caisseing.firebaseapp.com Open in urlscan Pro
2620:0:890::100  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response caisseing.firebaseapp.com/	5 KB 2 KB	89ms 27ms	Document text/html	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://caisseing.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ef4917b6357aee20ac1c0483e46028520bd5fa4eaaed0db7a92503cf4e32f48c Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 cache-control max-age=3600 content-encoding br content-length 1743 content-type text/html; charset=utf-8 date Mon, 15 Aug 2022 14:31:06 GMT etag "d6971e6916f0cc6164f77f86179eff03cd2a14bbaf144dcef7bd8882759c0bec-br" last-modified Tue, 09 Aug 2022 09:54:49 GMT strict-transport-security max-age=31556926; includeSubDomains; preload vary x-fh-requested-host, accept-encoding x-cache HIT x-cache-hits 1 x-served-by cache-mxp6960-MXP x-timer S1660573867.650451,VS0,VE1
GET H2	200	css2 fonts.googleapis.com/	4 KB 1 KB	64ms 25ms	Stylesheet text/css	2a00:1450:4001:813::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:wght@400;600;700&display=swap Requested by Host: caisseing.firebaseapp.com URL: https://caisseing.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 15 Aug 2022 14:31:06 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Mon, 15 Aug 2022 14:31:06 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 15 Aug 2022 14:31:06 GMT
GET H2	200	app.css linkywall.com/css/	122 KB 22 KB	835ms 765ms	Stylesheet text/css	2606:4700:3031::6815:15d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://linkywall.com/css/app.css?id=e1a2287b16099079e32b Requested by Host: caisseing.firebaseapp.com URL: https://caisseing.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:15d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 40ce5ba64281c10cd521ab43d99d0c2965e669b9c13ea04b327186da2996bfbf Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:07 GMT content-encoding br x-content-type-options nosniff cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 21 Mar 2022 14:59:27 GMT server cloudflare etag W/"623892cf-1e1e5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JllmRnwa86IwmYN7%2Borvfq6ho8Wv8We%2F%2F4eGm2DM1jUUCemm0ZfzkFAbNNAMdrA7O%2BSAItRwgSnIFan7%2B6Z12xr77SqpLb2zAL7wvn6yICyEpQd%2BmzIdjCL2zM84n0uC3GSjQavQR6WXUjKL"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=86400 cf-ray 73b2a1cb28640f5a-MXP cf-bgj minify
GET H/1.1	200 OK	ing-logo.svg ebanking.ing.be/login/assets/images/svg/	11 KB 7 KB	352ms 54ms	Image image/svg+xml	145.221.42.211 ING-AS Amsterdam
General Check archive.org Show headers Download Go to Show image Full URL https://ebanking.ing.be/login/assets/images/svg/ing-logo.svg Requested by Host: caisseing.firebaseapp.com URL: https://caisseing.firebaseapp.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 145.221.42.211 , Netherlands, ASN15625 (ING-AS Amsterdam, NL), Reverse DNS Software / Resource Hash da4638536ea61163947d415fce63a19e4c7be592fe76908e9dac19eb35e5ea8f Security Headers Name Value Content-Security-Policy default-src 'self'; prefetch-src 'self' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src blob:; frame-ancestors 'self' api.ebanking.ing.be; form-action 'self' api.ebanking.ing.be; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ebanking.ing.be https://*.ing.be https://*.twilio.com wss://*.twilio.com https://jsmon.ingbank.nl https://*.jsmon.ingbank.nl https://cdn.ing.com; style-src 'self' 'unsafe-inline' data:; img-src https: data: https://cdn.ing.com https://*.dealwise.app; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval' api.ebanking.ing.be data: https://cdn.ing.com; frame-src 'self' blob: api.ebanking.ing.be https://cdn.ing.com https://aweucn1-2.advanced-web-analytics.com; media-src data: https://cdn.ing.com https://assets.ing.com; Strict-Transport-Security max-age=31622400; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Date Mon, 15 Aug 2022 14:31:07 GMT Content-Encoding br X-Content-Type-Options nosniff Last-Modified Mon, 01 Aug 2022 15:40:43 GMT ETag "2F2534A63255F689" X-Frame-Options sameorigin Connection keep-alive Content-Type image/svg+xml Cache-Control no-cache Content-Security-Policy default-src 'self'; prefetch-src 'self' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src blob:; frame-ancestors 'self' api.ebanking.ing.be; form-action 'self' api.ebanking.ing.be; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ebanking.ing.be https://*.ing.be https://*.twilio.com wss://*.twilio.com https://jsmon.ingbank.nl https://*.jsmon.ingbank.nl https://cdn.ing.com; style-src 'self' 'unsafe-inline' data:; img-src https: data: https://cdn.ing.com https://*.dealwise.app; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval' api.ebanking.ing.be data: https://cdn.ing.com; frame-src 'self' blob: api.ebanking.ing.be https://cdn.ing.com https://aweucn1-2.advanced-web-analytics.com; media-src data: https://cdn.ing.com https://assets.ing.com; Strict-Transport-Security max-age=31622400; includeSubDomains X-ING-Response-ID 3505272a-0261-4ed0-b9f8-9d841ebb20f1 Vary Accept-Encoding Content-Length 4053 X-XSS-Protection 1; mode=block
GET H2	404	3.PNG www.francescgomez2019cambra.com/web/	0 0	225ms 56ms	Image text/html	217.76.142.90 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://www.francescgomez2019cambra.com/web/3.PNG Requested by Host: caisseing.firebaseapp.com URL: https://caisseing.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 217.76.142.90 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS llgk291.servidoresdns.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers
GET H2	200	api.js Show response hcaptcha.com/1/	281 KB 80 KB	70ms 27ms	Script application/javascript	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hcaptcha.com/1/api.js Requested by Host: caisseing.firebaseapp.com URL: https://caisseing.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e626cb80c06ed2f4560b3b4fef501c83d601fde61cd7cc507d77d47c916f06b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:06 GMT via 1.1 3b5a3bc53642845f1ba1a839609aac0e.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT age 0 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare etag W/"84729783ded6e9166650d2e40d1556b2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control max-age=120 x-amz-cf-pop DUS51-P2 cf-ray 73b2a1cb19e4bba7-FRA x-amz-cf-id V451qEK5n9StuG0auMK_k6VPjW91_Ou7yP1gA5D7XY06csTG8-xyYg==
GET H2	200	rocket-loader.min.js Show response linkywall.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/	12 KB 4 KB	88ms 35ms	Script application/javascript	2606:4700:3031::6815:15d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://linkywall.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Requested by Host: caisseing.firebaseapp.com URL: https://caisseing.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:15d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:06 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 09 Aug 2022 17:04:07 GMT server cloudflare etag W/"62f29387-302c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-frame-options DENY report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OhBAua4eQFI%2BKA1xhvtlzaba4r%2FRYXZpbostf1e8DHhpkHXhz4MTJDdxPLMkr4IzuInXT5VnYP148NrgsitR7gTf26xm%2BtcPWf4SAiz6R1Xf8wySYB58sWZmj4PHB6Ca98EkltAX85HVDi%2BW"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=172800, public nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 73b2a1cb28670f5a-MXP vary Accept-Encoding expires Wed, 17 Aug 2022 14:31:06 GMT
GET H2	200	v652eace1692a40cfa3763df669d7439c1639079717194 Show response static.cloudflareinsights.com/beacon.min.js/	14 KB 5 KB	353ms 304ms	Script text/javascript	2606:4700:440e::6812:2fe6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194 Requested by Host: caisseing.firebaseapp.com URL: https://caisseing.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:440e::6812:2fe6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505 Request headers Referer https://caisseing.firebaseapp.com/ Origin https://caisseing.firebaseapp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:07 GMT content-encoding gzip last-modified Thu, 09 Dec 2021 19:55:17 GMT server cloudflare etag W/2021.12.0 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript;charset=UTF-8 access-control-allow-origin * cache-control public, max-age=86400 cross-origin-resource-policy cross-origin cf-ray 73b2a1cb2ddf0204-ZRH
GET H2	200	hcaptcha.html Show response newassets.hcaptcha.com/captcha/v1/1f7dc62/static/ Frame D7E8	2 KB 885 B	34ms 26ms	Document text/html	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Requested by Host: hcaptcha.com URL: https://hcaptcha.com/1/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f13f4ed673e0842319f91d3ae31f9927ade2ecd5f024a550c8f5d6f43c5e4b21 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://caisseing.firebaseapp.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers age 58954 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=1209600 cf-cache-status HIT cf-ray 73b2a1cb9ad3bba7-FRA content-encoding gzip content-type text/html date Mon, 15 Aug 2022 14:31:06 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding via 1.1 a2cac9c5f0e90f8b7fede4ac9aca75ca.cloudfront.net (CloudFront) x-amz-cf-id Ove3-fQ7oxG9OvIUKDsW-uewXNJVeRPOs63XoW1RV-IKOl-L1p45YA== x-amz-cf-pop FRA56-P4 x-cache Hit from cloudfront x-content-type-options nosniff
GET H2	200	hcaptcha.html Show response newassets.hcaptcha.com/captcha/v1/1f7dc62/static/ Frame 873B	2 KB 1013 B	31ms 24ms	Document text/html	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Requested by Host: hcaptcha.com URL: https://hcaptcha.com/1/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f13f4ed673e0842319f91d3ae31f9927ade2ecd5f024a550c8f5d6f43c5e4b21 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://caisseing.firebaseapp.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers age 58954 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=1209600 cf-cache-status HIT cf-ray 73b2a1cb9ad1bba7-FRA content-encoding gzip content-type text/html date Mon, 15 Aug 2022 14:31:06 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding via 1.1 a2cac9c5f0e90f8b7fede4ac9aca75ca.cloudfront.net (CloudFront) x-amz-cf-id Ove3-fQ7oxG9OvIUKDsW-uewXNJVeRPOs63XoW1RV-IKOl-L1p45YA== x-amz-cf-pop FRA56-P4 x-cache Hit from cloudfront x-content-type-options nosniff
GET H2	200	hcaptcha.js Show response newassets.hcaptcha.com/captcha/v1/1f7dc62/ Frame 873B	281 KB 80 KB	31ms 30ms	Script application/javascript	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/1f7dc62/hcaptcha.js Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e626cb80c06ed2f4560b3b4fef501c83d601fde61cd7cc507d77d47c916f06b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Origin https://newassets.hcaptcha.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:06 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 58964 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 81029 access-control-allow-origin * last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare etag "84729783ded6e9166650d2e40d1556b2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 access-control-allow-methods GET, HEAD content-type application/javascript via 1.1 f97c9082b750957571bc7e3354a4f4a4.cloudfront.net (CloudFront) vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding cache-control max-age=1209600 x-amz-cf-pop DUS51-P2 accept-ranges bytes cf-ray 73b2a1cbeb6ebba7-FRA x-amz-cf-id 8NTfTVxlNxPfrFWnZmhbdqCXWkbGj6D8IhcS4ZxTGwiJCjvmpH9oWw==
GET H2	200	hcaptcha.js Show response newassets.hcaptcha.com/captcha/v1/1f7dc62/ Frame D7E8	281 KB 79 KB	32ms 31ms	Script application/javascript	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/1f7dc62/hcaptcha.js Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e626cb80c06ed2f4560b3b4fef501c83d601fde61cd7cc507d77d47c916f06b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Origin https://newassets.hcaptcha.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:06 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 58964 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 81029 access-control-allow-origin * last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare etag "84729783ded6e9166650d2e40d1556b2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 access-control-allow-methods GET, HEAD content-type application/javascript via 1.1 f97c9082b750957571bc7e3354a4f4a4.cloudfront.net (CloudFront) vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding cache-control max-age=1209600 x-amz-cf-pop DUS51-P2 accept-ranges bytes cf-ray 73b2a1cbeb6fbba7-FRA x-amz-cf-id 8NTfTVxlNxPfrFWnZmhbdqCXWkbGj6D8IhcS4ZxTGwiJCjvmpH9oWw==
GET DATA	200 OK	truncated / Frame 873B	798 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Content-Type image/png
POST H3	200	checksiteconfig Show response hcaptcha.com/ Frame 873B	543 B 923 B	48ms 48ms	XHR application/json	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hcaptcha.com/checksiteconfig?v=1f7dc62&host=caisseing.firebaseapp.com&sitekey=6ba78ccd-f275-4c2d-be45-5e4b46a4a4d8&sc=1&swa=1 Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/1f7dc62/hcaptcha.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e1c4187a87a622b2af3dba631f73bbc921069016b881e2fb6e464bf053b61f8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json Referer https://newassets.hcaptcha.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Content-Type text/plain Response headers date Mon, 15 Aug 2022 14:31:06 GMT content-encoding gzip x-content-type-options nosniff server cloudflare access-control-allow-headers Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path cf-chl-bypass 2 vary Origin, Accept-Encoding access-control-allow-methods GET, HEAD, POST, OPTIONS content-type application/json access-control-allow-origin https://newassets.hcaptcha.com expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 73b2a1cc5b6a694f-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	hsw.js Show response newassets.hcaptcha.com/c/c916818a/ Frame D7E8	956 KB 360 KB	34ms 34ms	Script application/javascript	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/c/c916818a/hsw.js Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/1f7dc62/hcaptcha.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ca9cd4bd0d42f840723d121b85bdda3d463fa28d8a0e58af494873fb9ed33d81 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:06 GMT via 1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT age 62875 x-cache Hit from cloudfront content-encoding gzip alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Fri, 12 Aug 2022 20:57:44 GMT server cloudflare etag W/"f4dfd1066053309cc230d33aa8377b8b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript vary Accept-Encoding cache-control max-age=1209600 x-amz-cf-pop DUS51-P1 cf-ray 73b2a1ccabe9694f-FRA x-amz-cf-id 5LyTpf0ApZPexPdWerwLZYPAPlwnU-cyIXXDUUbFojWPuHYzjFwnTQ==
GET H3	200	e Show response newassets.hcaptcha.com/i/251abe1/ Frame D7E8	108 KB 109 KB	35ms 35ms	Fetch application/octet-stream	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/i/251abe1/e Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/c/c916818a/hsw.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 520a8672bbe6f06d2330b677ad20fa15db6b7df2f9e3e657a25915f36a127401 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:07 GMT via 1.1 c813ed55721b9ee3209e2abab7207a00.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT age 62758 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 110712 last-modified Fri, 22 Jul 2022 19:46:47 GMT server cloudflare etag "8f27b6f2a62cea6fd89de322a941dbdf" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/octet-stream vary Accept-Encoding cache-control max-age=1209600 x-amz-cf-pop FRA56-P4 accept-ranges bytes cf-ray 73b2a1ce3e31694f-FRA x-amz-cf-id g1dxeja_2T8j4nRgs5kzakehpQ7OY27ae6N3VItDxnwQZlyLzkQC2A==
GET H2	200	js Show response www.googletagmanager.com/gtag/	197 KB 71 KB	71ms 32ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-6YGPT4DFSF Requested by Host: linkywall.com URL: https://linkywall.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash cc730ead13a25e076eef9282676b232efd57298607f05dafd2a53c240100a997 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:07 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 72298 x-xss-protection 0 expires Mon, 15 Aug 2022 14:31:07 GMT
GET H3	200	app.js Show response linkywall.com/js/	661 KB 181 KB	1953ms 1920ms	Script application/javascript	2606:4700:3031::6815:15d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://linkywall.com/js/app.js?id=39e95ca56fbafed5d0b6 Requested by Host: linkywall.com URL: https://linkywall.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3031::6815:15d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6f8c3c3daa5fc21b1e272149f65db9454e2446c8b8333b97f98608f794dfef74 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:09 GMT content-encoding br x-content-type-options nosniff cf-cache-status MISS last-modified Mon, 21 Mar 2022 14:59:27 GMT server cloudflare etag W/"623892cf-a537f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2vTmko8%2BlSLcABiG4BDxvOsn4eQ7f55R7r7ZSXyVzSXn2BVhHE%2B%2FaSvj4mPkqI250GKJ5O3Nw6tkCmQnwQLIAAp%2BZBuw9gtIXOGSKkwGepHSyA3sgkBnm78r2%2F%2BpaohM8MGmsRBR%2Bd5%2Bg9C7"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 vary Accept-Encoding cache-control max-age=86400 cf-ray 73b2a1d1297c0f6a-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	chart.js Show response cdn.jsdelivr.net/npm/	195 KB 68 KB	92ms 42ms	Script application/javascript	2606:4700::6810:5614 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/chart.js Requested by Host: linkywall.com URL: https://linkywall.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fbc45926e6b46845a0f905552a0e0b1331049bff1115ecf94dbe0904d895e710 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Mon, 15 Aug 2022 14:31:07 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 35715 x-jsd-version 3.9.1 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by cache-fra19173-FRA, cache-iad-kiad7000132-IAD timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"30b88-Qskf6TlN3nGtrwuPll6B+S+4ovs" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D1OFKnYl9ecwNW1QMlkezVqRMWxaE0CRof0HYk6c39ic2um10mQ%2BIxUpLllHB41A0l%2BoaBJRY5gmcQPYMnkrBG12sa%2F%2FGvnWnge1Cma7RTC22H0bz7DZBLSGipIs7RiCI4Ng9lsHOjIseJNJ82g%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=604800, s-maxage=43200 cf-ray 73b2a1d14bf3cc62-ZRH access-control-expose-headers *
POST H2	204	collect region1.google-analytics.com/g/	0 353 B	63ms 23ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-6YGPT4DFSF&gtm=2oe880&_p=1224837616&cid=1234283410.1660573868&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1660573867&sct=1&seg=0&dl=https%3A%2F%2Fcaisseing.firebaseapp.com%2F&dt=ING%20Home%27Bank&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-6YGPT4DFSF Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://caisseing.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers pragma no-cache date Mon, 15 Aug 2022 14:31:07 GMT server Golfe2 content-type text/plain access-control-allow-origin https://caisseing.firebaseapp.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET DATA	200 OK	truncated /	215 B 0		Image image/jpg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f7f8f7d85735ab4fba7b9f9f63650f2e2d7b8e33801633f48319bdc7a2a46785 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Content-Type image/jpg
POST H3	200	rum Show response caisseing.firebaseapp.com/cdn-cgi/	5 KB 2 KB	94ms 67ms	XHR text/html	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://caisseing.firebaseapp.com/cdn-cgi/rum? Requested by Host: static.cloudflareinsights.com URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194 Protocol H3 Security QUIC, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ef4917b6357aee20ac1c0483e46028520bd5fa4eaaed0db7a92503cf4e32f48c Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers Referer https://caisseing.firebaseapp.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 content-type application/json Response headers strict-transport-security max-age=31556926; includeSubDomains; preload content-encoding br last-modified Tue, 09 Aug 2022 09:54:49 GMT x-timer S1660573870.813800,VS0,VE43 etag "d6971e6916f0cc6164f77f86179eff03cd2a14bbaf144dcef7bd8882759c0bec-br" x-served-by cache-mxp6973-MXP vary x-fh-requested-host, accept-encoding x-cache MISS content-type text/html; charset=utf-8 cache-control max-age=3600 date Mon, 15 Aug 2022 14:31:09 GMT accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 1743 x-cache-hits 0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| Raven object| hcaptcha object| grecaptcha object| __cfQR object| __cfBeacon function| Chart function| gtag object| dataLayer boolean| isProduction boolean| __cfRLUnblockHandlers object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal object| webpackChunk object| regeneratorRuntime function| dayjs object| __framePainter object| FilePond function| FileAttachmentElement function| MarkdownHeaderButtonElement function| MarkdownBoldButtonElement function| MarkdownItalicButtonElement function| MarkdownQuoteButtonElement function| MarkdownCodeButtonElement function| MarkdownLinkButtonElement function| MarkdownImageButtonElement function| MarkdownUnorderedListButtonElement function| MarkdownOrderedListButtonElement function| MarkdownTaskListButtonElement function| MarkdownMentionButtonElement function| MarkdownRefButtonElement function| MarkdownStrikethroughButtonElement function| MarkdownToolbarElement function| IMask object| Alpine function| copy

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.caisseing.firebaseapp.com/	1970-01-20 14:52:13	Name: _ga_6YGPT4DFSF Value: GS1.1.1660573867.1.0.1660573867.0
			.caisseing.firebaseapp.com/	1970-01-20 14:52:13	Name: _ga Value: GA1.1.1234283410.1660573868

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.francescgomez2019cambra.com/web/3.PNG Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

caisseing.firebaseapp.com
cdn.jsdelivr.net
ebanking.ing.be
fonts.googleapis.com
hcaptcha.com
linkywall.com
newassets.hcaptcha.com
region1.google-analytics.com
static.cloudflareinsights.com
www.francescgomez2019cambra.com
www.googletagmanager.com
104.16.168.131
104.16.169.131
145.221.42.211
2001:4860:4802:34::36
217.76.142.90
2606:4700:3031::6815:15d7
2606:4700:440e::6812:2fe6
2606:4700::6810:5614
2620:0:890::100
2a00:1450:4001:813::2008
2a00:1450:4001:813::200a
40ce5ba64281c10cd521ab43d99d0c2965e669b9c13ea04b327186da2996bfbf
4e626cb80c06ed2f4560b3b4fef501c83d601fde61cd7cc507d77d47c916f06b
520a8672bbe6f06d2330b677ad20fa15db6b7df2f9e3e657a25915f36a127401
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
6f8c3c3daa5fc21b1e272149f65db9454e2446c8b8333b97f98608f794dfef74
9e1c4187a87a622b2af3dba631f73bbc921069016b881e2fb6e464bf053b61f8
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
ca9cd4bd0d42f840723d121b85bdda3d463fa28d8a0e58af494873fb9ed33d81
cc730ead13a25e076eef9282676b232efd57298607f05dafd2a53c240100a997
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
da4638536ea61163947d415fce63a19e4c7be592fe76908e9dac19eb35e5ea8f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef4917b6357aee20ac1c0483e46028520bd5fa4eaaed0db7a92503cf4e32f48c
f13f4ed673e0842319f91d3ae31f9927ade2ecd5f024a550c8f5d6f43c5e4b21
f7f8f7d85735ab4fba7b9f9f63650f2e2d7b8e33801633f48319bdc7a2a46785
fbc45926e6b46845a0f905552a0e0b1331049bff1115ecf94dbe0904d895e710
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505