY5IGi2U4GBEFRFeezDrBE50q%2B3OswdrN%2BL6doont%2BhWzmpOJMFlwwiOmWUzVcpBGkyA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding,User-Agent
mediaelementplayer-legacy.min.css
refund.lt/wp-content/cache/background-css/refund.lt/wp-content/cache/min/1/c/6.6.1/wp-includes/js/mediaelement/
11 KB
3 KB
Stylesheet
General
Full URL
https://refund.lt/wp-content/cache/background-css/refund.lt/wp-content/cache/min/1/c/6.6.1/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=1721792535&wpr_t=1722696312
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c32d4635ceefc731971bce3492769af66c3e791a66f397e18e9670092c5b9d7f

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sun, 28 Jul 2024 12:45:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qjxXvrN8TUeMSBDBlZEgbuOTrhwV34EWgUThxL8AM2uDp58IzZB%2BRzgIJkOPNgwDKe9T5eGdxb4THA4%2B8pVM6WmNTdJ9Y5I%2F9RpHFDIes2G5ccaklwQ7hjRsQMI%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9a49183644-FRA
alt-svc
h3=":443"; ma=86400
content-length
2681
wp-mediaelement.min.css
refund.lt/wp-content/cache/min/1/c/6.6.1/wp-includes/js/mediaelement/
4 KB
2 KB
Stylesheet
General
Full URL
https://refund.lt/wp-content/cache/min/1/c/6.6.1/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=1721792536
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Wed, 24 Jul 2024 03:42:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5qscSgZQ8yhGHpykiWHmgHKm4WZUusRTOAyolv01CSQQMEIopHwsnSbd5tFavRRy6TuPmwTROVRIqD1opQtWTu98z3ap2L6dhLh3o62aTRxtM7Gffj5sa1lhUI%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9a491b3644-FRA
alt-svc
h3=":443"; ma=86400
content-length
1156
css
fonts.googleapis.com/
57 KB
3 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f322afdaf7184e4ddd7fca589f89cdd7e2e2721dffbf8abed7cb1eca88b0915f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 03 Aug 2024 19:26:17 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 03 Aug 2024 20:49:26 GMT
style-static.min.css
refund.lt/wp-content/cache/background-css/refund.lt/wp-content/cache/min/1/wp-content/themes/Divi/
806 KB
78 KB
Stylesheet
General
Full URL
https://refund.lt/wp-content/cache/background-css/refund.lt/wp-content/cache/min/1/wp-content/themes/Divi/style-static.min.css?ver=1712818216&wpr_t=1722696312
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
814daa2c2a5a24f0b0bc5f5177cfb8677c5fa6b29d9dc6605a8acf5a3af1c898

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sun, 28 Jul 2024 12:45:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ml5%2BEyX8JP38W%2FY5MFDKwzqqmswwyN9iOaiFpLVQsOr6n62FFTK3gKeYOMJajqfuC1gUgQA5kr6m2wGO8F5TUhDtGTTGMNG3LqOzTI0eSVS5Pf%2FUrqQKqT6szcc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
cf-ray
8ad92c9a491c3644-FRA
alt-svc
h3=":443"; ma=86400
jetpack.css
refund.lt/wp-content/cache/background-css/refund.lt/wp-content/cache/min/1/p/jetpack/13.3.1/css/
105 KB
20 KB
Stylesheet
General
Full URL
https://refund.lt/wp-content/cache/background-css/refund.lt/wp-content/cache/min/1/p/jetpack/13.3.1/css/jetpack.css?ver=1712842998&wpr_t=1722696312
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
992133fc8e339d2df29c0a06bc7822aeb99ec97e33b87cfd426d1660db38e17b

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sun, 28 Jul 2024 12:45:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OAwGCjeXs3vffWVWFI6dnmjtf%2FMA7ft6qQOa1dJvRofOu36S6BwlPDsQ%2BPBLW1aGhWcMDOoXXbLHuERK%2FeymSE%2Fwh64%2BkkDFclU2YBuJ6jW76e59MH99jjn0NIA%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9a491d3644-FRA
alt-svc
h3=":443"; ma=86400
content-length
19521
jquery.min.js
c0.wp.com/c/6.6.1/wp-includes/js/jquery/
86 KB
31 KB
Script
General
Full URL
https://c0.wp.com/c/6.6.1/wp-includes/js/jquery/jquery.min.js
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-nc
HIT ams 2
date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
br
strict-transport-security
max-age=15552000
last-modified
Mon, 28 Aug 2023 17:14:23 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3=":443"; ma=86400
expires
Sun, 03 Aug 2025 20:49:26 GMT
jquery-migrate.min.js
refund.lt/wp-content/cache/min/1/c/6.6.1/wp-includes/js/jquery/
13 KB
5 KB
Script
General
Full URL
https://refund.lt/wp-content/cache/min/1/c/6.6.1/wp-includes/js/jquery/jquery-migrate.min.js?ver=1721792536
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7c3b69070e18da88843ce5865aae332f74fae0ada9c0a6004c6615c9813b4d6

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Wed, 24 Jul 2024 03:42:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qYjiiLDlJ4hiSXMdz2ghWLnx1AQxHMU4iZEHaamAZsWD%2BWxervsd7T%2BxhhUoEidLtAx7IsUN3XB10vv0PKqXi261Y6dmQRnpFoGCkqH%2BrF4jx5kpA%2FNTx6Llu%2FQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9b8b133644-FRA
alt-svc
h3=":443"; ma=86400
content-length
4870
et-core-unified-deferred-8.min.css
refund.lt/wp-content/et-cache/8/
2 KB
982 B
Stylesheet
General
Full URL
https://refund.lt/wp-content/et-cache/8/et-core-unified-deferred-8.min.css?ver=1720215659
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5da93918957ee54f7f5cecc15acc4cb97b0b78144195072bc15305afdc389246

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Fri, 05 Jul 2024 21:40:59 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DhJKymSZq7hbJ3R%2FX7uWFULVzxgxkoCmAVs6AiMUcylg3mGr3AWJ66Vz95kp%2FI6WQIDbidzyvDkfYs5hLzNLk3qgWayk%2F%2BBpwXohr%2FjnBZZ8jcCqCL3ukxbSl%2Bo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9a49213644-FRA
alt-svc
h3=":443"; ma=86400
content-length
515
logo.png
refund.lt/wp-content/themes/Divi/images/
2 KB
2 KB
Image
General
Full URL
https://refund.lt/wp-content/themes/Divi/images/logo.png
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf520886e248a0fad2dffd2e44bd9ba546d0d8f5e750f182397be7d16680b20f

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sat, 06 Apr 2024 20:39:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=druUW6QjUaNdZ7ZJwZZULwA%2Fe3jt0RfPED0W99AWxoMZNLBAhOFHOW2OdDTWJdJNihOKeHpGb3KZ%2FGdExsswHxsHAAyYur3LC5oFY5otTOSsoHVkrDyFD52LoUA%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9b9b2a3644-FRA
alt-svc
h3=":443"; ma=86400
content-length
1763
image-cdn.js
refund.lt/wp-content/cache/min/1/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/
700 B
845 B
Script
General
Full URL
https://refund.lt/wp-content/cache/min/1/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/image-cdn.js?ver=1712818216
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
272e8dfb7d01bb5be5b39ad5f6742a0ebcf4cdca9a72390f859d89db3bacbc75

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Thu, 11 Apr 2024 06:50:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sVQHksWuP9g%2FQFAaNa5xaeIf1tl1y9r9yBUKUMMGyQls5NuRxio0qdhXld8xdocFwo657G218jJMRfsL4yi9Cgp1XReDfj4Ta8GqadoI9%2BnguojfyBzBFfVJru8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9b9b2d3644-FRA
alt-svc
h3=":443"; ma=86400
content-length
383
scripts.min.js
refund.lt/wp-content/themes/Divi/js/
268 KB
69 KB
Script
General
Full URL
https://refund.lt/wp-content/themes/Divi/js/scripts.min.js?ver=4.24.2
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ccbe8ceae9d2553c597d0a65f19928d14f42368ddd1118d69a968c2c9912161

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sat, 06 Apr 2024 20:42:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w8l603ZEugX4D0rDbP63FuZ%2FFRi7kyP6lByrfJLZy9pgFpp5X0VFmwJKqeREQ9DFv4e4gcGY3ln4ee%2BLjkgkhY43L0A1nweJoFd2iMO2H6WYm9GGDKiwXJlC4Vo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
max-age=14400
cf-ray
8ad92c9b9b2f3644-FRA
alt-svc
h3=":443"; ma=86400
common.js
refund.lt/wp-content/cache/min/1/wp-content/themes/Divi/core/admin/js/
890 B
894 B
Script
General
Full URL
https://refund.lt/wp-content/cache/min/1/wp-content/themes/Divi/core/admin/js/common.js?ver=1712818216
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72e8f92bc41d9dd380115197e1080d5cded646448be3a51b73ae5b1ee7fbf28b

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Thu, 11 Apr 2024 06:50:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wpMPAPjiawpRnFI2N%2BMUu4hMHuVQChxZWbBAc%2BgPtoFJbFtQbhx17uE1A4HNXaL0omts0tM4tnk85gpSxfTnEfJL8YbR0hnXRkVpMPTDAdqpgxlxS9X%2Bvpk10FA%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9b9b313644-FRA
alt-svc
h3=":443"; ma=86400
content-length
429
e-202431.js
stats.wp.com/
7 KB
3 KB
Script
General
Full URL
https://stats.wp.com/e-202431.js
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-minify-cache
hit
x-nc
HIT ams
date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
br
server
nginx
x-minify
t
etag
W/14421-1717166113627.1218
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
alt-svc
h3=":443"; ma=86400
expires
Sun, 27 Jul 2025 22:28:18 GMT
lazyload.min.js
refund.lt/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/
9 KB
3 KB
Script
General
Full URL
https://refund.lt/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sun, 07 Apr 2024 12:39:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RygI0XoA0pavVoegFZOWGmXCx80bbsWhXM3v%2FabBoWdNQSOC6JVDIWuMbxEzwM4feAUz0LpjUdzeH7VckJxONv2zFtJl6dX5hYav6R3td3zdqLFV%2Fil86gNR8QA%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9b9b343644-FRA
alt-svc
h3=":443"; ma=86400
content-length
3053
truncated
/
68 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
38bed02d21c97f485e7ecaca13845a1cd4c3ee53a302d039a7b30b6754ba8ba6

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
style.min.css
refund.lt/wp-content/cache/min/1/c/6.6.1/wp-includes/css/dist/block-library/
110 KB
15 KB
Stylesheet
General
Full URL
https://refund.lt/wp-content/cache/min/1/c/6.6.1/wp-includes/css/dist/block-library/style.min.css?ver=1721792535
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb80012ab36520713c3f6d81e093c4859b82b2047bb92286f6aed12c0354f18f

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Wed, 24 Jul 2024 03:42:15 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MQG20s1NU0LPlXbBpwot5F4qkCUzj5CvQsYSd7sUxmGT9ZgiB67l0BxTolGcgeNZkyY6Tjfqgn%2FyPG6MEZ78SxJN2CBIkbX%2F9yjEdacxALEzrnGTsD8o1Z836Ac%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92c9b9b373644-FRA
alt-svc
h3=":443"; ma=86400
content-length
14833
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/
47 KB
48 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://refund.lt
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 30 Jul 2024 14:56:39 GMT
x-content-type-options
nosniff
age
366767
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48236
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 30 Jul 2025 14:56:39 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2
fonts.gstatic.com/s/opensans/v40/
35 KB
35 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
adfa45260a1306cb5fefc1f17c1b5e7b61135534a82bf1b8e3d0540af7e07e3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://refund.lt
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Tue, 30 Jul 2024 17:23:05 GMT
x-content-type-options
nosniff
age
357981
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35328
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:00:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 30 Jul 2025 17:23:05 GMT
zinios-ir-patirtis.png
i0.wp.com/refund.lt/wp-content/uploads/2024/04/
12 KB
12 KB
Image
General
Full URL
https://i0.wp.com/refund.lt/wp-content/uploads/2024/04/zinios-ir-patirtis.png?w=680&ssl=1
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
dcf499b70a5323e31edfe8db47f39f6b6663bd28b370e2b82bca64bdba1983fc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
content-length
12064
x-nc
MISS ams 1
last-modified
Sat, 03 Aug 2024 20:49:26 GMT
server
nginx
etag
"86733101c248095b"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://refund.lt/wp-content/uploads/2024/04/zinios-ir-patirtis.png>; rel="canonical"
expires
Tue, 04 Aug 2026 08:49:26 GMT
atsauktas-skrydis-2.png
i0.wp.com/refund.lt/wp-content/uploads/2024/04/
7 KB
8 KB
Image
General
Full URL
https://i0.wp.com/refund.lt/wp-content/uploads/2024/04/atsauktas-skrydis-2.png?w=680&ssl=1
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
d5cb74b43d037b225c6856a92823906b62f0c21bafac3af34d8c2da58ba52f58
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:26 GMT
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
content-length
7334
x-nc
MISS ams 2
last-modified
Sat, 03 Aug 2024 20:49:26 GMT
server
nginx
etag
"83d8dcbd4519a6f7"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://refund.lt/wp-content/uploads/2024/04/atsauktas-skrydis-2.png>; rel="canonical"
expires
Tue, 04 Aug 2026 08:49:26 GMT
g.gif
pixel.wp.com/
50 B
177 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=222312425&post=8&tz=3&srv=refund.lt&j=1%3A13.3.1&host=refund.lt&ref=&fcp=402&rand=0.6199932423420766
Requested by
Host: refund.lt
URL: https://refund.lt/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 03 Aug 2024 20:49:26 GMT
cache-control
no-cache
server
nginx
alt-svc
h3=":443"; ma=86400
content-length
50
content-type
image/gif
w-logo-blue-white-bg.png
refund.lt/wp-includes/images/
Redirect Chain
  • https://refund.lt/favicon.ico
  • https://refund.lt/wp-includes/images/w-logo-blue-white-bg.png
4 KB
4 KB
Other
General
Full URL
https://refund.lt/wp-includes/images/w-logo-blue-white-bg.png
Protocol
H3
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bdb369337ac2496761c6f063bffea0aa6a91d4662279c399071a468251f51f0

Request headers

Referer
https://refund.lt/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 03 Aug 2024 20:49:27 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Sat, 02 Mar 2024 02:03:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=isS%2Fz72fm3TGu%2FN43nnszs%2F5tEcAbmKoCut5FBBycgWldgR3iVU1%2BrFH74R%2BWHeXwc%2F%2FiGrinmardAziqyK2jkheqwSOBm3Z%2Fyvr30nyiIRt54nusXkNm2dKujE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ad92ca009163644-FRA
alt-svc
h3=":443"; ma=86400
content-length
4142

Redirect headers

cf-edge-cache
cache,platform=wordpress
date
Sat, 03 Aug 2024 20:49:27 GMT
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-redirect-by
WordPress
vary
X-Forwarded-Proto,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Dudl%2B1T4CFsTMSWSOL7Pddn8duvJ9WWS3TDcgsmEjfrWeDwOlX8xex1QM4SgTxFx59pBlRVO5%2Fd6evdXkmkITuSnTN4GBuoditg9D6WRWcRVN%2FdKK6ALNAfTbQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
location
https://refund.lt/wp-includes/images/w-logo-blue-white-bg.png
cf-ray
8ad92c9cfd043644-FRA
link
<https://refund.lt/wp-json/>; rel="https://api.w.org/"
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

81 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| et_animation_data object| rocket_lazyload_css_data object| DIVI object| et_builder_utils_params object| et_frontend_scripts object| et_pb_custom object| et_pb_box_shadow_elements object| _stq object| lazyLoadOptions function| jQuery function| LazyLoad function| Waypoint function| et_pb_debounce function| et_pb_smooth_scroll function| et_pb_form_placeholders_init function| et_duplicate_menu function| et_pb_remove_placeholder_text function| et_fix_fullscreen_section function| et_bar_counters_init function| et_fix_pricing_currency_position function| et_pb_set_responsive_grid function| et_pb_set_tabs_height function| et_pb_box_shadow_apply_overlay function| et_pb_init_nav_menu function| et_pb_toggle_nav_menu function| et_pb_apply_sticky_image_effect function| et_pb_menu_inject_inline_centered_logo function| et_pb_menu_inject_item function| et_pb_reposition_menu_module_dropdowns boolean| et_load_event_fired boolean| et_is_fixed_nav function| et_pb_init_woo_star_rating function| et_pb_wrap_woo_attribute_fields_in_span function| et_calculate_fullscreen_section_size function| et_pb_init_modules function| etFixDividerSpacing function| etInitWooReviewsRatingStars function| st_go function| linktracker_init object| wpcom object| images object| iframes object| rocket_lazy function| et_calculate_header_values function| et_change_primary_nav_position function| et_fix_page_container_position function| et_pb_window_side_nav_scroll_init function| et_pb_side_nav_page_init function| et_pb_slider_init function| et_countdown_timer function| et_countdown_timer_labels function| et_pb_tabs_init function| et_pb_circle_counter_update function| et_apply_parallax function| et_parallax_set_height function| et_apply_builder_css_parallax function| et_pb_play_overlayed_video function| et_pb_resize_section_video_bg function| et_pb_center_video function| et_pb_adjust_video_margin function| et_fix_slider_height function| et_pb_submit_newsletter function| et_fix_testimonial_inner_width function| et_pb_video_background_init function| et_animate_element function| et_process_animation_data function| et_has_animation_data function| et_get_animation_classes function| et_remove_animation function| et_remove_animation_data function| et_reinit_waypoint_modules function| et_calc_fullscreen_section function| debounced_et_apply_builder_css_parallax function| et_pb_parallax_init function| et_pb_fullwidth_header_scroll function| et_pb_search_init function| et_pb_search_percentage_custom_margin_fix function| et_pb_comments_init function| et_pb_shop_add_hover_class function| et_pb_init_woo_custom_button_icon string| waypointContextKey

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c0.wp.com
fonts.googleapis.com
fonts.gstatic.com
i0.wp.com
pixel.wp.com
refund.lt
stats.wp.com
188.114.97.3
192.0.76.3
192.0.77.2
192.0.77.37
2a00:1450:4001:830::200a
2a00:1450:4001:831::2003
272e8dfb7d01bb5be5b39ad5f6742a0ebcf4cdca9a72390f859d89db3bacbc75
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
38bed02d21c97f485e7ecaca13845a1cd4c3ee53a302d039a7b30b6754ba8ba6
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855
5da93918957ee54f7f5cecc15acc4cb97b0b78144195072bc15305afdc389246
6bdb369337ac2496761c6f063bffea0aa6a91d4662279c399071a468251f51f0
72e8f92bc41d9dd380115197e1080d5cded646448be3a51b73ae5b1ee7fbf28b
814daa2c2a5a24f0b0bc5f5177cfb8677c5fa6b29d9dc6605a8acf5a3af1c898
992133fc8e339d2df29c0a06bc7822aeb99ec97e33b87cfd426d1660db38e17b
9ccbe8ceae9d2553c597d0a65f19928d14f42368ddd1118d69a968c2c9912161
a245f9d38f865a907cbdf24b3fe6d72845c06df4933bc35ac8d0fa53bbf44ed7
a7c3b69070e18da88843ce5865aae332f74fae0ada9c0a6004c6615c9813b4d6
adfa45260a1306cb5fefc1f17c1b5e7b61135534a82bf1b8e3d0540af7e07e3b
c32d4635ceefc731971bce3492769af66c3e791a66f397e18e9670092c5b9d7f
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cf520886e248a0fad2dffd2e44bd9ba546d0d8f5e750f182397be7d16680b20f
d5cb74b43d037b225c6856a92823906b62f0c21bafac3af34d8c2da58ba52f58
dcf499b70a5323e31edfe8db47f39f6b6663bd28b370e2b82bca64bdba1983fc
eb80012ab36520713c3f6d81e093c4859b82b2047bb92286f6aed12c0354f18f
f322afdaf7184e4ddd7fca589f89cdd7e2e2721dffbf8abed7cb1eca88b0915f
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a