safehaven.blog Open in urlscan Pro
104.207.142.244 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://amosyost.safehaven.blog/
Effective URL:
https://safehaven.blog/wp-signup.php?new=amosyost
Submission: On March 23 via automatic, source certstream-suspicious (March 23rd 2020, 12:39:15 am UTC)

Summary HTTP 21 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 21 HTTP transactions. The main IP is 104.207.142.244, located in Elk Grove Village, United States and belongs to AS-CHOOPA, US. The main domain is safehaven.blog.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 22nd 2020. Valid for: 3 months.

This is the only time safehaven.blog was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 1	2001:19f0:5c0... 2001:19f0:5c01:7a:5400:ff:fe2c:fb13		20473 (AS-CHOOPA) (AS-CHOOPA)
17	104.207.142.244 104.207.142.244		20473 (AS-CHOOPA) (AS-CHOOPA)
1	2a00:1450:400... 2a00:1450:4001:815::200a		15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:814::2003		15169 (GOOGLE) (GOOGLE)
21	3

1 2001:19f0:5c01:7a:5400:ff:fe2c:fb13 (United States) 1 redirects

ASN20473 (AS-CHOOPA, US)

amosyost.safehaven.blog	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 104.207.142.244 (Elk Grove Village, United States)

ASN20473 (AS-CHOOPA, US)
PTR: node32.aleph-com.net

safehaven.blog	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	safehaven.blog 1 redirects amosyost.safehaven.blog safehaven.blog	716 KB
3	gstatic.com fonts.gstatic.com	28 KB
1	googleapis.com fonts.googleapis.com	1 KB
21	3

	Domain	Requested by
17	safehaven.blog	safehaven.blog
3	fonts.gstatic.com	safehaven.blog
1	fonts.googleapis.com	safehaven.blog
1	amosyost.safehaven.blog	1 redirects
21	4

This site contains no links.

Subject Issuer	Validity	Valid
safehaven.blog Let's Encrypt Authority X3	`2020-03-22` - `2020-06-20`	3 months	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://safehaven.blog/wp-signup.php?new=amosyost
Frame ID: 7EBFD6ECC38B0494B37F8ECA1C83AF4D
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://amosyost.safehaven.blog/ HTTP 302
https://safehaven.blog/wp-signup.php?new=amosyost Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

21
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

744 kB
Transfer

1498 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://amosyost.safehaven.blog/ HTTP 302
https://safehaven.blog/wp-signup.php?new=amosyost Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set wp-signup.php Show response
safehaven.blog/
Redirect Chain

https://amosyost.safehaven.blog/
https://safehaven.blog/wp-signup.php?new=amosyost

16 KB
6 KB

835ms
504ms

Document
text/html

104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 271b832dc4e80197dc1cd8115a383bc8d98e653102d7d9c5e352105933ad15cb

Request headers

Host: safehaven.blog
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Server: Apache/2.4.7
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Set-Cookie: spo_1_fa=2a398c5a16cafcbd63b5d4136afb1633; expires=Mon, 23-Mar-2020 01:08:58 GMT; Max-Age=1800; path=/
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 5567
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Mon, 23 Mar 2020 00:38:57 GMT
Server: Apache/2.4.7
Location: https://safehaven.blog/wp-signup.php?new=amosyost
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.min.css
safehaven.blog/wp-includes/css/dist/block-library/ 40 KB
6 KB 109ms
107ms Stylesheet
text/css 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-includes/css/dist/block-library/style.min.css?ver=5.3.2
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Jan 2020 19:32:28 GMT
Server: Apache/2.4.7
ETag: "a1fb-59d60847aae5c-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 6163

GET
H/1.1 200
OK wp_head.css
safehaven.blog/wp-content/uploads/wtfdivi/ 2 KB
968 B 215ms
106ms Stylesheet
text/css 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-content/uploads/wtfdivi/wp_head.css?ver=1531333013
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 18fd1a19b6b22fda36f962562ea0b905850979088faab847ae5f5a839a578cc8

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Jan 2020 19:32:33 GMT
Server: Apache/2.4.7
ETag: "649-59d6084c96aa1-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 643

GET
H/1.1 200
OK style.css
safehaven.blog/wp-content/themes/Divi/ 454 KB
56 KB 338ms
123ms Stylesheet
text/css 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-content/themes/Divi/style.css?ver=5.3.2
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 9b34fc1a41aa32dc5282735dec9b99026bec68acc40eeb8c2fb33102835f82eb

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jul 2018 12:44:42 GMT
Server: Apache/2.4.7
ETag: "716be-57054071add88-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 56770

GET
H2 200 css
fonts.googleapis.com/ 25 KB
1 KB 20ms
19ms Stylesheet
text/css 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext

Requested by

Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d3fb385aad2757e720c0e49ca0b807172ff255ad2dc2bf4b1998e632297800a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 23 Mar 2020 00:38:58 GMT
server: ESF
date: Mon, 23 Mar 2020 00:38:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 Mar 2020 00:38:58 GMT

GET
H/1.1 200
OK style.css
safehaven.blog/wp-content/themes/safehaven/ 497 B
633 B 321ms
106ms Stylesheet
text/css 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-content/themes/safehaven/style.css?ver=3.9
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: ae7a7122defcc4e5ee5f5268b0e39201f0fd2775965a11fb4d8aff699da8d087

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jul 2018 13:43:31 GMT
Server: Apache/2.4.7
ETag: "1f1-57054d9729ce2-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 308

GET
H/1.1 200
OK dashicons.min.css
safehaven.blog/wp-includes/css/ 46 KB
28 KB 331ms
113ms Stylesheet
text/css 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-includes/css/dashicons.min.css?ver=5.3.2
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 18aa66c192cbef43a61b1398c292ae5c6c1d40d679428ee998b1c6bfaf61d75a

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Content-Encoding: gzip
Last-Modified: Wed, 14 Aug 2019 18:40:00 GMT
Server: Apache/2.4.7
ETag: "b9c6-5901815a92858-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 28481

GET
H/1.1 200
OK jquery.js Show response
safehaven.blog/wp-includes/js/jquery/ 95 KB
33 KB 336ms
118ms Script
application/javascript 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Content-Encoding: gzip
Last-Modified: Wed, 14 Aug 2019 18:40:00 GMT
Server: Apache/2.4.7
ETag: "17a69-5901815aaaef6-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 33776

GET
H/1.1 200
OK jquery-migrate.min.js Show response
safehaven.blog/wp-includes/js/jquery/ 10 KB
4 KB 335ms
113ms Script
application/javascript 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 May 2016 06:11:28 GMT
Server: Apache/2.4.7
ETag: "2748-5333ff613c400-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4014

GET
H/1.1 200
OK et-core-unified-15827429822354.min.css
safehaven.blog/wp-content/cache/et/1/1/19/ 6 KB
1 KB 329ms
111ms Stylesheet
text/css 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-content/cache/et/1/1/19/et-core-unified-15827429822354.min.css
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 9b3d645b74d151392c7a8f80c965aad732d441f5c994b36f7c13032b184ab6ae

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Feb 2020 18:49:42 GMT
Server: Apache/2.4.7
ETag: "1621-59f7f113f30ed-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 738

GET
H/1.1 200
OK logo.png
safehaven.blog/wp-content/themes/Divi/images/ 2 KB
2 KB 112ms
111ms Image
image/png 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://safehaven.blog/wp-content/themes/Divi/images/logo.png
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: cf520886e248a0fad2dffd2e44bd9ba546d0d8f5e750f182397be7d16680b20f

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Last-Modified: Fri, 06 Jul 2018 12:44:42 GMT
Server: Apache/2.4.7
ETag: "6cc-57054071add88"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1740

GET
H/1.1 200
OK custom.min.js Show response
safehaven.blog/wp-content/themes/Divi/js/ 250 KB
59 KB 120ms
119ms Script
application/javascript 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-content/themes/Divi/js/custom.min.js?ver=3.9
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: e6463939706bad5c589962d8ad3346892425435dbbab6f5ab0ad8e3ebb4e53a0

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 23 Mar 2020 00:38:58 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jul 2018 12:44:42 GMT
Server: Apache/2.4.7
ETag: "3e73d-57054071bb847-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96

GET
H/1.1 200
OK common.js Show response
safehaven.blog/wp-content/themes/Divi/core/admin/js/ 1 KB
912 B 112ms
111ms Script
application/javascript 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-content/themes/Divi/core/admin/js/common.js?ver=3.9
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: c4cbd5613d8734794f5937f142149baa1ca6335d853079f9a49d2dc014eb94a3

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 23 Mar 2020 00:38:59 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jul 2018 12:44:42 GMT
Server: Apache/2.4.7
ETag: "541-57054071abe48-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 573

GET
H/1.1 200
OK wp_footer.js Show response
safehaven.blog/wp-content/uploads/wtfdivi/ 510 B
643 B 109ms
109ms Script
application/javascript 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-content/uploads/wtfdivi/wp_footer.js?ver=1531333013
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: b86334546fa415db8dd2b8a3bbb47e41d41de42c6ee19cc99ec92b3fd5cd676a

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 23 Mar 2020 00:38:59 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Jan 2020 19:32:33 GMT
Server: Apache/2.4.7
ETag: "1fe-59d6084c96aa1-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 304

GET
H/1.1 200
OK wp-embed.min.js Show response
safehaven.blog/wp-includes/js/ 1 KB
1 KB 108ms
107ms Script
application/javascript 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-includes/js/wp-embed.min.js?ver=5.3.2
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 23 Mar 2020 00:38:59 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Jan 2020 19:32:28 GMT
Server: Apache/2.4.7
ETag: "577-59d60847c543c-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 740

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
safehaven.blog/wp-includes/js/ 14 KB
5 KB 110ms
110ms Script
application/javascript 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-includes/js/wp-emoji-release.min.js?ver=5.3.2
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 1a351abc3f3b435497ddb8a55f09268d3e641dc22455deac06cf0181a4de52ee

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 23 Mar 2020 00:38:59 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Jan 2020 19:32:28 GMT
Server: Apache/2.4.7
ETag: "362a-59d60847c543c-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4626

GET
H/1.1 200
OK bridge-2261737_1920.jpg
safehaven.blog/wp-content/uploads/2018/07/ 420 KB
420 KB 109ms
109ms Image
image/jpeg 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://safehaven.blog/wp-content/uploads/2018/07/bridge-2261737_1920.jpg
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: 327f64e85cdd3325ec17eac6a1685393d4e8f1fa096f1b09cc32fe93e8aec92e

Request headers

Referer: https://safehaven.blog/wp-signup.php?new=amosyost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 23 Mar 2020 00:38:59 GMT
Last-Modified: Fri, 06 Jul 2018 13:20:34 GMT
Server: Apache/2.4.7
ETag: "68e35-57054876124f0"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 429621

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext
Origin: https://safehaven.blog
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 24 Feb 2020 20:33:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
server: sffe
age: 2347501
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9132
x-xss-protection: 0
expires: Tue, 23 Feb 2021 20:33:58 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext
Origin: https://safehaven.blog
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 10 Mar 2020 23:56:14 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:44 GMT
server: sffe
age: 1039365
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9180
x-xss-protection: 0
expires: Wed, 10 Mar 2021 23:56:14 GMT

GET
H/1.1 200
OK modules.ttf
safehaven.blog/wp-content/themes/Divi/core/admin/fonts/ 90 KB
90 KB 111ms
111ms Font
application/octet-stream 104.207.142.244
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.blog/wp-content/themes/Divi/core/admin/fonts/modules.ttf
Requested by: Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.207.142.244 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: node32.aleph-com.net
Software: Apache/2.4.7 /
Resource Hash: d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09

Request headers

Referer: https://safehaven.blog/wp-content/themes/Divi/style.css?ver=5.3.2
Origin: https://safehaven.blog
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Mar 2020 00:38:59 GMT
Last-Modified: Fri, 06 Jul 2018 12:44:42 GMT
Server: Apache/2.4.7
ETag: "168f0-57054071abe48"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 92400

GET
H2 200 mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2
fonts.gstatic.com/s/opensans/v17/ 10 KB
10 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2

Requested by

Host: safehaven.blog
URL: https://safehaven.blog/wp-signup.php?new=amosyost

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext
Origin: https://safehaven.blog
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 09 Mar 2020 14:41:28 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:31:02 GMT
server: sffe
age: 1159051
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9728
x-xss-protection: 0
expires: Tue, 09 Mar 2021 14:41:28 GMT

Verdicts & Comments Add Verdict or Comment

71 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| et_site_url string| et_post_id function| et_core_page_resource_fallback object| _wpemojiSettings undefined| $ function| jQuery object| et_animation_data object| DIVI object| et_shortcodes_strings object| et_pb_custom object| et_pb_box_shadow_elements function| et_shortcodes_init boolean| et_load_event_fired boolean| et_is_transparent_nav boolean| et_is_vertical_nav boolean| et_is_fixed_nav boolean| et_is_minified_js boolean| et_is_minified_css function| et_pb_init_modules function| et_pb_debounce object| jQuery1124007828716118984569 function| et_pb_smooth_scroll function| et_pb_form_placeholders_init function| et_duplicate_menu function| et_pb_remove_placeholder_text function| et_fix_fullscreen_section function| et_bar_counters_init function| et_fix_pricing_currency_position function| et_pb_set_responsive_grid function| et_pb_set_tabs_height function| et_pb_box_shadow_apply_overlay function| et_pb_init_nav_menu function| et_pb_toggle_nav_menu function| et_pb_apply_sticky_image_effect object| salvattore function| Waypoint object| ET_SmoothScroll boolean| et_calculating_scroll_position boolean| et_side_nav_links_initialized object| wp object| $et_tooltip object| $et_learn_more function| et_pb_slider_init function| et_pb_audio_module_init function| et_countdown_timer function| et_countdown_timer_labels function| et_apply_parallax function| et_parallax_set_height function| et_pb_play_overlayed_video function| et_pb_resize_section_video_bg function| et_pb_center_video function| et_pb_adjust_video_margin function| et_fix_slider_height number| window_width function| et_pb_submit_newsletter function| et_fix_testimonial_inner_width function| et_pb_video_background_init function| et_reinit_waypoint_modules function| et_calc_fullscreen_section function| et_pb_parallax_init function| et_pb_fullwidth_header_scroll function| et_pb_search_init function| et_pb_search_percentage_custom_margin_fix function| et_pb_comments_init function| et_calculate_header_values function| et_pb_window_side_nav_scroll_init function| et_pb_side_nav_page_init object| twemoji number| $logo_width

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			safehaven.blog/	1970-01-19 08:15:25	Name: spo_1_fa Value: 2a398c5a16cafcbd63b5d4136afb1633

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://safehaven.blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amosyost.safehaven.blog
fonts.googleapis.com
fonts.gstatic.com
safehaven.blog
104.207.142.244
2001:19f0:5c01:7a:5400:ff:fe2c:fb13
2a00:1450:4001:814::2003
2a00:1450:4001:815::200a
0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b
18aa66c192cbef43a61b1398c292ae5c6c1d40d679428ee998b1c6bfaf61d75a
18fd1a19b6b22fda36f962562ea0b905850979088faab847ae5f5a839a578cc8
1a351abc3f3b435497ddb8a55f09268d3e641dc22455deac06cf0181a4de52ee
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
271b832dc4e80197dc1cd8115a383bc8d98e653102d7d9c5e352105933ad15cb
327f64e85cdd3325ec17eac6a1685393d4e8f1fa096f1b09cc32fe93e8aec92e
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
9b34fc1a41aa32dc5282735dec9b99026bec68acc40eeb8c2fb33102835f82eb
9b3d645b74d151392c7a8f80c965aad732d441f5c994b36f7c13032b184ab6ae
ae7a7122defcc4e5ee5f5268b0e39201f0fd2775965a11fb4d8aff699da8d087
b86334546fa415db8dd2b8a3bbb47e41d41de42c6ee19cc99ec92b3fd5cd676a
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
c4cbd5613d8734794f5937f142149baa1ca6335d853079f9a49d2dc014eb94a3
cf520886e248a0fad2dffd2e44bd9ba546d0d8f5e750f182397be7d16680b20f
d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09
d3fb385aad2757e720c0e49ca0b807172ff255ad2dc2bf4b1998e632297800a9
d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f
e6463939706bad5c589962d8ad3346892425435dbbab6f5ab0ad8e3ebb4e53a0
ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305