telegramfraud.com
Open in
urlscan Pro
104.19.240.93
Public Scan
Effective URL: https://telegramfraud.com/
Submission: On March 17 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by E1 on March 17th 2024. Valid for: 3 months.
This is the only time telegramfraud.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.16.42.105 104.16.42.105 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
15 | 104.19.240.93 104.19.240.93 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6810:5514 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:828::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
5 | 2a00:1450:400... 2a00:1450:4001:808::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 54.231.161.169 54.231.161.169 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a00:1450:400... 2a00:1450:4001:806::200e | 15169 (GOOGLE) (GOOGLE) | |
4 | 2600:9000:211... 2600:9000:211e:1200:1c:37e5:3f40:21 | 16509 (AMAZON-02) (AMAZON-02) | |
32 | 10 |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
plst237.s3.amazonaws.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN16509 (AMAZON-02, US)
d1muf25xaso8hp.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
telegramfraud.com
1 redirects
www.telegramfraud.com telegramfraud.com |
801 KB |
5 |
gstatic.com
fonts.gstatic.com |
177 KB |
4 |
cloudfront.net
d1muf25xaso8hp.cloudfront.net |
56 KB |
2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 36 |
309 B |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 43 |
141 KB |
1 |
amazonaws.com
plst237.s3.amazonaws.com — Cisco Umbrella Rank: 160266 |
7 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 38 |
1 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 253 |
19 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 346 |
16 KB |
32 | 9 |
Domain | Requested by | |
---|---|---|
15 | telegramfraud.com |
telegramfraud.com
|
5 | fonts.gstatic.com |
fonts.googleapis.com
|
4 | d1muf25xaso8hp.cloudfront.net |
telegramfraud.com
|
2 | www.google-analytics.com |
www.googletagmanager.com
|
2 | www.googletagmanager.com |
telegramfraud.com
|
1 | plst237.s3.amazonaws.com |
telegramfraud.com
|
1 | fonts.googleapis.com |
telegramfraud.com
|
1 | cdnjs.cloudflare.com |
telegramfraud.com
|
1 | cdn.jsdelivr.net |
telegramfraud.com
|
1 | www.telegramfraud.com | 1 redirects |
32 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
telegramfraud.com E1 |
2024-03-17 - 2024-06-15 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
*.s3.amazonaws.com Amazon RSA 2048 M01 |
2023-10-10 - 2024-07-03 |
9 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2023-10-10 - 2024-09-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://telegramfraud.com/
Frame ID: 56516D613EE0907F22666C64BAB51E34
Requests: 33 HTTP requests in this frame
Screenshot
Page Title
Реестр неблагонадежных телеграм каналов и авторовPage URL History Show full URLs
-
https://www.telegramfraud.com/
HTTP 301
https://telegramfraud.com/ Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
XRegExp (JavaScript Libraries) Expand
Detected patterns
- xregexp.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.telegramfraud.com/
HTTP 301
https://telegramfraud.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
telegramfraud.com/ Redirect Chain
|
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
early.js
telegramfraud.com/package/early_js/05ae9fe83d6b755291132aab9d325d70918aafd336da1bd91a41a31c8b25734b/ |
24 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
run.css
telegramfraud.com/package/run_css/3aee24e1498a05d6c4e95d8d10a8e6a4b5f11c2179667bc40ecd6430272094dd/fraud-telegram/live/index/xfalse/xfalse/ |
96 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pre_run_jquery.js
telegramfraud.com/package/pre_run_jquery_js/dee903a9e36db713e4c86d0cdd96d921e37be0c1293ed8dee29e2e4d7713b9ff/ |
88 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
run.js
telegramfraud.com/package/run_js/c903f24a9f5b19708f0db9f07cc646b46c99acacaf3abe7d9589093f63d670f0/xfalse/x29/ |
3 MB 695 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
static.js
telegramfraud.com/package/static_js/3b5bfa0acb39c84245a78f8861845ab2c35379f13497b4c611dc07b141dc7515/fraud-telegram/live/index/xnull/xfalse/xfalse/xfalse/ |
62 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dynamic.js
telegramfraud.com/package/dynamic_js/fb7b7149e8846119dde4a6d3447ce4c80499799cdecf2badb143455af4b2342c/fraud-telegram/live/index/xnull/xfalse/xfalse/en_us/xfalse/xfalse/ |
91 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fuse.js
cdn.jsdelivr.net/npm/fuse.js/dist/ |
66 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xregexp-all.min.js
cdnjs.cloudflare.com/ajax/libs/xregexp/3.2.0/ |
78 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
282 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
data
telegramfraud.com/api/1.1/init/ |
283 B 1019 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tsstApxBaigK_hnnQ1iFow.woff2
fonts.gstatic.com/s/almarai/v12/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tssoApxBaigK_hnnS_qjtnqWow.woff2
fonts.gstatic.com/s/almarai/v12/ |
49 KB 50 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tssoApxBaigK_hnnS-agtnqWow.woff2
fonts.gstatic.com/s/almarai/v12/ |
47 KB 47 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
fonts.gstatic.com/s/raleway/v29/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
plst.js
plst237.s3.amazonaws.com/ |
7 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
42 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 255 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCMPrEHJA.woff2
fonts.gstatic.com/s/raleway/v29/ |
12 KB 12 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
hi
telegramfraud.com/user/ |
57 B 852 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https%3A%2F%2Fac28f1ae4aac704c41592fda08d4ed56.cdn.bubble.io%2Ff1710624986870x143343342989221700%2F283d0b47-6790-404c-b642-88e2679c11ac.webp
d1muf25xaso8hp.cloudfront.net/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https%3A%2F%2Fac28f1ae4aac704c41592fda08d4ed56.cdn.bubble.io%2Ff1710620967265x818431606343276500%2F5c91dc58-a7dd-4e69-b402-820c20d881c9.webp
d1muf25xaso8hp.cloudfront.net/ |
25 KB 26 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
119 KB 46 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
maggregate
telegramfraud.com/elasticsearch/ |
68 B 826 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https%3A%2F%2Fac28f1ae4aac704c41592fda08d4ed56.cdn.bubble.io%2Ff1710620967265x818431606343276500%2F5c91dc58-a7dd-4e69-b402-820c20d881c9.webp
d1muf25xaso8hp.cloudfront.net/ |
25 KB 26 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https%3A%2F%2Fac28f1ae4aac704c41592fda08d4ed56.cdn.bubble.io%2Ff1710624986870x143343342989221700%2F283d0b47-6790-404c-b642-88e2679c11ac.webp
d1muf25xaso8hp.cloudfront.net/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
msearch
telegramfraud.com/elasticsearch/ |
103 B 852 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
m
telegramfraud.com/user/ |
4 B 653 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
bulk_watch
telegramfraud.com/elasticsearch/ |
77 B 836 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
apm
telegramfraud.com/user/ |
4 B 721 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
frg
telegramfraud.com/ |
5 B 722 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
62 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| bubble_session_uid object| headers_source_maps object| load_error_log object| _bubble_page_load_data object| webfont object| WebFont function| FontFaceObserver string| gm_key boolean| glrl_key_status string| bubble_page_load_id string| bubble_plp_token string| _p string| bubble_page_name boolean| google_web_fonts_active object| fontface_loaded boolean| all_fontface_loaded function| Lib_post_load function| $ function| jQuery string| bubble_bundle_name object| BrowserDetect function| highlight_dom_changes function| local_storage_fallback object| u function| appquery function| clearImmediate function| setImmediate object| element_performance_counts function| kill_notifier_socket function| restore_notifier_socket number| server_time_offset object| client_db object| safe_require object| testing function| authenticate_as object| document_ready_key function| display_page function| switch_page object| preloaded object| _bubble_watcher_cache number| bubble_version object| plugins object| bubble_run_derived function| gtag object| app object| dataLayer object| __code__ object| translation_data object| language_data string| application_language function| Lib function| everything_ready function| wait_for_everything function| Fuse function| XRegExp object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal boolean| plst number| render_end_timestamp object| gtag_script5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.telegramfraud.com/ | Name: fraud-telegram_live_u2main Value: 1710709033585x426031472270288060 |
|
.telegramfraud.com/ | Name: fraud-telegram_live_u2main.sig Value: VjG6U2andP4HP8lywaoI4ZLfgBI |
|
.telegramfraud.com/ | Name: fraud-telegram_u1main Value: 1710709033568x260836964040485080 |
|
.telegramfraud.com/ | Name: _ga Value: GA1.1.20771464.1710709035 |
|
.telegramfraud.com/ | Name: _ga_64FBLDR671 Value: GS1.1.1710709034.1.0.1710709034.0.0.0 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'none'; |
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
d1muf25xaso8hp.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
plst237.s3.amazonaws.com
telegramfraud.com
www.google-analytics.com
www.googletagmanager.com
www.telegramfraud.com
104.16.42.105
104.19.240.93
2600:9000:211e:1200:1c:37e5:3f40:21
2606:4700::6810:5514
2606:4700::6811:190e
2a00:1450:4001:806::200e
2a00:1450:4001:808::2003
2a00:1450:4001:828::2008
2a00:1450:4001:829::200a
54.231.161.169
004f653557b6318ffcbf65e7860235d7ae29e0004232649ec4f0f977306663aa
03da4172eecc330846a9d7c056c18a2bb88c49c5ddfd68a60035ec70af715335
119ed9f8f66e3774eff520c77ce6bc8f974b8972cce6d0c831f059d9850809ee
1418cd530794d21095098afbdfd3aebceff4797e3c4459295603c058470e0435
294f1c75ce434c1c38e0006c7a6f10ba2356875f61f96a14d30ebbcf2b5b824c
2a6bda3553569fc700de73f81edc96180d144db1e05a702bc9854dbe14961c5e
34dcf441cdbc8d20b3482ff45d97b2d5577863cebb974992d3c88424272b1702
4438edf9f18f778a1bd21df66d108fab96d14b840098f7825b7af1c44a4463dd
450e62180e870526d437f065fa76a5d4e31517905e37a98184ef79b0fc2abd5b
57329622c0571f0bc59a56da7cbbb007f53a6f69f66302fc41a99cdb429c5f8d
5ec1e2ebe080ec8fbfbdc7dd9c0c25449e1d98e4e947c11a00fd770d8841698b
6b5a1116fedf74e888369da43f27b4ea6e21a7c5b3e3dde3227da6c21a2ef67c
7313eea2b0a30dbeff22e56fc8009acc3cd9744edf2a5a5806258aa416a3aa55
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
7e2ac7eda513b5e82c0ccb51f748810cbb33cc90e00c28f16b32f70ed474c543
875d5e91760e21a2faa424daa5a8cf89d666efdd6ea4a7ee0d76a17328d74325
94799ca77fe8f69807b0423d72a34ec22a491cbd5771d656ec47fc7a3e99fdca
9bd0279b23e2566c3cde07f58324401e0c5659a3f61ccf74699780748ae8a3a5
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
ae87eb983a546435dab3c65f5781a73f47501de11b9f09b77b5dd514ca72ee16
b16451935f2c828efe085e9e3419bf041c99f38143e720bcec92780379198369
b50d921fb971525780a2145b16dc1c74aa4771ed3b9e6692a0bd31ed53e1d0f1
b9bc227c45fbcfe05a6f37f0a398dc58cd8e2bf916b67b7ecf9ff1f82518e1ee
cbe48d5942468b47d100279501fa9e1fd82e0573bbbef97d66501c8b2b28ee87
d81289b2de1bd4c7146b1401c8a5484c2bffad531ce9223bd439800e2dbee693
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4380fe87526ef4a781348393b953b9d6a3a8ddfc729ce25cef19870ef74b9b6
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa