Submitted URL: https://4vh0zayesako.xyz/
Effective URL: https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz
Submission Tags: falconsandbox
Submission: On September 27 via api from US — Scanned from US

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 22 HTTP transactions. The main IP is 172.67.143.160, located in United States and belongs to CLOUDFLARENET, US. The main domain is 3kt1cln2er9.top.
TLS certificate: Issued by WE1 on August 2nd 2024. Valid for: 3 months.
This is the only time 3kt1cln2er9.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 11 172.67.129.191 13335 (CLOUDFLAR...)
2 206.238.197.160 399077 (TERAEXCH)
1 8 172.67.143.160 13335 (CLOUDFLAR...)
2 206.238.197.170 399077 (TERAEXCH)
1 2606:4700:303... 13335 (CLOUDFLAR...)
22 5
Apex Domain
Subdomains
Transfer
11 4vh0zayesako.xyz
4vh0zayesako.xyz
72 KB
8 3kt1cln2er9.top
3kt1cln2er9.top
31 KB
4 gv86knght6r.top
api.gv86knght6r.top
5 KB
1 nuegwgadi2f.top
nuegwgadi2f.top
22 4
Domain Requested by
11 4vh0zayesako.xyz 1 redirects 4vh0zayesako.xyz
8 3kt1cln2er9.top 1 redirects 4vh0zayesako.xyz
3kt1cln2er9.top
4 api.gv86knght6r.top 4vh0zayesako.xyz
3kt1cln2er9.top
1 nuegwgadi2f.top 3kt1cln2er9.top
22 4

This site contains no links.

Subject Issuer Validity Valid
4vh0zayesako.xyz
WE1
2024-09-27 -
2024-12-26
3 months crt.sh
*.gv86knght6r.top
ZeroSSL ECC Domain Secure Site CA
2024-09-09 -
2024-12-08
3 months crt.sh
3kt1cln2er9.top
WE1
2024-08-02 -
2024-10-31
3 months crt.sh
nuegwgadi2f.top
WE1
2024-08-25 -
2024-11-23
3 months crt.sh

This page contains 4 frames:

Primary Page: https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz
Frame ID: 2C8453BA67D0F72EDDB8E1C4581456A8
Requests: 15 HTTP requests in this frame

Frame: https://4vh0zayesako.xyz/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js
Frame ID: 8079BA8EB5A26682C8125E83528363BD
Requests: 2 HTTP requests in this frame

Frame: https://3kt1cln2er9.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js
Frame ID: BFFB71DFB352AA394D6CFF7923F4F7F0
Requests: 2 HTTP requests in this frame

Frame: https://nuegwgadi2f.top/?domain=4vh0zayesako.xyz
Frame ID: 5B03751C0E0D04AC43CF23BE54A76C33
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://4vh0zayesako.xyz/ Page URL
  2. https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:/([\d.]+))?/vue(?:\.min)?\.js

Page Statistics

22
Requests

91 %
HTTPS

20 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

107 kB
Transfer

245 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://4vh0zayesako.xyz/ Page URL
  2. https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://4vh0zayesako.xyz/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://4vh0zayesako.xyz/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js
Request Chain 17
  • https://3kt1cln2er9.top/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://3kt1cln2er9.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js

22 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
4vh0zayesako.xyz/
2 KB
1 KB
Document
General
Full URL
https://4vh0zayesako.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d3160e0ba384b34ba2f633d979e540581b8545b7feb9d0e7b0153f42591c327

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-cache-status
DYNAMIC
cf-ray
8c99a577e8572b5a-LAX
content-encoding
br
content-type
text/html
date
Fri, 27 Sep 2024 07:05:37 GMT
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZClb6%2Fb9NVclWwmZNJTiXWDonVuzbCs8au4irx4gxdK6Y%2BOjTC8n0818in7pj1rdt3BNygYVJ%2FA%2B1SwkoWNhEEZavJoMUQr29fqar1ftEpndTo4I9R3xYe6fqmIcqBoRZ0gx"}],"group":"cf-nel","max_age":604800}
server
cloudflare
speculation-rules
"/cdn-cgi/speculation"
speculation
4vh0zayesako.xyz/cdn-cgi/
128 B
541 B
Other
General
Full URL
https://4vh0zayesako.xyz/cdn-cgi/speculation
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://4vh0zayesako.xyz
Referer
https://4vh0zayesako.xyz/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=isWtjoe%2BnGUsj3BA29078fQ3j3xm3mWJ7ZkXi1ubY12HibBX5tNwC2AB38kW8jqbjP4Rf%2BnAnzZKBUQghdV7XYE55yjkZp%2Bi%2BBXcBgZ%2FlVCLKBcsszyrP4EBk9Yh4UxWTutf"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a57a7b302b5a-LAX
access-control-allow-origin
https://4vh0zayesako.xyz
content-length
128
date
Fri, 27 Sep 2024 07:05:37 GMT
content-type
application/speculationrules+json
vary
Origin, Accept-Encoding
server
cloudflare
common.js
4vh0zayesako.xyz/static/js/
4 KB
2 KB
Script
General
Full URL
https://4vh0zayesako.xyz/static/js/common.js?t=202409091529
Requested by
Host: 4vh0zayesako.xyz
URL: https://4vh0zayesako.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e64c2562dd0311a74557526152b57a8f5a7c46fc5655e8a7edebdeecc58a42b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://4vh0zayesako.xyz/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
MISS
etag
W/"66dfc8a8-f3c"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ASHO3LKqLrAWtkIy%2BuJ%2BPpSVYErvjIV6h0WfV%2F7qX5mni2wTAgjzMIi3G%2BpGVc6XsAzpBbmTSwhNlqhFUsMssn7%2B5fIQmNBJ1MltT5bgqk0FQ3dFeh7NH%2BIC5FDkX5D5jbhw"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a57a7b322b5a-LAX
date
Fri, 27 Sep 2024 07:05:38 GMT
content-type
application/javascript
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
vary
Accept-Encoding
server
cloudflare
vue.min.js
4vh0zayesako.xyz/static/cdn/js/
92 KB
35 KB
Script
General
Full URL
https://4vh0zayesako.xyz/static/cdn/js/vue.min.js
Requested by
Host: 4vh0zayesako.xyz
URL: https://4vh0zayesako.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9174c425c445377df4562ad9165ea08fdf9433a808296d7de5f619791df10e17

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://4vh0zayesako.xyz/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
MISS
etag
W/"66dfc8a8-16fc7"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XklwZMwrpM0WJEa65Hxo309VjM9rJDayLUZGzRycEVzC2lYpelCGmROmA8ZU2Rz5jCUyk8hzZRv7qcIn62Veo1AO6vAVvANAdWXbGHv5PBRobgj3ePceqWMuj1nwctDZSB0m"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a57a7b352b5a-LAX
date
Fri, 27 Sep 2024 07:05:38 GMT
content-type
application/javascript
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
vary
Accept-Encoding
server
cloudflare
axios.min.js
4vh0zayesako.xyz/static/cdn/js/
17 KB
6 KB
Script
General
Full URL
https://4vh0zayesako.xyz/static/cdn/js/axios.min.js
Requested by
Host: 4vh0zayesako.xyz
URL: https://4vh0zayesako.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d389f625c1d774224d32527657e7398e57a65c718a07748f0ad7faecce8de3e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://4vh0zayesako.xyz/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
MISS
etag
W/"66dfc8a8-45b3"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zeelhl7w3NweUp7AfQKBnbuzmnn%2BPky%2FrD9ZGHU0KSipOgPZRUzNoBJk1LFPxI15cO0K6EeNGlJdrPsezmWm1ZoN46zQf9nDAU4E%2FLtJCktwJ8jKg%2Fv9IJJkD8kKsi2GEqR6"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a57a7b392b5a-LAX
date
Fri, 27 Sep 2024 07:05:38 GMT
content-type
application/javascript
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
vary
Accept-Encoding
server
cloudflare
crypto-js.min.js
4vh0zayesako.xyz/static/cdn/js/
46 KB
17 KB
Script
General
Full URL
https://4vh0zayesako.xyz/static/cdn/js/crypto-js.min.js
Requested by
Host: 4vh0zayesako.xyz
URL: https://4vh0zayesako.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
817c88066f7a344d4471bb20d30652e641f498eedd9c28e5a6ed661c67795010

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://4vh0zayesako.xyz/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
MISS
etag
W/"66dfc8a8-b9d8"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N3jPvnWGz9IQzQK%2BcLJqcu5D8LH3YNo03QtAGAIaD6f4wXQip75L34TiPLzjad2Mqc%2B56Dql7cEE%2BbI9W9QDiNFM5rYtGcdbONczPH1L06%2F6leEWMIFjeenym43mpdtqsJqn"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a57a7b3c2b5a-LAX
date
Fri, 27 Sep 2024 07:05:38 GMT
content-type
application/javascript
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
vary
Accept-Encoding
server
cloudflare
collect_301.js
4vh0zayesako.xyz/static/js/
2 KB
1 KB
Script
General
Full URL
https://4vh0zayesako.xyz/static/js/collect_301.js?t=202409101529
Requested by
Host: 4vh0zayesako.xyz
URL: https://4vh0zayesako.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d32927eac4b56c3ae55bf6091b3a69614bf1aeede076e04880e751b08259a4d3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://4vh0zayesako.xyz/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
MISS
etag
W/"66dfc8a8-89c"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VsK1rAKK3rPxXbHxyt1MMqVS%2BjAvy1D0BLb9vaSiOCijiceUGbc4XDGimKZgwi%2FhnTfn8VUWBOOANv6tPjRGv44412Rev9VpeXBRzD3MWitWxR9RYEU0Z4MbRUiem7peO4tV"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a57a7b3d2b5a-LAX
date
Fri, 27 Sep 2024 07:05:38 GMT
content-type
application/javascript
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
vary
Accept-Encoding
server
cloudflare
request
api.gv86knght6r.top/fast-endecode/main/ Frame
0
0
Preflight
General
Full URL
https://api.gv86knght6r.top/fast-endecode/main/request
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
206.238.197.160 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://4vh0zayesako.xyz
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers
content-type DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Access-Control-Allow-Methods
POST GET, POST, OPTIONS
Access-Control-Allow-Origin
*
CF-Cache-Status
DYNAMIC
CF-RAY
8c99a584b8e704c7-HKG
Connection
keep-alive
Date
Fri, 27 Sep 2024 07:05:39 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bH9%2BsuhMQ2A6DYNIDRDf4eODFM4CuMW4EnOpZfMDHPWVOHw5HplO%2ByFQ2OPz6uZfYaGlMWNDZimuGHQnv5E6Wdj8j2HK0RngMyNw28dqZb0qfLX0oHy9qza0IFdxoXlvBJnLPFM%3D"}],"group":"cf-nel","max_age":604800}
Server
nginx/1.17.6
Transfer-Encoding
chunked
Vary
Origin
X-Application-Context
fast-cloud-zull:prod:8801
request
api.gv86knght6r.top/fast-endecode/main/
2 KB
2 KB
XHR
General
Full URL
https://api.gv86knght6r.top/fast-endecode/main/request
Requested by
Host: 4vh0zayesako.xyz
URL: https://4vh0zayesako.xyz/static/cdn/js/axios.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
206.238.197.160 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Referer
https://4vh0zayesako.xyz/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Content-Type
application/json

Response headers

Transfer-Encoding
chunked
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Connection
keep-alive
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wLp4LRg89%2Bwp6Fhpc3jNUL0Jnp2r1ulM1%2FOkgrkAb56zpZveRfywR4CIh%2FWU4Zse9%2BxIXYmzkcOCPCg%2BwVbIJi2O8AI44WQHia1SNKuTHYVNhhmIQYJCNlgCh5991CT8XC7k%2BUc%3D"}],"group":"cf-nel","max_age":604800}
Access-Control-Allow-Methods
GET, POST, OPTIONS
CF-RAY
8c99a5863f120974-HKG
Access-Control-Allow-Origin
*
X-Application-Context
fast-cloud-zull:prod:8800
Date
Fri, 27 Sep 2024 07:05:39 GMT
Content-Type
application/json;charset=UTF-8
Vary
Origin
Server
nginx/1.17.6
Access-Control-Allow-Headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
main.js
4vh0zayesako.xyz/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/ Frame 8079
Redirect Chain
  • https://4vh0zayesako.xyz/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://4vh0zayesako.xyz/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
8 KB
4 KB
Script
General
Full URL
https://4vh0zayesako.xyz/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
Protocol
H3
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbb521eed54572faf1021b7371b257f1aae9257af0bb382cf5096dd4c7d7a130
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7yf82F5QmhXpYvXj9A4PLChUnvBUgAgXhGbhtx5FadstDABMLHwrYZaiEWp4%2BeZoCWzziJPXAAmxqTaktg2Ab%2FgJfoKEPng%2B92VvKQrRcEyYDV8UDUWjCP1wr3f5G5gVt9oZ"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8c99a5816b5a2b5a-LAX
date
Fri, 27 Sep 2024 07:05:38 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wYsb%2F%2FuhxL9DkMujsV5dTHIjHo4CsIjePqZY2kbFGEoSzNQyQilwJ7a49BplceXYmRy%2FjFPZmTviB8bbC7VoL3MymDLBXobBW2xUS93EhrQp5hG8wgqt1Pj4hhkW%2FH%2BH4NeG"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a580fabc2b5a-LAX
access-control-allow-origin
*
content-length
0
date
Fri, 27 Sep 2024 07:05:38 GMT
vary
Accept-Encoding
server
cloudflare
favicon.ico
4vh0zayesako.xyz/
4 KB
4 KB
Other
General
Full URL
https://4vh0zayesako.xyz/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e1fe9bb70d664878f4704611ec4f086aeb4725e0a6d9c1555b9a0e1413a9989

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://4vh0zayesako.xyz/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
REVALIDATED
etag
W/"66dfc8a8-eb0"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kHoypr%2BHdSbPqFyn53keISSO2%2B8QkRygY1lqqunxt8ToOBRc9i4nIu9WaGYp06laV2Te2FOylKT1vtI4T8T4Hmb9ENSMi9RWepngs3oMXm4C2n%2FXgozKfoCS2xiXXuZ7rWAi"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a580fac12b5a-LAX
date
Fri, 27 Sep 2024 07:05:39 GMT
content-type
image/x-icon
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
vary
Accept-Encoding
server
cloudflare
8c99a577e8572b5a
4vh0zayesako.xyz/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 8079
0
899 B
XHR
General
Full URL
https://4vh0zayesako.xyz/cdn-cgi/challenge-platform/h/g/jsd/r/8c99a577e8572b5a
Requested by
Host: 4vh0zayesako.xyz
URL: https://4vh0zayesako.xyz/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.129.191 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

cf-ray
8c99a5826cfe2b5a-LAX
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length
0
date
Fri, 27 Sep 2024 07:05:38 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0PC0jCNpNsISH9cU9qin7hsM1uo4KAJE4tIRuNaTKdiOu7pCXy49SEvs5TXGfKpNg7ptkFFJaomnCH251PIMQxVnIVQ10CIG66UHgiW2Sb5HLSen0LBd1QAYKejVnyBW%2FWdZ"}],"group":"cf-nel","max_age":604800}
Primary Request /
3kt1cln2er9.top/
2 KB
1 KB
Document
General
Full URL
https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz
Requested by
Host: 4vh0zayesako.xyz
URL: https://4vh0zayesako.xyz/static/js/collect_301.js?t=202409101529
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.143.160 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2b40385e2ff9079875db6058d771f7d454c00f6987e75c7af82ddcf73566653

Request headers

Referer
https://4vh0zayesako.xyz/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-cache-status
DYNAMIC
cf-ray
8c99a588bea62f1d-LAX
content-encoding
br
content-type
text/html
date
Fri, 27 Sep 2024 07:05:40 GMT
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=phAwEJqQvxiagSPvtxqBjMG38y02LAWsWKIKxNC9lZ4y5gSWaXQYbhWqskdj6phQJDKdZbDWe%2FaVJNVEFaM2qGHj8WYtSQh%2Fd1%2FaXZjIRCBrlcX7QtvFiDNZMChUx%2Bkp0SI%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
speculation-rules
"/cdn-cgi/speculation"
speculation
3kt1cln2er9.top/cdn-cgi/
128 B
533 B
Other
General
Full URL
https://3kt1cln2er9.top/cdn-cgi/speculation
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.143.160 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://3kt1cln2er9.top
Referer
https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xLjv5YyOH7t7CdagFJsncIH3lBqwck5XYmj%2B8Z0QT1Pj0QpYT24FotICoh856gQ4AeWRtbCG7aA6tmbz0fz7qymYl2LiVooRIsZazVejaKo2jqpSVrYuswwG95DrzbicrYA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a58b6a1d2f1d-LAX
access-control-allow-origin
https://3kt1cln2er9.top
content-length
128
date
Fri, 27 Sep 2024 07:05:40 GMT
content-type
application/speculationrules+json
vary
Origin, Accept-Encoding
server
cloudflare
crypto-js.min.js
3kt1cln2er9.top/static/cdn/js/
46 KB
17 KB
Script
General
Full URL
https://3kt1cln2er9.top/static/cdn/js/crypto-js.min.js
Requested by
Host: 3kt1cln2er9.top
URL: https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.143.160 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
817c88066f7a344d4471bb20d30652e641f498eedd9c28e5a6ed661c67795010

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
HIT
etag
W/"66dfc8a8-b9d8"
age
6551
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8ITb6YVsSZ1A8OnIYJnHINLDHqTuzBvKZdX4leLraDWd0NqIWVobhIeFRS2hFiLIvZ9C0%2FWeE3OoMhyNDNA0%2B%2BSKMlQuCqezyj2cXZaU%2BMyPKhBVlaq8PEvEuV3AzzzUMpU%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a58b6a222f1d-LAX
alt-svc
h3=":443"; ma=86400
date
Fri, 27 Sep 2024 07:05:40 GMT
content-type
application/javascript
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
vary
Accept-Encoding
server
cloudflare
iframe.js
3kt1cln2er9.top/static/js/
6 KB
3 KB
Script
General
Full URL
https://3kt1cln2er9.top/static/js/iframe.js?t=202409101529
Requested by
Host: 3kt1cln2er9.top
URL: https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.143.160 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c03ea32aee9865eba7291d6340518e820a5b1f11b2208e4c1b4a168c179ee9a9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-bgj
minify
etag
W/"66dfc8a8-1793"
age
6551
cf-cache-status
HIT
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TStxhq%2FaYofpRg3o9RoMP7Gxifrl0TBqBTze08AKE%2FqPdnnUmosJmXNUxAd1GD%2FiSFXjaL2FtFrSt9eO5Ly4jbqscP2Unvrtzjn3lv%2F5WqJAL%2BJSnSFGkmKL0cHlN9tR80A%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a58b6a242f1d-LAX
date
Fri, 27 Sep 2024 07:05:40 GMT
content-type
application/javascript
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
vary
Accept-Encoding
server
cloudflare
request
api.gv86knght6r.top/fast-endecode/main/ Frame
0
0
Preflight
General
Full URL
https://api.gv86knght6r.top/fast-endecode/main/request
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
206.238.197.170 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://3kt1cln2er9.top
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers
content-type DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Access-Control-Allow-Methods
POST GET, POST, OPTIONS
Access-Control-Allow-Origin
*
CF-Cache-Status
DYNAMIC
CF-RAY
8c99a58fa84b85fb-HKG
Connection
keep-alive
Date
Fri, 27 Sep 2024 07:05:41 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a4M0ofex7A%2Fvyp37jxu2HYACJvzo8DT6ZOnanKRXAZvLV3C3ISOERfH2BmqCJb%2F2FwUDj%2BFkZbCAgsoXD0wbXWWhhFqhqdJVq4qE%2BXkYU12hHc780Ur5hnLUXz4YyOoMpXkSjXo%3D"}],"group":"cf-nel","max_age":604800}
Server
nginx/1.17.6
Transfer-Encoding
chunked
Vary
Origin
X-Application-Context
fast-cloud-zull:prod:8800
request
api.gv86knght6r.top/fast-endecode/main/
2 KB
2 KB
Fetch
General
Full URL
https://api.gv86knght6r.top/fast-endecode/main/request
Requested by
Host: 3kt1cln2er9.top
URL: https://3kt1cln2er9.top/static/js/iframe.js?t=202409101529
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
206.238.197.170 Singapore, Singapore, ASN399077 (TERAEXCH, US),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
edceb53fe1421f18b4955d8c5698674b62481ee63c15540a507c2ade6e86dabf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://3kt1cln2er9.top/

Response headers

Transfer-Encoding
chunked
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Connection
keep-alive
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U5UVi7UlgJ1n66a33UZqz1CpfgAa0wCipi7zlsYIW5JvnADDhuHGf6jKWQN78yZ%2F3rvpS%2BpjZVq0KdIb4xNIqcEBrK1cKfnxWWTICfU52FbVFCSjajkyz5%2BVGcUgEIGxFO%2FSxTI%3D"}],"group":"cf-nel","max_age":604800}
Access-Control-Allow-Methods
GET, POST, OPTIONS
CF-RAY
8c99a5911c679b48-HKG
Access-Control-Allow-Origin
*
X-Application-Context
fast-cloud-zull:prod:8801
Date
Fri, 27 Sep 2024 07:05:41 GMT
Content-Type
application/json;charset=UTF-8
Vary
Origin
Server
nginx/1.17.6
Access-Control-Allow-Headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
main.js
3kt1cln2er9.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/ Frame BFFB
Redirect Chain
  • https://3kt1cln2er9.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://3kt1cln2er9.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
8 KB
4 KB
Script
General
Full URL
https://3kt1cln2er9.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
Protocol
H3
Server
172.67.143.160 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
814af9933ffa69e507e389b408c271b1a59780fbb795565c11167d20d6ac33d4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0AFXvgXFXSu8VtU6N72FYQtXRQPWD7uKeSjH9cCdA5frHKDa87wA1O5tJRtog%2FH9FpHc4AKUboDchpTc3VGJZ0v6GmPTdV%2FRnaK5oYxtFGxXPmm6cDL%2BmJ%2FAy6OYMXbIhG8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8c99a58cebfb2f1d-LAX
date
Fri, 27 Sep 2024 07:05:40 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y1fFJ69c7TV%2Fgo0LSznlr39Ab2jqMrM8XQbSm24U0A6bOHkdSubHplWHza8A3CqjQydWmSmdAFqxwv7udp3fk5jwC5x17%2B8kwvURLQm5gqBt73vLJmGvFMgE6r%2BxJvDXskU%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a58c7b752f1d-LAX
access-control-allow-origin
*
content-length
0
date
Fri, 27 Sep 2024 07:05:40 GMT
vary
Accept-Encoding
server
cloudflare
favicon.ico
3kt1cln2er9.top/
4 KB
4 KB
Other
General
Full URL
https://3kt1cln2er9.top/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.143.160 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e1fe9bb70d664878f4704611ec4f086aeb4725e0a6d9c1555b9a0e1413a9989

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://3kt1cln2er9.top/?domain=4vh0zayesako.xyz

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
HIT
etag
W/"66dfc8a8-eb0"
age
4750
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=leRbDy90dyHIngE%2Bhc4ZniI60GIUzTjnmRjUHpVU%2FrItvJ5aEu8MMGE6wqkhHLVBK24Q0QRCDuRTjA3YUpN9E0hsa6obNWTUs7jidE1xrgY2Neb0%2F%2BsafR2zUQOX2qaaE6I%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8c99a58c7b782f1d-LAX
date
Fri, 27 Sep 2024 07:05:40 GMT
content-type
image/x-icon
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
vary
Accept-Encoding
server
cloudflare
8c99a588bea62f1d
3kt1cln2er9.top/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame BFFB
0
903 B
XHR
General
Full URL
https://3kt1cln2er9.top/cdn-cgi/challenge-platform/h/g/jsd/r/8c99a588bea62f1d
Requested by
Host: 3kt1cln2er9.top
URL: https://3kt1cln2er9.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.143.160 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

cf-ray
8c99a58dfd812f1d-LAX
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length
0
date
Fri, 27 Sep 2024 07:05:40 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gXfHOOKxdAhoP0Q2ZricLLclM12PQLkp7i%2Fc92Nw%2BcnMCapD8m%2BqVgannIjkHZh%2BPWEW6jTWzdI6w4R7JP1SUV%2FwKOE51udHBxCnH5ym%2FjI2KBLvlb2CPANm%2F03sOzJ90Qc%3D"}],"group":"cf-nel","max_age":604800}
/
nuegwgadi2f.top/ Frame 5B03
0
0
Document
General
Full URL
https://nuegwgadi2f.top/?domain=4vh0zayesako.xyz
Requested by
Host: 3kt1cln2er9.top
URL: https://3kt1cln2er9.top/static/js/iframe.js?t=202409101529
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:a5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://3kt1cln2er9.top/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-cache-status
DYNAMIC
cf-ray
8c99a593787bcb82-LAX
content-encoding
br
content-type
text/html
date
Fri, 27 Sep 2024 07:05:42 GMT
last-modified
Tue, 10 Sep 2024 04:18:48 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Ng9utJO%2FDpgzCKxLcdch7C9z5C9FvpY4iZOef4HH%2BvHc%2F30xf%2FlHCGRkRcV4dBTySE0bJHWMkELdppkOZ4P%2Fu7ytlmfOfE7qt7JPq3lnQ%2Fqd%2B3MqtCB7ktlvsZPICW5f3%2FuBozPN9KnG8FnD%2Fk%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
speculation-rules
"/cdn-cgi/speculation"

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| CryptoJS object| _0x3b3d function| _0x180e object| domainList object| publicKey function| getDomain function| handleEncrypt function| handleDecrypt function| fromCode boolean| connect object| urls number| urlIndex function| getconfigDown

2 Cookies

Domain/Path Name / Value
.4vh0zayesako.xyz/ Name: cf_clearance
Value: jHzLi8MpTwDPgdnfHgc9OCZH3deL.LAtA_TRvpsH86E-1727420738-1.2.1.1-DFzE5ES_9nuif_97CDUtf2HQ06rsGm6gGxpvFfv.QxxrfJW1laxiBIzsRu0KhUbBJf6hAKCnUrmtTQ01DRPjn7bivvGFfmjW8NKz2aBhuT.rrdgi86oQ7FHzjhrJP6QuwznaJjTikzNySR_Y9_JGTzowRumK6s_8lrEGmKLIbKiOhzacNb6hkMlik0jy0xGUMVuw2iL3yoDF.kXyUlee5bqYdBgSfGEDOoEl_LwY6UpAcbauQvgKRVwkzbcXNkg1MaPESuhvTwEWDkwJQ3M1FP7xYWodwPCEJhTtVrfs90tHHk5S9HMMtJywxXNJvqvl0o8QDmOQpq7GDuFOWy58bGTyev8h6V0wKIjiLwQZE_r29AuY6vP0cAHy4RQIuMAt
.3kt1cln2er9.top/ Name: cf_clearance
Value: IuILuVRx_EjYAuI4auul.n.G.akh392KnCSkUgIfA8I-1727420740-1.2.1.1-EHy519tYyUSc0Oup0OMbNGyZZTOKOnvYJcdK7.1FNn53E1b6v9YlfjkrlS6CTri8B5UGpcdFo.Q50BQMOcFsPETZ53ah4sBHQq6I2Ys5bP89vlTHILljC6O2Owwea8ltSfnpVklnAJOuk_DmhwM4VqWlGFkDqP1ckOJID0YKyr0WYFEvy0sex81RarFUv4VKGm3.vWd_DNJlguCgu6TjZk3S2MucQnFv3.j.Jo6TXrPJa35cxTFz1EwsSRdvqvqjgm1On8MVAQ_ZYRQC.u0IneKbkhR4fFMjR3ljAtOi7sTDm_b2YS3atDsuLy_8vE2.do6a6.02abOB98.UhrXrp8Ogh.oPbTrhzPa8yg2gfoTqer42r3_yYkgwbEsz4Fia