[HN Gopher] Gone (Almost) Phishin'
___________________________________________________________________
Gone (Almost) Phishin'
Author : luu
Score : 165 points
Date : 2026-03-31 05:11 UTC (2 days ago)
(HTM) web link (ma.tt)
(TXT) w3m dump (ma.tt)
| voidUpdate wrote:
| Whats at the bottom of the page? It looks like it's meant to be
| brushstrokes or something?
| ErneX wrote:
| Yes, same as the logo / header.
| hk__2 wrote:
| Previous submission:
| https://news.ycombinator.com/item?id=47388201
| firstrulephish wrote:
| For the record, Apple will never call you first, but other
| services might. The REAL first rule of not being scammed should
| be stated
|
| "Thanks for the concern, I will call you right back"
|
| If your bank calls you, you turn off the call and call them.
| Don't take suggestions for contact address. You look them up, and
| you call them. Don't elaborate. The scammer is either and idiot
| and will try to call you telling to stop, or smart and fuck off.
| And if it was the bank, they'll at best, pick right back from
| where you left it, and at worst, learn better from the event.
| olmo23 wrote:
| I told my parents: if they are ever called by anyone, to tell
| them "now is not a good time, please give me a case number and
| I'll call back when I do have the time."
|
| And then, this is important, look up the number for the customer
| service hotline online.
|
| I feel like this is a simple solution that works 100% of the
| time.
| argee wrote:
| Mike Tyson once said "Everyone has a plan until they get
| punched in the mouth". I think you are underestimating the
| underhanded tactics and emotional tools available to scammers
| to keep you on the line.
| dspillett wrote:
| When I'm at home with the old man (mam is unfortunately in a
| care home), it _really_ irritates me how many scam calls he
| gets some days. Most of them are obvious: they just hang up
| when you pick up, the line is very bad or the caller is
| otherwise barely intelligible (i.e. they are speaking their
| 4th language), they refer to an account that doesn't exist or
| a fictitious government agency. But the occasional one is
| very smooth, and sometimes even have a few details about
| Dad's life and/or accounts that give pause (either of the
| form "could this actually be real" or "I wonder how have they
| collected and associated that?").
|
| If my family are anything to go by, they definitely target
| the elderly more than even one generation down (so it isn't
| just due to those of the younger generations often only
| having mobile phones and landlines are more targeted) because
| they know those tend to be more susceptible to the con and
| more likely to have some savings worth pillaging.
|
| Also in DayJob, some of our C*s and others associated with
| them (PAs, office managers) have seen some pretty
| sophisticated phishing attempts, both targeting the
| business's dealings and their personal accounts. I get the
| impression that these are reducing in number ATM (or the
| filtering of them is improving) but that those coming in are
| making an increasing effort to be convincing.
| e40 wrote:
| My dad googled "amex phone number" and called the first result.
| I spent most of a Saturday cleaning up after the scammers.
|
| I told him, next time call the number on the back of your card.
| MaxGabriel wrote:
| Any chance the first result was an ad? Those are definitely a
| popular phishing distribution mechanism, so getting your
| parents an adblocker could help
| qingcharles wrote:
| I just got a family member to install one after they
| Google'd a hotel name and accidentally clicked the first ad
| instead of the hotel site.
| dspillett wrote:
| Another top tip is how to response to "can I just confirm". No,
| they can't just confirm any details, until they have confirmed
| who they are, which they can't do without us calling them on
| the company's published support number.
|
| Luckily my parents are appropriately cynical and have not
| fallen for anything like that, but I know a couple of people of
| my generation who have (in the worst case losing 5K+ in
| savings, back when there was no onus on UK banks to take any
| responsibility for such fraud through their systems so it was
| properly lost to them).
| JumpCrisscross wrote:
| > _Apple Support lives on apple.com and getsupport.apple.com,
| nowhere else._
|
| Meanwhile: "Microsoft support uses the following domains to send
| emails:
|
| microsoft.com
|
| microsoftsupport.com
|
| mail.support.microsoft.com
|
| office365support.com
|
| techsupport.microsoft.com" [1]
|
| [1] https://learn.microsoft.com/en-
| us/troubleshoot/azure/general...
| throwaway290 wrote:
| That's just for support. Legit password resets for example come
| from more random top level domains with "microsoft" in it, like
| microsoftonline.com
|
| Another fun one is facebook, they use facebookmail.com or
| whatever else for serious security stuff
| e40 wrote:
| The number of redirects while using ms properties is just
| insane. It makes white listing them in uBO impossible because
| they redirect so fast, through multiple domains. The White
| listing is needed to sometimes make them work.
| throwaway290 wrote:
| It's a thing with google and facebook too. If you login to
| youtube or go to facebook account settings, at least 3
| redirects through very random places. I guess 3 is not a
| lot compared to microsoft's 15.
| CraigRood wrote:
| Is this because at one point <username>@facebook.com was a
| valid communication method? Great concept to be fair, but
| once you pull back the first layer you can immediately see
| its problems.
| Metacelsus wrote:
| >Legit password resets for example come from more random top
| level domains with "microsoft" in it, like
| microsoftonline.com
|
| Or aka.ms
| deng wrote:
| Also, Microsoft regularly sends me _legitimate_ emails
| regarding "Microsoft Rewards" that are absolutely
| indistinguishable from phishing, like "Total Prize Drop is
| here! Your chance to win 1,000,000 USD cash grand prize or one
| of three customizable Mercedes-Benz cars!", complete with links
| to login pages and everything. So like this one, just as mail:
| https://xcancel.com/bing/status/2034720189003231410
|
| The first time I got those I couldn't believe these were
| legitimate. Thank you Microsoft for teaching your customers how
| to fall for scams!
| latexr wrote:
| https://xkcd.com/570/
| hombre_fatal wrote:
| My Mexican telcom (Telcel) does this over SMS.
|
| "Sign up for Uber Eats and win 50,000 MXN of credit
| https://bit.ly/1234"
|
| What's funny is that they also send these over the same
| channel:
|
| "Warning: Telcel will never call you nor ask you for your
| personal info!"
|
| Gee, maybe stop priming your whole customer base to click on
| messages identical to spam?
| mentalgear wrote:
| This scam is scarily well made and what terrifies me is how
| easily scalable it is across sectors (e.g. your bank) and with AI
| voice clones (like in the attached video they mentioned the new
| 11lab generation).
| maplethorpe wrote:
| The scammer sounds Australian, but he pronounces mobile as
| "mobil", like an American. I wonder if he's doing that
| intentionally to provide cover, or if he's worked with Americans
| so much in the past that it's changed his pronunciation.
| wateralien wrote:
| The pause in replies also suggests he's not around the corner.
| ChrisMarshallNY wrote:
| Phishing has gotten _really good_ , lately. As he noted, they
| will often re-use legit templates from the actual corporation.
| The email will be 99.9% legit, with maybe only one link being
| dodgy.
|
| I don't think they can pass DMARC, though.
|
| My wife was almost scammed, a few years ago. What tipped her off,
| was how _extremely good_ the "tech support" was. Real tech
| support is generally someone on a scratchy line, with a heavy
| accent, following an inappropriate script.
|
| Even after she backed away, they sent a few followup snail mails,
| looking somewhat legit (cheap printer).
| tom-blk wrote:
| This is actually quite impressive and concerning
| xnx wrote:
| audit-apple.com is offline now. Is that something ICANN does, and
| if so, can they fix zombo.com?
| chuckadams wrote:
| ICANN doesn't do that, individual registrars do. ICANN _can_
| suspend a registrar 's accreditation if they don't act on
| spam/scam domains brought to their attention, which is
| something they do at the dizzying frequency of never.
| rererereferred wrote:
| I've gotten phishing domains taken down by going to their
| registrar and filling a support ticket.
| metalman wrote:
| Currently my device has no passwords, and the only apps that lead
| to anything personal are browsers, and then sign into my
| website/email. I have eliminated online banking, except for
| allowing people to pay me through direct deposit, which I confirm
| on my once a week trip to an actual bank. Very occasional online
| purchases use a dedicated credit card. The above, I believe makes
| me a smol, challenging target, and I use the many many attempts
| to fish through, text, email, and voice, as practice sessions to
| refine my customer faceing presence, and answer all calls, and
| chearfully deflect anything or anyone that is not a legitimate
| human and/or customer, in under 10 seconds. Going forward I would
| train any office helpers to use the same methods on any work
| devices.
| haar wrote:
| Thank you for writing this up (and getting it put into a video).
| I sent this blog post to my parents and my mum has decided to
| forward it on to all of her friends after watching.
|
| Seems easily digestible and approachable for a specific target
| audience.
| jasode wrote:
| _> When you get an email from Apple--or, really, anyone telling
| you to complete a digital security measure--check the URL they're
| trying to send you to. Apple Support lives on apple.com and
| getsupport.apple.com, nowhere else._
|
| That advice is fine for the technically savvy but doesn't work
| for a lot of normal people who don't have the knowledge to
| mentally parse urls. https://getsupport.apple.com
| /customer?cvid=8c11bcc71f684b6ab405d4fa1e86c146 https://get
| support.apple.com.phish.xyz/customer?cvid=8c11bcc71f684b6ab405d4f
| a1e86c146
|
| People just pattern match on the substring "apple.com" because
| they don't understand that the DNS system works right-to-left.
| Therefore, the 2nd url looks just as "legitimate" as the first
| one.
|
| I work with senior citizens and tried to explain how to parse the
| domain in the URL by looking for the first forward "/" after the
| "https://" and then scan backwards but they find that mental
| algorithm confusing and those instructions don't stick. (This is
| actually an area where some AI on phones/desktops could assist
| people decipher urls or mark them as suspicious.)
|
| The other problem with that advice is people can't "whitelist"
| the legitimate domains to look for _because they don 't know
| ahead-of-time what they are_. E.g.:
|
| - An Amazon verification email will be sent from "account-
| update@amazon.com". It's intuitive to predict something coming
| from "@amazon.com" so a mental whitelist filter works in that
| case.
|
| - However, State Farm Insurance legitimate login verification
| codes are actually sent from "noreply@sfauthentication.com"
| instead of the expected "@statefarm.com"
| basilikum wrote:
| It is unfortunately normal for companies to impersonate
| scammers.
|
| We can teach people as much as we want about security against
| phishing. It won't matter because people have to break these
| rules constantly. Companies actively train people to fall for
| phishing by doing everything in their power to be
| indistinguishable from phishing themselves.
| microtonal wrote:
| The worst are DHL, UPS, etc. customs payment mails. Even the
| real ones look like phishing mails and in some cases they
| don't link the payment request to your account, so you cannot
| circumvent it by logging into your account and checking
| wether it is legit.
| JohnMakin wrote:
| hp's email sender always look malicious and makes me double
| take
| varun_ch wrote:
| Microsoft is really bad with this. Login might be live.com or
| microsoftonline.com or maybe onmicrosoft.com. I went to report
| a vulnerability to their security portal this week and it
| redirected me to b2clogin.com.
|
| OneDrive email attachments link to, I kid you not, 1drv.ms, or
| maybe it was 1drv.com...
|
| Not to mention, they use .ms as if it's their personal TLD, but
| obviously anyone can register a .ms domain. It's like they want
| people to get phished.
| Retr0id wrote:
| Until this moment I assumed .ms _was_ a Microsoft TLD, but
| indeed it is not https://en.wikipedia.org/wiki/.ms
| amiga386 wrote:
| Handy tip: _all_ two-letter TLDs are country code TLDs.
| Doesn 't matter if they're trendy in website names (.nu,
| .cc, .io, .co, .it, .at, .cx, youtu.be and so on)
|
| In fact, here we have the ma.tt website, where the ".tt" is
| Trinidad and Tobago. Is Matt Mullenweg from Trinidad? No!
| the_mitsuhiko wrote:
| Though not all country codes point to a country. See .eu,
| .ac .su as different examples of stuff that breaks the
| rules.
| mghackerlady wrote:
| the .su domain was made when the soviet union was still
| around, so that doesn't really break the rules. I would
| prefer for top level domains to be eternal for a great
| multitude of reasons
| SAI_Peregrinus wrote:
| The possible annoyance with eternal country-code TLDs
| would be the dissolution of one country, and the creation
| (or renaming) of another country resulting in an eventual
| exhaustion of two-letter country codes. Eternity is a
| rather long duration.
| RGamma wrote:
| They also use .microsoft now (e.g. for the M365 admin
| portal).
| small_scombrus wrote:
| 1Password has really been bugging me recently, all the emails
| they send have giant link buttons they want you to click
| without verifying where you're actually going
| latexr wrote:
| > I work with senior citizens and tried to explain how to parse
| the domain in the URL by looking for the first forward "/"
| after the "https://" and then scan backwards but they find that
| mental algorithm confusing and those instructions don't stick.
|
| Have you tried some analogy which will be personal to them?
| Like describing the URL as a family tree: " _com_ is the oldest
| ancestor, like you Mr Johnson. Then _apple_ is your son Bill,
| and _getsupport_ is your grandchild Cody. If you saw _ml_
| instead of _getsupport_ , that would be a different grandchild,
| but still in your family. However, when you see _phish_ and
| _xyz_ before _apple_ and _com_ you can think 'I don't know
| those people, they aren't my father and grandfather'".
|
| The idea is imperfect but I literally just thought of it. We
| could certainly come up with something better that might
| eventually work.
|
| Thank you for working to keep vulnerable people safe from
| phishing.
| kstrauser wrote:
| For a simpler example:
|
| "You ever watch MASH? Remember the main guy, Benjamin
| Franklin Pierce? He's not the same guy as Benjamin Franklin,
| is he? You can tell because you don't stop after the first
| part of the name you recognize. You have to go all the way to
| the end and look at the whole name.
|
| Well, same here!"
| latexr wrote:
| Agreed, I like that better. It even has the correlation
| with family names being at the end.
| AnimalMuppet wrote:
| I recall receiving an email from company X, warning me to not
| trust emails that said they were from X but didn't come from
| X.com. _But the warning email itself did not come from X.com!_
| They broke their own rules _in the warning email._
|
| It's been a while, so I cannot name and shame X...
| xorcist wrote:
| > senior citizens and tried to explain how to parse the domain
|
| Why would you want end users, senior citizens or not, to
| mentally parse URLs?
|
| The rule is: If the bank, or paypal, or your landlord, or
| anyone else really emails you that you have to complete some
| information to your account or pay the latest bill or whatever,
| you GO TO THEIR WEBSITE and login normally. If it is important
| they will have the same information there.
|
| The same rule also applied to unsolicited phonecalls, but it
| might be harder to follow: If your bank, or the police, or some
| other important person calls you and asks for information or
| for you to do something that feels the _least_ bit off or
| hurried, you take their contact information, you look up
| whatever it is they want you to do and you CALL THEM BACK at
| the official telephone number of the bank or the police. You
| probably already have the number and if you don 't it's on
| their web site. Do not call back on any other number.
|
| People working the phone generally have much worse protocols
| than people working over email, so they may be less prepared
| for you to do this, but I have never heard of anything
| important that was emailed that wasn't also easily available
| when logged in to the website.
|
| The only time it is appropriate to click a link in an email is
| when you are verifying your email address with them. Not for
| any other reason.
| jasode wrote:
| _> The rule is: If the bank, or paypal, or your landlord, or
| anyone else really emails you that you have to complete some
| information to your account or pay the latest bill or
| whatever, you GO TO THEIR WEBSITE and login normally. _
|
| Yes, that is a "best practice" and good internet hygiene is
| to never click on email and text message urls but the reason
| they like clicking on legitimate email urls is _convenience
| and usability_. A helpful email link _directly lands them on
| the relevant website page_ to do whatever they need to do.
| That 's because the email url has a long string query
| parameters (id, etc) that _automatically navigates_ to the
| correct webpage.
|
| On the other hand, to do it the "best practice" way, it
| requires clicking around a confusing website menus and
| drilling several layers deep to _find_ whatever issue the
| email is talking about.
|
| A helpful email url link bypasses the hassle of learning
| whatever flavor-of-the-month confusing UI the website
| designer happened to to use.
|
| Hang around old people and watch over the shoulder how they
| use computers and you become sympathetic to how the make it
| work for them.
|
| E.g. An order status email has a URL link of a UPS tracking
| number to monitor shipping status. But don't click on that!
| Instead, copy the 1Z... number to the buffer. Then open a web
| browser and type in the ups.com url. Then paste the number
| into the text box. Those copy&paste mechanics not too
| difficult on desktop (Ctrl+C Ctrl-V) but it is much more
| difficult on mobile phones (double taps or long press and
| hold).
|
| That was a simple example. The more complicated one is email
| from health and medical companies with confusing websites.
| They'd rather just click on the email url.
| dwedge wrote:
| Man it's like we live in two different realities and yours is
| a textbook. dozens of times I've been sent links to download
| a pdf or fill out a form that is not linked from the main
| site anywhere. I know because I check - I hate clicking links
| in emails because of tracking if nothing else
| qingcharles wrote:
| Bluesky's moderation email is moderation@blueskyweb.xyz which
| 100% looks like a phishing address.
|
| https://bsky.app/profile/safety.bsky.app/post/3ljp6zi7tp227
| toast0 wrote:
| > The other problem with that advice is people can't
| "whitelist" the legitimate domains to look for because they
| don't know ahead-of-time what they are. E.g.:
|
| Yep, and there's even things like irs.gov which tells you how
| to know a site is official (https, and .gov), and then links
| you to id.me to login. (not sure what was wrong with login.gov,
| which SSA lets you use)
| Terr_ wrote:
| Or the insanity of IRS services that use the "id.me" domain for
| a vendor with a Montenegro TLD.
|
| Privacy issues aside, white-labeling the service and
| infrastructure behind *.irs.gov should be a mandatory
| requirement.
| re wrote:
| > getsupport.apple.com.phish.xyz
|
| I notice that a lot of scam texts use domains that start with a
| TLD followed by a hyphen, like: https://wa.gov-
| phish.fit/dol https://seattle.gov-phish.cc/dmv
|
| (Real examples, with "phish" replacing a string of 3-4 random
| letters)
|
| In some ways, it's a more convincing fake URL, since even if
| you're used to reading the domain right-to-left, your brain
| wants to start from the hyphen since it's a different character
| following a familiar TLD. But that type of domain also seems a
| lot easier for spam detection rules to catch.
| esquivalience wrote:
| > I work with senior citizens and tried to explain how to parse
| the domain in the URL by looking for the first forward "/"
| after the "https://" and then scan backwards but they find that
| mental algorithm confusing and those instructions don't stick.
|
| Might try explaining it this way?
|
| It works the same way as a postal address. The first part
| before `/` is the envelope: by analogy it runs
| streetaddress.city.country.
|
| You can give a name to your house, or add an apartment to the
| front - but that doesn't change the most significant part.
| valzam wrote:
| As others have mentioned, one big issue is that every company
| does these things differently and just because someone texts you
| a link doesn't mean it's phishing, even though it feels shady. In
| Australia I have had calls by immigration officers on supressed
| numbers that wanted PII over the phone without being able to tell
| me what the purpose of the call is.
| seb1204 wrote:
| Wow, this is tricky. Even though you can look up the official
| number you will likely not get through to the same person.
| WhyNotHugo wrote:
| What's the end goal here?
|
| I know that after a phone has been stolen, attackers want to gain
| access to an Apple account to remove the activation lock. But in
| this case, no devices had been stolen yet. The most they could do
| would be to... remotely mark the devices as stolen? Then ask the
| victim to pay to unlock them?
| sdwr wrote:
| Get into the account, change the phone number, and start
| charging the cards on file. Or look through iCloud data for
| passwords/contacts
| dinkleberg wrote:
| I've found that just not answering any calls from unknown numbers
| (and having my phone just silence those calls so I don't even see
| them) prevents all of this. If the caller is legitimate (e.g.,
| new dentist office regarding an appointment) they can leave a
| voicemail. And if it isn't spam and they aren't willing to leave
| a voicemail and have me call the back, it probably wasn't
| important in the first place.
|
| Sure, I may be missing out on some opportunities. But the peace
| of mind is far greater.
| seb1204 wrote:
| This, my pixel marks almost all calls not in my address book as
| suspected spam or phishing.
| dude250711 wrote:
| Google users are safe from this, as neither the fraudster nor the
| potential victim would be able to contact their support to begin
| with.
| emmelaich wrote:
| I believe this is actually part of the intent.
| qingcharles wrote:
| I can't even get into my own damned account with the username,
| password and recovery email.
| whywhywhywhy wrote:
| Apple let someone in India a place I have never been to, Apple
| knows I've never been to log into an old Apple account I'd
| forgotten about and hadn't logged into for 12 years with a
| password from a leak. All I got was "Your apple account has been
| linked to a new mac in India".
|
| Disgusting to me that even the most basic of logic for what would
| be someone stealing an account: has the account been used in
| years, would this person we have location data for ever be in
| India setting up a new computer, with a computer type ID we know
| is compromised to hackintoshes (iMac Pro) wasn't enough of a red
| flag to send me an email confirmation first.
|
| Luckily the account was so old iCloud barely stored anything back
| then but still shocking to me.
| ShowalkKama wrote:
| step 1) use a password mamager step 2) forget your own password
| step 3) witness the password mamager NOT autofill on phishing
| sites
| Cider9986 wrote:
| Having identifiers where anyone can initiate conversation is the
| problem. Modern messengers like Signal or SimpleX allow you to
| share one-time contact info, completely preventing anyone you
| don't allow to contact you.
|
| Besides that, people should sign up with random email aliases
| just as much as they sign up with random passwords.
|
| Here is a free crossplatform workflow: New, free Proton
| Mail[1]-->Free Bitwarden[2] account with single master password
| memorized[3]-->duck.com[4] alias pointing at Proton
| Mail-->Extract[5] duck.com api key to generate random duck.com
| alias for each site in Bitwarden-->Sign up for new service using
| new random email+password in seconds and never have to remember
| it and no spam.
|
| Here is a simple crossplatform workflow: Paid proton
| suite[6]-->Single memorized master password[3]-->Generate random
| email alias and password for new services using proton pass.
|
| If you use iCloud+ you can generate email aliases using a
| Raycast[7] extension or a browser extension[8] or inside of
| safari natively. There is also iCloud+ settings, but that is a
| pain to get to.
|
| [1] https://proton.me/mail
|
| [2] https://bitwarden.com/go/start-free
|
| [3] https://strongphrase.net
|
| [4] https://duckduckgo.com/email
|
| [5] https://bitwarden.com/blog/how-to-use-the-bitwarden-
| forwarde...
|
| [6] https://proton.me/mail/pricing
|
| [7] https://www.raycast.com/svenhofman/hidemyemail
|
| [8] https://chromewebstore.google.com/detail/icloud-hide-my-
| emai...
| PaulHoule wrote:
| Whenever I get some breathless email about security from my
| organization I send a phishing report for it even if I think it
| is real. All the messages about mandatory password resets and the
| like just increase the surface area for phishing. There should be
| a policy like "we will _never_ send you an email about the
| security of your account " See
|
| https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/201...
|
| a policy that's been talked about for more than 10 years and that
| the industry is almost catching up to.
| jbellis wrote:
| I've had some close calls already and with AI making it cheap to
| tailor scams to individuals it's probably only a matter of time.
|
| For my parents in their 70s, even more so. No amount of reminding
| them to read URLs first is going to help.
|
| So my question is: what are best practices to limit the blast
| radius when I (or they) inevitably click the wrong link?
| emptybits wrote:
| I had two calls from "Apple Support" very very much like this in
| the past two weeks. Both times, their claim was that someone was
| trying to reset my Apple password and they were trying to protect
| me.
|
| Both times, they asked me to go to a BS "apple-support" website
| and enter a six digit number they'd read out to me, where I'd see
| a transcript of this very phone call so I could then have full
| assurance that they were legit and working for Apple.
|
| Uh huh.
|
| And both times, when I asked them to just send me a quick email
| from their address at Apple (any address, even a generic inbox or
| support address) to assure me they worked for Apple ... pause ...
| [click]. Yeah.
| twoodfin wrote:
| _Don't approve any password-reset prompts--those are the first
| part of the attack. Do not pass Go, just head directly to your
| Apple ID settings._
|
| Why do I need to go to Settings? I get these occasionally and
| ignore them; what harm is there in that?
|
| FWIW these were real bad for a while, but Apple seems to have
| gotten better at canning the spam. Maybe 1-2 per year?
| mattlondon wrote:
| No mention of password managers yet? One of the major benefits is
| the password manager can do a quick, simple, completely
| deterministic check on the domain before providing the password.
| That would have stopped this dead in its tracks without relying
| on the human just happening to notice.
|
| I personally use bitwarden on my chrome profile across Windows
| Mac Linux and android and think it's great. Highly recommended.
|
| Of course I tell this to family and friends and no one does it so
| I dunno...
| KomoD wrote:
| This was easily one of the best phishing attempts I've ever seen.
___________________________________________________________________
(page generated 2026-04-02 23:01 UTC)