Submitted URL: http://bandura.cloud/accounts/ticket/torsion/pass/
Effective URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Submission: On December 13 via api from JP — Scanned from JP

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 23 HTTP transactions. The main IP is 88.198.207.53, located in Germany and belongs to HETZNER-AS, DE. The main domain is bandura.cloud.
TLS certificate: Issued by R3 on November 6th 2022. Valid for: 3 months.
This is the only time bandura.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Live information

Domain & IP information

IP Address AS Autonomous System
1 3 88.198.207.53 24940 (HETZNER-AS)
8 193.203.121.166 31004 (SBB-CFF-F...)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2600:140b:1a0... 20940 (AKAMAI-ASN1)
2 52.29.203.109 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
23 7
Apex Domain
Subdomains
Transfer
8 swisspass.ch
www.swisspass.ch — Cisco Umbrella Rank: 579638
704 KB
6 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 412
108 KB
3 bandura.cloud
bandura.cloud
18 KB
2 sbb.ch
cdn.app.sbb.ch — Cisco Umbrella Rank: 478410
29 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 678
314 B
1 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 487
41 KB
23 6
Domain Requested by
8 www.swisspass.ch bandura.cloud
www.swisspass.ch
6 cdn.cookielaw.org bandura.cloud
cdn.cookielaw.org
3 bandura.cloud 1 redirects www.swisspass.ch
2 cdn.app.sbb.ch www.swisspass.ch
1 geolocation.onetrust.com cdn.cookielaw.org
1 assets.adobedtm.com bandura.cloud
23 6

This site contains links to these domains. Also see Links.

Domain
www.swisspass.ch
Subject Issuer Validity Valid
bandura.cloud
R3
2022-11-06 -
2023-02-04
3 months crt.sh
www.swisspass.ch
SwissSign RSA TLS OV ICA 2021 - 1
2022-05-04 -
2023-05-04
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2022-05-01 -
2023-05-01
a year crt.sh
assets.adobedtm.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-19 -
2023-08-19
a year crt.sh
*.app.sbb.ch
Amazon
2022-09-15 -
2023-10-14
a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-12-13 -
2023-12-13
a year crt.sh

This page contains 1 frames:

Primary Page: https://bandura.cloud/accounts/ticket/torsion/pass/
Frame ID: 05EE61BD9F620AAA7313F3E9AD566424
Requests: 23 HTTP requests in this frame

Screenshot

Page Title

Login | SwissPass

Page URL History Show full URLs

  1. http://bandura.cloud/accounts/ticket/torsion/pass/ HTTP 301
    https://bandura.cloud/accounts/ticket/torsion/pass/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

23
Requests

87 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

7
IPs

4
Countries

900 kB
Transfer

1365 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://bandura.cloud/accounts/ticket/torsion/pass/ HTTP 301
    https://bandura.cloud/accounts/ticket/torsion/pass/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
bandura.cloud/accounts/ticket/torsion/pass/
Redirect Chain
  • http://bandura.cloud/accounts/ticket/torsion/pass/
  • https://bandura.cloud/accounts/ticket/torsion/pass/
23 KB
7 KB
Document
General
Full URL
https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
88.198.207.53 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.kostiuk.agency
Software
nginx/1.20.2 /
Resource Hash
6e8a2825cc74e35f58f7381900babbca959a5fc525b55df8126a9d25db043606

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
6521
Content-Type
text/html; charset=UTF-8
Date
Tue, 13 Dec 2022 12:03:05 GMT
ETag
"5afb-5e94f4d4af700-gzip"
Last-Modified
Fri, 23 Sep 2022 02:54:52 GMT
Server
nginx/1.20.2
Vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Length
169
Content-Type
text/html
Date
Tue, 13 Dec 2022 12:03:04 GMT
Location
https://bandura.cloud/accounts/ticket/torsion/pass/
Server
nginx/1.20.2
sso.min-20200819.css
www.swisspass.ch//resources/css/normal/app/
180 KB
181 KB
Stylesheet
General
Full URL
https://www.swisspass.ch//resources/css/normal/app/sso.min-20200819.css
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),
Reverse DNS
Software
Apache /
Resource Hash
17b7c94cb891331ef612c7b2b3648f007c1c4f6a2eb420199bb275d91450959b
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 12:03:06 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
184064
X-XSS-Protection
1; mode=block
Referrer-Policy
same-origin
last-modified
Thu, 17 Nov 2022 12:57:11 GMT
Server
Apache
etag
"63762fa7-2cf00"
x-frame-options
sameorigin
Content-Type
text/css
cache-control
private
Feature-Policy
autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
accept-ranges
bytes
Keep-Alive
timeout=10, max=500
modernizr-20200819.js
www.swisspass.ch//resources/js/vendor/head/modernizr/
8 KB
8 KB
Script
General
Full URL
https://www.swisspass.ch//resources/js/vendor/head/modernizr/modernizr-20200819.js
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),
Reverse DNS
Software
Apache /
Resource Hash
4a3d4cf982535aaf485c6e3af9ad1498df5c065adf94eed056f0aa13c31e92ed
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 12:03:06 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
7769
X-XSS-Protection
1; mode=block
Referrer-Policy
same-origin
last-modified
Thu, 17 Nov 2022 12:57:12 GMT
Server
Apache
etag
"63762fa8-1e59"
x-frame-options
sameorigin
Content-Type
application/javascript
cache-control
private
Feature-Policy
autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
accept-ranges
bytes
Keep-Alive
timeout=10, max=500
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
8 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 13 Dec 2022 12:03:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
bKkFjZE43AfZo3jm8gqLew==
age
44585
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
7151
x-ms-lease-status
unlocked
last-modified
Thu, 08 Dec 2022 21:22:16 GMT
server
cloudflare
etag
0x8DAD96247F69588
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
8efa7dae-001e-0030-5f62-0b82cc000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
778e8df82bac8a6e-NRT
launch-6cc731e967aa.min.js
assets.adobedtm.com/15ff638fdec4/7a0c4d63ddff/
139 KB
41 KB
Script
General
Full URL
https://assets.adobedtm.com/15ff638fdec4/7a0c4d63ddff/launch-6cc731e967aa.min.js
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
811e8df757d166dce4bda35c81d2f639eed22055abd034720214c7125b21b737

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Tue, 13 Dec 2022 12:03:07 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2022 13:22:51 GMT
server
AkamaiNetStorage
etag
"189167e53066c0526a1465b03aaa8a84:1657545771.809033"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://bandura.cloud
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
41295
expires
Tue, 13 Dec 2022 13:03:07 GMT
logo_text_de-20200819.svg
www.swisspass.ch//resources/img/
137 KB
137 KB
Image
General
Full URL
https://www.swisspass.ch//resources/img/logo_text_de-20200819.svg
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),
Reverse DNS
Software
Apache /
Resource Hash
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 12:03:07 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
last-modified
Thu, 17 Nov 2022 12:57:11 GMT
Server
Apache
etag
"63762fa7-222c3"
x-frame-options
sameorigin
Content-Type
image/svg+xml
Feature-Policy
autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=10, max=498
Content-Length
139971
X-XSS-Protection
1; mode=block
logo-20200819.svg
www.swisspass.ch//resources/img/
7 KB
8 KB
Image
General
Full URL
https://www.swisspass.ch//resources/img/logo-20200819.svg
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),
Reverse DNS
Software
Apache /
Resource Hash
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 12:03:07 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
last-modified
Thu, 17 Nov 2022 12:57:11 GMT
Server
Apache
etag
"63762fa7-1cce"
x-frame-options
sameorigin
Content-Type
image/svg+xml
Feature-Policy
autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=10, max=497
Content-Length
7374
X-XSS-Protection
1; mode=block
loader-20200819.png
www.swisspass.ch//resources/img/
272 B
942 B
Image
General
Full URL
https://www.swisspass.ch//resources/img/loader-20200819.png
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),
Reverse DNS
Software
Apache /
Resource Hash
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 12:03:07 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
last-modified
Thu, 17 Nov 2022 12:57:11 GMT
Server
Apache
etag
"63762fa7-110"
x-frame-options
sameorigin
Content-Type
image/png
Feature-Policy
autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=10, max=500
Content-Length
272
X-XSS-Protection
1; mode=block
jquery-20200819.js
www.swisspass.ch//resources/primefaces/jquery/
95 KB
96 KB
Script
General
Full URL
https://www.swisspass.ch//resources/primefaces/jquery/jquery-20200819.js
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),
Reverse DNS
Software
Apache /
Resource Hash
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 12:03:06 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
last-modified
Thu, 17 Nov 2022 12:57:12 GMT
Server
Apache
etag
"63762fa8-17c54"
x-frame-options
sameorigin
Content-Type
application/javascript
Feature-Policy
autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=10, max=499
Content-Length
97364
X-XSS-Protection
1; mode=block
vendor.min-20200819.js
www.swisspass.ch//resources/js/vendor/
175 KB
176 KB
Script
General
Full URL
https://www.swisspass.ch//resources/js/vendor/vendor.min-20200819.js
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),
Reverse DNS
Software
Apache /
Resource Hash
be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 12:03:07 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
last-modified
Thu, 17 Nov 2022 12:57:12 GMT
Server
Apache
etag
"63762fa8-2bc0a"
x-frame-options
sameorigin
Content-Type
application/javascript
Feature-Policy
autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=10, max=499
Content-Length
179210
X-XSS-Protection
1; mode=block
swisspass.min-20200819.js
www.swisspass.ch//resources/js/
97 KB
98 KB
Script
General
Full URL
https://www.swisspass.ch//resources/js/swisspass.min-20200819.js
Requested by
Host: bandura.cloud
URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),
Reverse DNS
Software
Apache /
Resource Hash
225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95
Security Headers
Name Value
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 12:03:07 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Referrer-Policy
same-origin
last-modified
Thu, 17 Nov 2022 12:57:12 GMT
Server
Apache
etag
"63762fa8-183fc"
x-frame-options
sameorigin
Content-Type
application/javascript
Feature-Policy
autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=10, max=498
Content-Length
99324
X-XSS-Protection
1; mode=block
SBBWeb-Light.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/
14 KB
14 KB
Font
General
Full URL
https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2
Requested by
Host: www.swisspass.ch
URL: https://www.swisspass.ch//resources/css/normal/app/sso.min-20200819.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.29.203.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-29-203-109.eu-central-1.compute.amazonaws.com
Software
nginx/1.23.2 /
Resource Hash
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf

Request headers

Referer
Origin
https://bandura.cloud
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Tue, 13 Dec 2022 12:03:07 GMT
content-encoding
br
last-modified
Fri, 17 Dec 2021 15:16:26 GMT
server
nginx/1.23.2
etag
W/"61bca9ca-3784"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000, public, private
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
expires
Wed, 13 Dec 2023 12:03:07 GMT
e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json
cdn.cookielaw.org/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/
4 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6d7a8a9faa62fca5c82d46a0529984c00bd18e7c6c35e564fecd795b538a6ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 13 Dec 2022 12:03:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-md5
ff53+VGF/tBRNSHyLiz7Xg==
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1445
x-ms-lease-status
unlocked
last-modified
Thu, 12 May 2022 08:50:28 GMT
server
cloudflare
etag
0x8DA33F476D1F927
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
aaa365af-e01e-00fd-43ea-0ee784000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
cf-ray
778e8e00da8cf59f-NRT
icomoon.woff2
www.swisspass.ch//resources/fonts/icomoon/
0
0

location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
66 B
314 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1a55 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://bandura.cloud/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Tue, 13 Dec 2022 12:03:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
778e8e02abb73547-NRT
access-control-allow-headers
Content-Type
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.28.0/
324 KB
77 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.28.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
204a3299ddc67db6fd1836653ece6696c46f1b2d7fb7abcb4fe9132abe2b6612
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 13 Dec 2022 12:03:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
uLX5MH+Q3LyO9KMWLS7oIw==
age
40037
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
78871
x-ms-lease-status
unlocked
last-modified
Thu, 10 Feb 2022 10:47:32 GMT
server
cloudflare
etag
0x8D9EC82BE23B55F
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
4201404f-901e-00d0-4189-1e6444000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
778e8e02cdf98a6e-NRT
co-branding
bandura.cloud/idp/
45 KB
11 KB
XHR
General
Full URL
https://bandura.cloud/idp/co-branding?resource=co-branding&lang=de&provider=sbbkn
Requested by
Host: www.swisspass.ch
URL: https://www.swisspass.ch//resources/primefaces/jquery/jquery-20200819.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
88.198.207.53 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.kostiuk.agency
Software
nginx/1.20.2 /
Resource Hash
8f599de9e8799cc1e824f93897b7f54593db5ca80e55af7c36d3281d865e7f8f

Request headers

Accept
*/*
Referer
https://bandura.cloud/accounts/ticket/torsion/pass/
X-Requested-With
XMLHttpRequest
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 12:03:07 GMT
Content-Encoding
gzip
Server
nginx/1.20.2
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
keep-alive
Link
<https://bandura.cloud/wp-json/>; rel="https://api.w.org/"
Expires
Wed, 11 Jan 1984 05:00:00 GMT
de-ch.json
cdn.cookielaw.org/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/ba92dbb5-02d7-443f-8481-b67e4427328b/
51 KB
14 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/ba92dbb5-02d7-443f-8481-b67e4427328b/de-ch.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.28.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
febc6f911627d3a8cda6790087fbcf351221485f4ec2895279ca014b03f5ddae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 13 Dec 2022 12:03:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-md5
IFtFcLxlSmQAY+OQFNOEjA==
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
14098
x-ms-lease-status
unlocked
last-modified
Thu, 12 May 2022 08:50:32 GMT
server
cloudflare
etag
0x8DA33F47908F81C
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
759e74a8-a01e-00be-0aea-0ecd6d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
cf-ray
778e8e031c59f59f-NRT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.28.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.28.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.28.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 13 Dec 2022 12:03:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
NLM0iGNpyC/+I80+dPdiSQ==
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2950
x-ms-lease-status
unlocked
last-modified
Thu, 10 Feb 2022 10:47:22 GMT
server
cloudflare
etag
0x8D9EC82B7D61026
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
8e4b9566-001e-00f7-28d2-0efe0d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
778e8e04ddc0f59f-NRT
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.28.0/assets/
20 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.28.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.28.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bandura.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 13 Dec 2022 12:03:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
Ye6OeZcNyuFoWog7CYs00A==
x-ms-lease-status
unlocked
last-modified
Thu, 10 Feb 2022 10:47:44 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
8f9f7698-f01e-002e-23d2-0e5821000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
778e8e04ddc1f59f-NRT
icomoon.ttf
www.swisspass.ch//resources/fonts/icomoon/
0
0

icomoon.woff
www.swisspass.ch//resources/fonts/icomoon/
0
0

SBBWeb-Roman.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/
14 KB
14 KB
Font
General
Full URL
https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Roman.woff2
Requested by
Host: www.swisspass.ch
URL: https://www.swisspass.ch//resources/css/normal/app/sso.min-20200819.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.29.203.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-29-203-109.eu-central-1.compute.amazonaws.com
Software
nginx/1.23.2 /
Resource Hash
966a89b8080879ba41c6b9f15c5efb58182c33a0d2d1e08748beb554b28b4997

Request headers

Referer
Origin
https://bandura.cloud
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Tue, 13 Dec 2022 12:03:08 GMT
content-encoding
br
last-modified
Fri, 17 Dec 2021 15:16:26 GMT
server
nginx/1.23.2
etag
W/"61bca9ca-3748"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000, public, private
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
expires
Wed, 13 Dec 2023 12:03:08 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.swisspass.ch
URL
https://www.swisspass.ch//resources/fonts/icomoon/icomoon.woff2?7m5yri
Domain
www.swisspass.ch
URL
https://www.swisspass.ch//resources/fonts/icomoon/icomoon.ttf?7m5yri
Domain
www.swisspass.ch
URL
https://www.swisspass.ch//resources/fonts/icomoon/icomoon.woff?7m5yri

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange object| digitalDataLayer object| html5 object| Modernizr object| OneTrustStub object| digitalData object| dataLayerEvent function| OptanonWrapper function| validateForm function| closeModal object| _satellite boolean| __satelliteLoaded function| $ function| jQuery object| jQuery112006206179494841579 function| A11yDialog function| iFrameResize function| Cleave string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData function| OevcResourceLoader object| dp object| oevc object| webtrends boolean| isMobile function| validate object| options object| attrs object| allowedProviders object| rememberMe boolean| providerAllowsRememberMe object| Optanon object| OneTrust

2 Cookies

Domain/Path Name / Value
.www.swisspass.ch/ Name: AL_SESS-S
Value: Ac148gegz6sDQsmbLR2L10TbwwAdlb3zQKICMSscgVOsOcJLMAxyT!drvf05k6FXkLZm
bandura.cloud/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Tue+Dec+13+2022+12%3A03%3A07+GMT%2B0000+(GMT)&version=6.28.0&isIABGlobal=false&hosts=&consentId=344a7786-32e3-4a3f-b2ed-12b718a6576a&interactionCount=0&landingPath=https%3A%2F%2Fbandura.cloud%2Faccounts%2Fticket%2Ftorsion%2Fpass%2F&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0

7 Console Messages

Source Level URL
Text
javascript error URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Message:
Access to font at 'https://www.swisspass.ch//resources/fonts/icomoon/icomoon.woff2?7m5yri' from origin 'https://bandura.cloud' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.swisspass.ch//resources/fonts/icomoon/icomoon.woff2?7m5yri
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://bandura.cloud/idp/co-branding?resource=co-branding&lang=de&provider=sbbkn
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
javascript error URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Message:
Access to font at 'https://www.swisspass.ch//resources/fonts/icomoon/icomoon.ttf?7m5yri' from origin 'https://bandura.cloud' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.swisspass.ch//resources/fonts/icomoon/icomoon.ttf?7m5yri
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://bandura.cloud/accounts/ticket/torsion/pass/
Message:
Access to font at 'https://www.swisspass.ch//resources/fonts/icomoon/icomoon.woff?7m5yri' from origin 'https://bandura.cloud' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.swisspass.ch//resources/fonts/icomoon/icomoon.woff?7m5yri
Message:
Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
bandura.cloud
cdn.app.sbb.ch
cdn.cookielaw.org
geolocation.onetrust.com
www.swisspass.ch
www.swisspass.ch
193.203.121.166
2600:140b:1a00:1b0::1e80
2606:4700::6810:9540
2606:4700::6812:1a55
52.29.203.109
88.198.207.53
17b7c94cb891331ef612c7b2b3648f007c1c4f6a2eb420199bb275d91450959b
204a3299ddc67db6fd1836653ece6696c46f1b2d7fb7abcb4fe9132abe2b6612
225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
291ac3898f3f28bd32810a5ef0f380363afee480e535632f0254da751f775c63
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
4a3d4cf982535aaf485c6e3af9ad1498df5c065adf94eed056f0aa13c31e92ed
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6e8a2825cc74e35f58f7381900babbca959a5fc525b55df8126a9d25db043606
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
811e8df757d166dce4bda35c81d2f639eed22055abd034720214c7125b21b737
8f599de9e8799cc1e824f93897b7f54593db5ca80e55af7c36d3281d865e7f8f
966a89b8080879ba41c6b9f15c5efb58182c33a0d2d1e08748beb554b28b4997
b6d7a8a9faa62fca5c82d46a0529984c00bd18e7c6c35e564fecd795b538a6ab
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5
febc6f911627d3a8cda6790087fbcf351221485f4ec2895279ca014b03f5ddae