savingssound.com
Open in
urlscan Pro
2606:4700:30::6818:7d4c
Public Scan
Effective URL: https://savingssound.com/ra/backed-content.php
Submission: On May 30 via api from BE
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 23rd 2018. Valid for: a year.
This is the only time savingssound.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.220.85.130 67.220.85.130 | 33333 (AWKNET-INC) (AWKNET-INC - Awknet Communications) | |
4 | 23.229.103.35 23.229.103.35 | 36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing) | |
1 1 | 2606:4700:30:... 2606:4700:30::681b:905f | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 2 | 2606:4700:30:... 2606:4700:30::6812:2664 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
11 | 2606:4700:30:... 2606:4700:30::6818:7d4c | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 209.197.3.15 209.197.3.15 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
1 | 2606:4700::68... 2606:4700::6813:c797 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
2 | 2606:4700::68... 2606:4700::6813:c497 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 52.6.142.147 52.6.142.147 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 52.216.66.43 52.216.66.43 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
23 | 8 |
ASN33333 (AWKNET-INC - Awknet Communications, Inc., CA)
PTR: s130-85.static.awknet.us
walker.biz.uguy.pw |
ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: 237df2.lockharding.com
openoctopus.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
rapid-cdn.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
mobilapptracking.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
savingssound.com |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x00f.map2.ssl.hwcdn.net
stackpath.bootstrapcdn.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-6-142-147.compute-1.amazonaws.com
b7zuvcmijd.execute-api.us-east-1.amazonaws.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
savingssound.com
savingssound.com |
353 KB |
4 |
openoctopus.com
openoctopus.com |
9 KB |
3 |
cloudflare.com
cdnjs.cloudflare.com |
89 KB |
2 |
amazonaws.com
b7zuvcmijd.execute-api.us-east-1.amazonaws.com s3.amazonaws.com |
43 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
34 KB |
2 |
mobilapptracking.com
2 redirects
mobilapptracking.com |
458 B |
1 |
jquery.com
code.jquery.com |
24 KB |
1 |
rapid-cdn.com
1 redirects
rapid-cdn.com |
1 KB |
1 |
uguy.pw
1 redirects
walker.biz.uguy.pw |
334 B |
23 | 9 |
Domain | Requested by | |
---|---|---|
11 | savingssound.com |
openoctopus.com
savingssound.com |
4 | openoctopus.com |
openoctopus.com
|
3 | cdnjs.cloudflare.com |
savingssound.com
|
2 | stackpath.bootstrapcdn.com |
savingssound.com
|
2 | mobilapptracking.com | 2 redirects |
1 | s3.amazonaws.com |
openoctopus.com
|
1 | b7zuvcmijd.execute-api.us-east-1.amazonaws.com |
savingssound.com
|
1 | code.jquery.com |
savingssound.com
|
1 | rapid-cdn.com | 1 redirects |
1 | walker.biz.uguy.pw | 1 redirects |
23 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
mobilapptracking.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2018-12-23 - 2019-12-23 |
a year | crt.sh |
*.bootstrapcdn.com COMODO RSA Domain Validation Secure Server CA |
2018-10-03 - 2019-10-12 |
a year | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-03-02 - 2019-09-08 |
6 months | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
*.execute-api.us-east-1.amazonaws.com Amazon |
2018-09-20 - 2019-10-20 |
a year | crt.sh |
s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2018-12-03 - 2019-10-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://savingssound.com/ra/backed-content.php
Frame ID: 44BED9B1BAC218CE20980A3067CC9A49
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://walker.biz.uguy.pw/202/5-22-2019-yahoopensin?source=cypher&q=4G3BsTGDPkcoy1rMck2wS1fhE46Va8keJzX9
HTTP 302
http://openoctopus.com/clicks?cid=23706&pub=101846&sid1=cypher&sid2=&sid3=&sid4= Page URL
- http://openoctopus.com/clicks/?cid=4740&pub=101846&prevcid=23706&sid1=cypher&sid2=&sid3=&sid4= Page URL
-
http://rapid-cdn.com/?flux_fts=ioxtixzzcotllizozxeiclzclcqzllcaqxxzi74b5b&pubid=101846&vert=&cid=...
HTTP 307
https://mobilapptracking.com/?flux_fts=lcclxztiplacoqttcaeltqclpxttaqxtqpolpff78c HTTP 307
https://mobilapptracking.com/?flux_fts=lozzipxazxxictztqleltqclpxttaqxtqpolp3f4ba HTTP 307
https://savingssound.com/ra/backed-content.php Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: More Trending News >>
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://walker.biz.uguy.pw/202/5-22-2019-yahoopensin?source=cypher&q=4G3BsTGDPkcoy1rMck2wS1fhE46Va8keJzX9
HTTP 302
http://openoctopus.com/clicks?cid=23706&pub=101846&sid1=cypher&sid2=&sid3=&sid4= Page URL
- http://openoctopus.com/clicks/?cid=4740&pub=101846&prevcid=23706&sid1=cypher&sid2=&sid3=&sid4= Page URL
-
http://rapid-cdn.com/?flux_fts=ioxtixzzcotllizozxeiclzclcqzllcaqxxzi74b5b&pubid=101846&vert=&cid=4740&country=&payout=
HTTP 307
https://mobilapptracking.com/?flux_fts=lcclxztiplacoqttcaeltqclpxttaqxtqpolpff78c HTTP 307
https://mobilapptracking.com/?flux_fts=lozzipxazxxictztqleltqclpxttaqxtqpolp3f4ba HTTP 307
https://savingssound.com/ra/backed-content.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://walker.biz.uguy.pw/202/5-22-2019-yahoopensin?source=cypher&q=4G3BsTGDPkcoy1rMck2wS1fhE46Va8keJzX9 HTTP 302
- http://openoctopus.com/clicks?cid=23706&pub=101846&sid1=cypher&sid2=&sid3=&sid4=
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
clicks
openoctopus.com/ Redirect Chain
|
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
index.php
openoctopus.com/ |
181 B 355 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
openoctopus.com/clicks/ |
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
index.php
openoctopus.com/ |
205 B 379 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
backed-content.php
savingssound.com/ra/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
backed.js
savingssound.com/ra/ |
522 B 289 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.1.3/css/ |
138 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
19.jpg
savingssound.com/ra/back-img/ |
38 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
54.jpg
savingssound.com/ra/back-img/ |
71 KB 71 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
68.jpg
savingssound.com/ra/back-img/ |
34 KB 34 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
60.jpg
savingssound.com/ra/back-img/ |
42 KB 42 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
28.jpg
savingssound.com/ra/back-img/ |
31 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
52.jpg
savingssound.com/ra/back-img/ |
33 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
70.jpg
savingssound.com/ra/back-img/ |
37 KB 37 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
10.jpg
savingssound.com/ra/back-img/ |
30 KB 30 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
66.jpg
savingssound.com/ra/back-img/ |
34 KB 34 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GetPushScript
b7zuvcmijd.execute-api.us-east-1.amazonaws.com/prod/ |
1 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ |
75 KB 75 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
trackpush.min.js
s3.amazonaws.com/trackpush/ |
41 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
117 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| Popper object| bootstrap object| _at undefined| _aimtellPushToken boolean| _aimtellRanScript undefined| _aimtellSubscriberID undefined| _aimtellRefreshResult string| _aimtellAPI boolean| _aimtellSWInitiated boolean| _aimtellNewSubscriberID number| _aimtellVersion object| _aimtellDebugQueue number| _aimtellDebugQueueActive boolean| _aimtellPrompted number| _aimtellCacheBuster string| _aimtellUserDefinedWorker object| _aimtellWebsiteConfiguration undefined| trackData undefined| _aimtellTrackData object| _aimtellPageLoadAttributes undefined| _aimtellDebug undefined| aimtellDebugBox function| _aimtellDeferred function| _aimtellGetUrlVars function| _aimtellGetDeviceType function| _aimtellGetPageDetails function| _aimtellLoadBeacon function| _aimtellGetReferrer function| _aimtellGetLanguage function| _aimtellGetResolution function| _aimtellGetBrowserInfo function| _aimtellGetSystemInfo function| _aimtellDebugger function| _aimtellDebugQueueProcess function| _aimtellLogDebug function| _aimtellInitialize function| _aimtellEnablePageDelayPrompt function| _aimtellEnableScrollDelayPrompt function| _aimtellEnableSecondsDelayPrompt function| _aimtellValidateSubscriber function| _aimtellGetSiteConfig function| _aimtellGetPercentageScrolled function| _aimtellLoadPrompt function| _aimtellPromptApprove function| _aimtellPromptDeny function| _aimtellPromptCancel function| _aimtellGetSubscriberID function| _aimtellIsNewData function| _aimtellTrack function| _aimtellAppendManifestHeader function| _aimtellGetManifestLocation function| _aimtellGetWebsiteConfiguration function| _aimtellGetGCMID function| _aimtellLogError function| _aimtellGetSubscriberIDFromToken function| _aimtellGetSubscriberAttributes function| _aimtellGenerateID function| _aimtellGetCookie function| _aimtellSetCookie function| _aimtellDeleteCookie function| _aimtellHashString function| _aimtellTrackAttributes function| _aimtellForcePrompt function| _aimtellPrompt function| _aimtellAlias function| _aimtellTrackEvent function| _aimtellAbandonedCart function| _aimtellTc undefined| webURL undefined| logid undefined| subscriber_uid function| _aimtellGetPushToken function| _aimtellSupportsPush function| _aimtellCheckHTTPS function| _aimtellListener function| _webpushCheckPermissions function| _webpushSupportsPush function| _webpushPrompt function| _webpushRunNative function| _webpushGetSubscriberIDFromToken function| _webpushTrackAttributes function| _webpushGetToken function| _webpushTrackEvent function| _webpushGetSubscriberID function| _aimtellCheckPermissions function| _aimtellRunNative function| _aimtellSafariRun function| _aimtellDelWidgetNotification function| _aimtellDelAllWidgetNotification function| _aimtellCheckNotificationRemaining function| _aimtellClickedNotification function| _aimtellShowNotificationCenter function| _aimtellHideNotificationCenter function| _aimtellAppendNotification function| _aimtellShowNoNotifications function| _aimtellShowNotSubscribed function| _aimtellLaunchNotificationCenter function| _aimtellGetWidgetNotifications function| _aimtellFillNotifications function| _aimtellWidgetPermissionGrantedCallback function| _aimtellPermissionGrantedCallbacks function| _aimtellChromeRun function| _aimtellSubscribe function| _aimtellUrlBase64ToUint8Array function| _aimtellExtractSubscriptionId function| _aimtellSendSubscriptionToServer function| _aimtellAmplifySubscriberWorkerData function| _aimtellRegisterWorker function| _aimtellSendWorkerMessage function| _aimtellLoad function| _aimtellProcessQueue function| _aimtellForceRefreshSW0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b7zuvcmijd.execute-api.us-east-1.amazonaws.com
cdnjs.cloudflare.com
code.jquery.com
mobilapptracking.com
openoctopus.com
rapid-cdn.com
s3.amazonaws.com
savingssound.com
stackpath.bootstrapcdn.com
walker.biz.uguy.pw
205.185.208.52
209.197.3.15
23.229.103.35
2606:4700:30::6812:2664
2606:4700:30::6818:7d4c
2606:4700:30::681b:905f
2606:4700::6813:c497
2606:4700::6813:c797
52.216.66.43
52.6.142.147
67.220.85.130
123518c39e3398ea317eba6a40aeb6d2510d00f61ac57f1c9c4a7169f78a66ba
1e5fa5a9c3c6e97c21c8bc7ca8b429afd36e78d82b92dbb30c098495a02c2f21
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2ca05ff87dddd8a43aa358e78ff34511c130ceafcde41afc2d1ade1904f411d6
38823c0d8e31cab1abf33754f4c46852e664a3861e78ec7088854e6a49b0a8f4
417270780852410bc9cd60c2252f8931a1863b64b9c8d469c1e1a4e37e329fe5
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
69e813a246bfc4a7d6fe3522bf149637089c6e2d16d885758848f064eabbb1bf
789223292b405e3c724a411ef1a3484e10ddbb6aa19091d8f6d78fd221ef46b9
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7e0ab9c510ff11bedb359fc99f615296581547e5cec6b61f8e95a459d200ce18
81bf61c7685c45d0abfbd43ff9822ee6ebc9eabd1f878a3a8b0fab0022399707
96326156cceaa94e75782a572d8322374f2393ab861223d537488117bd6def6b
9db8df7ccc2631553a6b0071596b00ff0da36e9a334e9c0fcb167fd63db1ba8a
acc6fa98e90a66ed9c3137efb406265d5703b6523ef3e9ce87f20d9684628503
bf8cfc6f8d728b3445d5c4f9b3fb95afa5838f4ab694806ec1f491a40ed505d9
c985d8ffc8c75d85f05b7eebe2a377b312df20e25684ae632e7c0161df75b64b
cb0527b7ca9026fe8e0d3f65193e6bf450a21328e291e257f4cc6530da75fe64
d764a74a9ee65ae8098ed172d80e796c06f7ced8fa1f8c8823601d7c19368027
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e