www.safepageserver0swer.xyz
Open in
urlscan Pro
107.180.114.118
Malicious Activity!
Public Scan
Submission: On March 26 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on March 26th 2024. Valid for: 3 months.
This is the only time www.safepageserver0swer.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 107.180.114.118 107.180.114.118 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
1 | 2606:4700::68... 2606:4700::6810:5914 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 2a02:4780:1:7... 2a02:4780:1:755:0:298c:cfd9:2 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 | 2606:4700:10:... 2606:4700:10::6814:4273 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2a02:26f0:480... 2a02:26f0:480:b84::f03 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 149.56.240.128 149.56.240.128 | 16276 (OVH) (OVH) | |
25 | 9 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 118.114.180.107.host.secureserver.net
www.safepageserver0swer.xyz |
ASN47583 (AS-HOSTINGER, CY)
theflavorsomejourney.com |
ASN20940 (AKAMAI-ASN1, NL)
support.microsoft.com |
ASN16276 (OVH, FR)
PTR: ns534296.ip-149-56-240.net
s4.histats.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
theflavorsomejourney.com
theflavorsomejourney.com |
642 KB |
2 |
microsoft.com
1 redirects
support.microsoft.com — Cisco Umbrella Rank: 12416 |
343 B |
2 |
histats.com
s10.histats.com — Cisco Umbrella Rank: 9768 s4.histats.com — Cisco Umbrella Rank: 9770 |
5 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4208 maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1806 |
23 KB |
2 |
safepageserver0swer.xyz
www.safepageserver0swer.xyz |
61 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 389 |
27 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 449 |
32 KB |
25 | 7 |
Domain | Requested by | |
---|---|---|
16 | theflavorsomejourney.com |
www.safepageserver0swer.xyz
|
2 | support.microsoft.com |
1 redirects
www.safepageserver0swer.xyz
|
2 | www.safepageserver0swer.xyz |
www.safepageserver0swer.xyz
|
1 | s4.histats.com |
s10.histats.com
|
1 | s10.histats.com |
www.safepageserver0swer.xyz
|
1 | maxcdn.bootstrapcdn.com |
www.safepageserver0swer.xyz
|
1 | stackpath.bootstrapcdn.com |
www.safepageserver0swer.xyz
|
1 | cdnjs.cloudflare.com |
www.safepageserver0swer.xyz
|
1 | cdn.jsdelivr.net |
www.safepageserver0swer.xyz
|
25 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
safepageserver0swer.xyz ZeroSSL RSA Domain Secure Site CA |
2024-03-26 - 2024-06-24 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-01-28 - 2024-04-27 |
3 months | crt.sh |
theflavorsomejourney.com R3 |
2024-03-07 - 2024-06-05 |
3 months | crt.sh |
support.microsoft.com Microsoft Azure TLS Issuing CA 02 |
2023-05-18 - 2024-05-12 |
a year | crt.sh |
histats.com R3 |
2024-02-16 - 2024-05-16 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.safepageserver0swer.xyz/
Frame ID: 5178CE60C49B9D5013409FCEF61947CD
Requests: 24 HTTP requests in this frame
Frame:
https://support.microsoft.com/de-DE
Frame ID: 02007FC3DAC79680E2F70372A33E3A10
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Microsoft Support Final WarningDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 19- https://support.microsoft.com/ HTTP 301
- https://support.microsoft.com/de-DE
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.safepageserver0swer.xyz/ |
213 KB 61 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/ |
216 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ |
82 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ |
59 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/ |
27 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
minimize.jpeg
theflavorsomejourney.com/coc/ |
17 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kxFy-clip.png
theflavorsomejourney.com/coc/ |
542 B 603 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qsbs-firewall.png
theflavorsomejourney.com/coc/ |
920 B 981 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s-S4-acc.png
theflavorsomejourney.com/coc/ |
813 B 875 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Z5BR-network.png
theflavorsomejourney.com/coc/ |
607 B 669 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uZbx-si.png
theflavorsomejourney.com/coc/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
okPE-vs.png
theflavorsomejourney.com/coc/ |
313 B 375 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
-EBq-current.png
theflavorsomejourney.com/coc/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nOxp-sett.png
theflavorsomejourney.com/coc/ |
463 B 525 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
def.png
theflavorsomejourney.com/coc/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cross.png
theflavorsomejourney.com/coc/ |
377 KB 378 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
virus-images.jpeg
theflavorsomejourney.com/coc/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft.png
theflavorsomejourney.com/coc/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stop.png
theflavorsomejourney.com/coc/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js15_as.js
s10.histats.com/ |
11 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
de-DE
support.microsoft.com/ Frame 0200 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_Fm7-alert.mp3
theflavorsomejourney.com/coc/ |
196 KB 196 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.php
s4.histats.com/stats/ |
50 B 184 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stars2.html
www.safepageserver0swer.xyz/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft.png
theflavorsomejourney.com/coc/ |
1 KB 1 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onpagereveal object| _Hasync function| $ function| jQuery object| bootstrap object| elem function| openFullscreen function| closeFullscreen function| getVariableFromURl string| ph0ne function| startScan function| playSound object| date string| current_date string| current_time string| date_time function| chfh function| chfh2 string| _HST_cntval object| Histats function| _typeof function| _classCallCheck function| _defineProperties function| _createClass function| FlipDown function| pad function| appendChildren function| getParameterByName function| finalCountdown function| exitModal number| _kmodal boolean| _smodal number| _now number| _tmx object| _HistatsCounterGraphics_0_setValues23 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
support.microsoft.com/signin-oidc | Name: .AspNetCore.OpenIdConnect.Nonce.CfDJ8AfnZ7Mjx1BCgeFmRZwDwXBJYUw1dCwO_onpSq8EfgFurs27f8Sq_nYwCVY-XPi-8d5mInYeZo2BPN5EuiCuCPjJJvCziO6HglsCTn7Lhss4sfe6cUqtl2gtwKgJ2_7J3QqFTsuP9LugLGcAS6veznU4Yl7HydtA1D9W0_kMPY5XzGCh5TzJVcqTwwVE0ECdIxywi-kesH8yHqwcREHd8fvRYozbIXj3ppWi9TG6qecjgIASVLhFZSzO2_OePBw_JyGU4YfMR5ptIS-uf-W9oTw Value: N |
|
www.safepageserver0swer.xyz/ | Name: HstCfa4854462 Value: 1711488610490 |
|
www.safepageserver0swer.xyz/ | Name: HstCla4854462 Value: 1711488610490 |
|
www.safepageserver0swer.xyz/ | Name: HstCmu4854462 Value: 1711488610490 |
|
www.safepageserver0swer.xyz/ | Name: HstPn4854462 Value: 1 |
|
www.safepageserver0swer.xyz/ | Name: HstPt4854462 Value: 1 |
|
www.safepageserver0swer.xyz/ | Name: HstCnv4854462 Value: 1 |
|
www.safepageserver0swer.xyz/ | Name: HstCns4854462 Value: 1 |
|
support.microsoft.com/ | Name: EXPID Value: c5212ccd-a62a-4219-9222-90f20ae5a186 |
|
support.microsoft.com/ | Name: MicrosoftApplicationsTelemetryDeviceId Value: e1c2d547-aea2-4b8c-bee0-421dbe02f6da |
|
support.microsoft.com/ | Name: ai_session Value: be3HmJJYr85EZImWFkBhQh|1711488611124|1711488611272 |
|
login.microsoftonline.com/ | Name: buid Value: 0.AQkAMe_N-B6jSkuT5F9XHpElWhkrJ-4RRD9DjyhcE8tv1AcBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8SIR7DUlX7aCOaSadQPRF3i5WJGF2BjZJAnqwY3YQk06NJ0RC4LeDYpbCHSLvWTn060ZN6pSEKs3uKNJBjHaoUY9bk_w-mQAQbo9VZ_jbWZAgAA |
|
.login.microsoftonline.com/ | Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8T8rEZSN7zYL_plcgVsTaAE1vPxbXWQG74Z6ly1EbqFGbHfwuxmKVPvjliNL8uLZ-KdfWGPDQY8bJfy0FZ3Kkm7CU8z60QrDB-zqlbOBiq49AsLMLiQgo7ze2pgfmSmnIVwpLUa40eOpznxJ_OXObHtOOyLmFGMnqjC2nHl34PDQgAA |
|
.login.microsoftonline.com/ | Name: esctx-87g8NHwaISI Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Pyn2UkHgUpsmvskYqJ31myCJr6wC3atHeGXjE-oVkK0uBKOKSYxsca-_fxD5ycwXpZ5mJos6OtGD98cGMChygEWwe7obKcGkh9nenGIpoyUCptij3-2LebsRWdnCfhIkmu9OZ48vCMq0paFtxcjPkiAA |
|
login.microsoftonline.com/ | Name: fpc Value: AiMTj9vm6ndDs-PR-tererZqwEtIAQAAAGM1ld0OAAAA |
|
login.microsoftonline.com/ | Name: x-ms-gateway-slice Value: estsfd |
|
login.microsoftonline.com/ | Name: stsservicecookie Value: estsfd |
|
.login.live.com/ | Name: uaid Value: b1b3c577a2fd4a7bb91ad6f6bf2a4449 |
|
.login.live.com/ | Name: MSPRequ Value: id=12<=1711488611&co=0 |
|
.login.live.com/ | Name: OParams Value: 11O.DoZ8AYU5xpX!*Y8K0!qK1f0YopaTMaRpvQ4ZfXcxHEWRbNX9um126ngE9wMFlXcCYU52*NyEf67gdOJYRd7kGiQl2!SvOuwxv5ApM0SzQAFjBtkIisahsWYd2BjHuFoS8o4P7qtirJh3rGvfFD64OGwK!ZnL2rRv017chLnW2Sgf1pTLhlMrx7fqagcEv5itPD1n0p7i*qJwpLLGq9!Gw2zbhFTGqCab8yPvxdYNwMwljI1rvfTq4xjm3ZVXRKYpH9z!0R0!ZmVJTL9yB3l7TYE$ |
|
.microsoft.com/ | Name: MC1 Value: GUID=af00478aecc34ef88941b4bc7b8bb533&HASH=af00&LV=202403&V=4&LU=1711488613434 |
|
.microsoft.com/ | Name: MS0 Value: 9f4fc02da2b94bd8a7f82665a690cfd6 |
|
support.microsoft.com/ | Name: MSFPC Value: GUID=f66c62e9246d4b338e2f725adc5537d9&HASH=f66c&LV=202403&V=4&LU=1711488613403 |
254 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
s10.histats.com
s4.histats.com
stackpath.bootstrapcdn.com
support.microsoft.com
theflavorsomejourney.com
www.safepageserver0swer.xyz
107.180.114.118
149.56.240.128
2606:4700:10::6814:4273
2606:4700::6810:5914
2606:4700::6811:180e
2606:4700::6812:acf
2606:4700::6812:bcf
2a02:26f0:480:b84::f03
2a02:4780:1:755:0:298c:cfd9:2
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
25e6759cb766022e77e2d37b55449dc1fd8d62370282018d579c8ecb28ea5956
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
316e6a6737bd296ab30aca2ef7fa36f119d15786a2432d01e31fdc130272f15c
3b531d403dc8ce7cbb0efb1a0c307cfb2bbaaf21feaff9f3546f13bebda71887
52b762d47c066e16300675d56cc359b504ffd3239438c96eb973864311bb7b79
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
91fb42a68a122344fd78cfd5f0cf9d06ff6d307fd4a5c68f40231c5950ece9a1
92d8510869b3d581401a93130fa72e4b54c5bf28dc8005994c5248d9afbfc37b
932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386
9cffd13c2ce05ebe032709a88fa59504e1218a12b175ec40d5aab280c18be51e
9edbf56b360080f5d6765dce77353b8130e9f8316ad34c68f6c2792cdc446321
a85f1e749a829c5c909837844c6b53ce0a9ae2adb7c8eac0e7b96c372c679a0d
bf8ebf2c2aeb4d8310341694baf1ed935d35c68c1572588af85b4775d5cf500e
c1d52e31f7fc13cbb3efca8b0ec937ddd97a5ec545c4dad26193429db10d8662
c3ad6aa1c03fd108854f008cfec2753ba623e1470a4d61798b5d8c050e474868
c56a8ae4818963e0d71eda4ebf46b4f2cdd3a238537dc8e99711fb690d272a73
c6fa08829a8a9d62abb4bf45e47d1443368aeda06418d83d46bb7526c4e05bf1
cc9492581764043ba1b1f7cd3561e035a1c365d09eda4df29c4e1cadb304fc5c
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03
fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65