nydglobal.com
Open in
urlscan Pro
192.158.239.209
Malicious Activity!
Public Scan
URL:
https://nydglobal.com/uimn/welcome.php
Submission: On June 29 via manual from US — Scanned from DE
Submission: On June 29 via manual from US — Scanned from DE
Summary
This website contacted 4 IPs
in 2 countries
across 3 domains to perform 27 HTTP transactions.
The main IP is 192.158.239.209, located in
Charlotte, United States and
belongs to TIER-NET, US.
The main domain is nydglobal.com.
TLS certificate: Issued by R3 on June 3rd 2023. Valid for: 3 months.
This is the only time nydglobal.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on June 3rd 2023. Valid for: 3 months.
This is the only time nydglobal.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: US Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 23 | 192.158.239.209 192.158.239.209 | 397423 (TIER-NET) (TIER-NET) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 130.211.29.114 130.211.29.114 | 15169 (GOOGLE) (GOOGLE) | |
| 2 | 35.241.15.240 35.241.15.240 | 15169 (GOOGLE) (GOOGLE) | |
| 27 | 4 |
23
192.158.239.209
(Charlotte, United States)
ASN397423 (TIER-NET, US)
PTR: host.1controlserver.com
ASN397423 (TIER-NET, US)
PTR: host.1controlserver.com
| nydglobal.com |
1
130.211.29.114
(Kansas City, United States)
ASN15169 (GOOGLE, US)
PTR: 114.29.211.130.bc.googleusercontent.com
ASN15169 (GOOGLE, US)
PTR: 114.29.211.130.bc.googleusercontent.com
| cdn.perfdrive.com |
2
35.241.15.240
(Kansas City, United States)
ASN15169 (GOOGLE, US)
PTR: 240.15.241.35.bc.googleusercontent.com
ASN15169 (GOOGLE, US)
PTR: 240.15.241.35.bc.googleusercontent.com
| cas.avalon.perfdrive.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 23 |
nydglobal.com
nydglobal.com |
1 MB |
| 3 |
perfdrive.com
cdn.perfdrive.com — Cisco Umbrella Rank: 21253 cas.avalon.perfdrive.com — Cisco Umbrella Rank: 7300 |
9 KB |
| 1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 433 |
31 KB |
| 27 | 3 |
| Domain | Requested by | |
|---|---|---|
| 23 | nydglobal.com |
nydglobal.com
|
| 2 | cas.avalon.perfdrive.com |
cdn.perfdrive.com
|
| 1 | cdn.perfdrive.com |
nydglobal.com
|
| 1 | ajax.googleapis.com |
nydglobal.com
|
| 27 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www1.uimn.org |
| www.uimn.org |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.nydglobal.com R3 |
2023-06-03 - 2023-09-01 |
3 months | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2023-05-29 - 2023-08-21 |
3 months | crt.sh |
| *.perfdrive.com Go Daddy Secure Certificate Authority - G2 |
2022-09-20 - 2023-09-26 |
a year | crt.sh |
| cas.avalon.perfdrive.com Go Daddy Secure Certificate Authority - G2 |
2022-08-02 - 2023-08-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://nydglobal.com/uimn/welcome.php
Frame ID: 6DA364E2CAD677415E32491DE682E28C
Requests: 27 HTTP requests in this frame
Screenshot
Page Title
Welcome to the Minnesota Unemployment Insurance Benefits SystemDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
URL: https://www1.uimn.org/ui_applicant/applicant/logoff.do#main-content
Title: Skip to content
Title: Skip to content
Search URL Search Domain Scan URL
URL: http://www.uimn.org/applicants
Title: Information For Applicants
Title: Information For Applicants
Search URL Search Domain Scan URL
URL: http://www.uimn.org/assets/HowToApplyForUI_tcm1068-193561.pdf
Title: How to Apply
Title: How to Apply
Search URL Search Domain Scan URL
URL: http://www.uimn.org/applicants/help-support/info-handbook/info-handbook-intro.jsp
Title: Information Handbook
Title: Information Handbook
Search URL Search Domain Scan URL
URL: http://www.uimn.org/applicants/videos/
Title: Video Library
Title: Video Library
Search URL Search Domain Scan URL
URL: http://www.uimn.org/applicants/contact-us/
Title: Contact Us
Title: Contact Us
Search URL Search Domain Scan URL
URL: https://www1.uimn.org/ui_applicant/benefits/security/applicantReauthenticate.do?action.explicit=action.applicantReauthenticate.init.null&init=true
Title: Forgot your password
Title: Forgot your password
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
welcome.php
nydglobal.com/uimn/ |
15 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aperture.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
44 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ruxitagentjs_ICA27NQVdfhjqru_10267230522124059.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
291 KB 291 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
157 KB 157 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
global.css
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
18 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
all.css
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
72 KB 72 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
popper.min.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
21 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.bundle.min.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
82 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
leftNavCommon.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
toggleMobileAgentContextHeader.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
188 B 433 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
util.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
89 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap-datepicker.min.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
33 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
datepicker.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
22 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Unemployment%20Insurance%20Logo%20RGB-websites-projects.png
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
77 KB 77 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
UiApplicantDesign.js.download
nydglobal.com/uimn/Welcome%20to%20the%20Minnesota%20Unemployment%20Insurance%20Benefits%20System_files/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.4/ |
88 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ruxitagentjs_D_10267230522124059.js
nydglobal.com/ui_javascripts/ |
0 250 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ruxitagentjs_D_10267230522124059.js
nydglobal.com/ui_javascripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
aperture.js
cdn.perfdrive.com/aperture/ |
26 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fa-solid-900.woff2
nydglobal.com/uimn/webfonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
jsdata
cas.avalon.perfdrive.com/ |
316 B 471 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
jsdata
cas.avalon.perfdrive.com/ |
211 B 274 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fa-solid-900.woff
nydglobal.com/uimn/webfonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fa-solid-900.ttf
nydglobal.com/uimn/webfonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
rb_bf91035bph
nydglobal.com/ui_javascripts/ |
0 222 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
rb_bf91035bph
nydglobal.com/ui_javascripts/ |
0 222 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: US Government (Government)132 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend object| ssTimeLogs object| BrowserStyle string| j object| SSJSConnectorObj function| ssJSActionTaker function| ssJSConnWriteCookies object| dT_ object| dtrum object| dynatrace function| $ function| jQuery function| Popper object| bootstrap number| width object| leftNavFlag boolean| clickFlag string| path function| loadNavPreference function| preventMultipleSubmit function| handleMainContentClick function| mainLeftNav function| openSidebar function| closeSidebar function| getNavOverflowAndAdjustRightContent boolean| isNN function| autoTab function| textCounter function| textCounterNew function| bindTextAreaEvents function| bindTextAreaEventsNew function| changeLanguagePref function| setCookie function| getAppointmentOptions object| selectedJudgeId function| getUnemploymentLawJudges object| rescheduleJudgeId function| getUnemploymentLawRescheduleJudges function| getReassignAppointmentOptions boolean| showFlag function| showHide function| blockView object| issueId object| issueSeqNu function| populateDataTable function| showHideReassign function| getEvents function| resetULJCriteria function| searchULJCriteria function| validateULJData function| createNoDataTable function| populateMobileData function| populateNoDataCard string| issueIdMob string| issueSeqMob function| renderMobileView function| resetApplicantCriteria function| searchApplicantCriteria function| validateApplicantData function| showValidationDialog function| resetEmployerCriteria function| searchEmployerCriteria function| validateEmployerData function| checkVisibility function| reassignAppeal string| selectedCalendarEvent function| scheduleAppeal function| removeBlockViewChildElements function| updateTimeOptionsMap function| replaceSelectTimesMessage function| checkBlockedTabVisibility function| createMultiSelectTimeStore function| consvertToMilitaryTime string| selectedStart string| selectedEnd function| daySelectedEvent function| blockAppointment function| unblockAppointment function| setViewBasedTime undefined| readOnly function| getUserReadOnlyAccess boolean| hasAdmin function| userAllowedToAddDeleteAdjudicators function| showAddDeleteAdjudicatorPane function| retrieveNonMonQueuesFromDataSource function| getAdjudicatorList function| populateAdjudicatorDropDown function| updateHistoryUserDropDown function| updateAdjudicatorDeleteDropDown function| getIssueStatusCodes function| updateQueueAccessPane function| getUsersWithQueueAccess function| updateQueueId function| saveUserQueueAccess function| saveCellValue function| updateAdjudicatorId function| updateQueueSaveNode function| formatSkillLevel function| formatToSkillCode function| updateQueueAccessOnTab function| updateAdjudicatorAccessPane function| getQueueAccessByAdjudicatorId function| updateAdjudicatorAccessPaneOnTab function| saveAdjudicatorQueueAccess function| deleteAdjudicator function| indicateDeletionSuccess function| reactivateAdjudicator function| indicateReactivationSuccess function| getAdjudicatorHistoryDetails function| issuesAdjudicatedPaneTab function| getAdjudicatorHistoryDetailsOnTab function| download function| formatApplicantId function| formatDateSource function| populateQueueMobileView function| populateAdjudicatorMobileView function| populateAdjHistoryMobileView function| formatAppId boolean| clickflag function| preventMultiSubmit function| multipleSelectItems function| moneyValidation function| dateValidation function| hoursValidation function| weeksValidation string| __uzdbm_1 string| __uzdbm_2 string| __uzdbm_3 string| __uzdbm_4 string| loc11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .nydglobal.com/ | Name: __ssds Value: 2 |
|
| .nydglobal.com/ | Name: dtCookie Value: v_4_srv_-2D89_sn_RQIPP93J5O6A515FGNQ8FUFQB6TUIK2A |
|
| .nydglobal.com/ | Name: rxVisitor Value: 16880438141396FAM6JLHLI7I72BVENT88JNKMIQEMFVA |
|
| .nydglobal.com/ | Name: dtSa Value: - |
|
| .nydglobal.com/ | Name: __ssuzjsr2 Value: a9be2cd8e |
|
| .nydglobal.com/ | Name: __uzmaj2 Value: 13102b03-ee69-4a7d-baa4-4526f286f0e5 |
|
| .nydglobal.com/ | Name: __uzmbj2 Value: 1688043814 |
|
| .nydglobal.com/ | Name: __uzmcj2 Value: 216701076422 |
|
| .nydglobal.com/ | Name: __uzmdj2 Value: 1688043814 |
|
| .nydglobal.com/ | Name: rxvt Value: 1688045614678|1688043814141 |
|
| .nydglobal.com/ | Name: dtPC Value: -89$243814135_185h-vKACCJCRDAPGUWLWBSBUSIUMNUJFJJGFF-0e0 |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cas.avalon.perfdrive.com
cdn.perfdrive.com
nydglobal.com
130.211.29.114
192.158.239.209
2a00:1450:4001:808::200a
35.241.15.240
1ef89c6057c63e1fd2bda3054817b95cb244d353dc1dafd2736e0ad49ca97924
1f28aa0d46ad932a60eb5734b29478d1294e9bdb58d5198f7bfdb54ea5fd064d
28bd79918e1f57b7021d7eac9750326db8c1e1f02092b380b2d892da584dbf26
34457b777f4633c195ff5f00cdd4328509b0ed9ecbd2132db8e687291b0c8c7c
402df36267c7dd63cd0180cf618c6002668ff2f2268415fd4195925952d53268
418ea6b06242965b952fa8c88c1a197c127ccca86111ca709a6be4973df275b0
7472c2eebbc58feecc31fe8971de0dcb0431d98e57acadb840372ab24d59de5d
8aaa219431bec67f4c46de770caca0cda391bedce14c2378c6f8b52c7354dce3
8ac8932fa7fce97a1dc5b2f476b02073e7d9ef2ea9abca6581f7456c93434d30
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
93d7d214a51f645213446ea00bf9a8b6d6a12ef89f4153b26c687f73664505ab
95ccb9f1206dc108c05f308578fe23bb072ec8baa6a4930360ce98d4c8b337bb
9a2723c21fb1b7dff0e2aa5dc6be24a9670220a17ae21f70fdbc602d1f8acd38
9fb91ff0e8c179aea40dbe6842b36fd201654f5647c21dcec41fd18be535d506
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
a396760c7e039118203bce59d4e6f5385e42acd04d0fc85418fd9da1e715e5b4
c129f5956bc8e9c3a2838069e9a3ff50ad7a540a077b42934b2c5d7c902f4efc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e403b3755f7ce38ec704ac0bdade5a05205343e6363d659bebe7e3c1061c31e0
f776ddc2d7f883a3689c882ef69fec7083eaab8ded2f9dcd383b9b7eb19912c2
fad6a08c07b147d1874b0fdb26a8e1bd8aaf4bebf51be1bf6b5b21962871a403