nbavoice.com Open in urlscan Pro
2606:4700:3032::681c:879  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request signin.php Show response nbavoice.com/wp-includes/Depp.ssl/df1657d83/	16 KB 4 KB	80ms 61ms	Document text/html	2606:4700:3032::681c:879 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::681c:879 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.8 Resource Hash 2e296be3277a8c86a17400678b813455ae3a602cfb10554830bef26be3d8b3b3 Request headers :method GET :authority nbavoice.com :scheme https :path /wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Fri, 09 Oct 2020 04:06:50 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d7b16af95c678c626482d75ba9dbb18e21602216410; expires=Sun, 08-Nov-20 04:06:50 GMT; path=/; domain=.nbavoice.com; HttpOnly; SameSite=Lax x-powered-by PHP/7.4.8 vary Accept-Encoding x-turbo-charged-by LiteSpeed cf-cache-status DYNAMIC cf-request-id 05ad2356c00000647ffc157200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 5df53b379e65647f-FRA content-encoding br
GET H2	200	blue-ui.css nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/css/	395 KB 45 KB	25ms 24ms	Stylesheet text/css	2606:4700:3032::681c:879 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/css/blue-ui.css Requested by Host: nbavoice.com URL: https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::681c:879 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a94921b7c398b61c9c0337d56f666d70c0604dd333aa5e7ffa197b4bdc646135 Request headers Referer https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 09 Oct 2020 04:06:50 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 8801 cf-polished origSize=405034 status 200 cf-request-id 05ad2357020000647ffc159200000001 last-modified Thu, 08 Oct 2020 20:15:30 GMT server cloudflare etag W/"62e2a-5f7f7362-e65e2b94d81b6ff4;gz" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} content-type text/css expires Fri, 16 Oct 2020 01:40:09 GMT cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 5df53b380e75647f-FRA cf-bgj minify
GET H2	200	logon.css nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/css/	128 KB 16 KB	18ms 17ms	Stylesheet text/css	2606:4700:3032::681c:879 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/css/logon.css Requested by Host: nbavoice.com URL: https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::681c:879 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9f7e5a5d537eb36b86a5f5a7fc373ec4c72a19b51e03ea8f0bda06e2a0261ae0 Request headers Referer https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 09 Oct 2020 04:06:50 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 8801 cf-polished origSize=131144 status 200 cf-request-id 05ad2357020000647ffc15a200000001 last-modified Thu, 08 Oct 2020 20:15:30 GMT server cloudflare etag W/"20048-5f7f7362-2dc7722c06f80001;gz" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} content-type text/css expires Fri, 16 Oct 2020 01:40:09 GMT cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 5df53b380e76647f-FRA cf-bgj minify
GET H2	200	rocket-loader.min.js Show response ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/	12 KB 4 KB	26ms 26ms	Script application/javascript	2606:4700::6810:a723 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js Requested by Host: nbavoice.com URL: https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a723 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains X-Frame-Options SAMEORIGIN Request headers Referer https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 09 Oct 2020 04:06:50 GMT content-encoding gzip vary Accept-Encoding nel {"report_to":"cf-nel","max_age":604800} status 200 cf-request-id 05ad2357050000d72dfa131200000001 last-modified Tue, 06 Oct 2020 11:13:20 GMT server cloudflare x-frame-options SAMEORIGIN etag W/"5f7c5150-3016" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000; includeSubDomains report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=172800, public cf-ray 5df53b38091fd72d-FRA expires Sun, 11 Oct 2020 04:06:50 GMT
GET H2	200	jquery.validate.min.js Show response nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/js/	49 KB 13 KB	16ms 15ms	Script application/x-javascript	2606:4700:3032::681c:879 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/js/jquery.validate.min.js Requested by Host: ajax.cloudflare.com URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::681c:879 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ac2faaa0365cb4fa0389ddffc2957571ab541b85f0113ffdb519dc075c6b3f33 Request headers Referer https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 09 Oct 2020 04:06:50 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 8801 status 200 cf-request-id 05ad2357230000647ffc15b200000001 last-modified Thu, 08 Oct 2020 20:15:30 GMT server cloudflare etag W/"c43a-5f7f7362-dc30cf3cdde6dee7;gz" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 5df53b383e7e647f-FRA expires Fri, 16 Oct 2020 01:40:09 GMT
GET H2	200	jquery.min.js Show response nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/js/	286 KB 79 KB	33ms 33ms	Script application/x-javascript	2606:4700:3032::681c:879 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/js/jquery.min.js Requested by Host: ajax.cloudflare.com URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::681c:879 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d Request headers Referer https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 09 Oct 2020 04:06:50 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 8801 status 200 cf-request-id 05ad2357230000647ffc15c200000001 last-modified Thu, 08 Oct 2020 20:15:30 GMT server cloudflare etag W/"478d0-5f7f7362-491297f0bdcf1253;gz" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 5df53b383e7f647f-FRA expires Fri, 16 Oct 2020 01:40:09 GMT
GET H2	200	angular.min.js Show response nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/js/	163 KB 55 KB	35ms 35ms	Script application/x-javascript	2606:4700:3032::681c:879 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/js/angular.min.js Requested by Host: ajax.cloudflare.com URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::681c:879 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9 Request headers Referer https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 09 Oct 2020 04:06:50 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 8801 status 200 cf-request-id 05ad2357230000647ffc15d200000001 last-modified Thu, 08 Oct 2020 20:15:30 GMT server cloudflare etag W/"28cdb-5f7f7362-95d7dbeb4e584634;gz" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 5df53b383e80647f-FRA expires Fri, 16 Oct 2020 01:40:09 GMT
GET H2	200	wordmark-white.svg nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/img/	1 KB 757 B	16ms 15ms	Image image/svg+xml	2606:4700:3032::681c:879 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/img/wordmark-white.svg Requested by Host: nbavoice.com URL: https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/css/logon.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::681c:879 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0 Request headers Referer https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/css/logon.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 09 Oct 2020 04:06:50 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 8801 status 200 cf-request-id 05ad2357270000647ffc15e200000001 last-modified Thu, 08 Oct 2020 20:15:30 GMT server cloudflare etag W/"581-5f7f7362-3acb75a65aad372b;gz" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 5df53b383e81647f-FRA expires Fri, 16 Oct 2020 01:40:09 GMT
GET H2	200	default.jpeg nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/img/	38 KB 39 KB	15ms 14ms	Image image/jpeg	2606:4700:3032::681c:879 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/img/default.jpeg Requested by Host: nbavoice.com URL: https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::681c:879 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a789126542ffccd16c10617e6d9c3338924ab3c3dec0a1c7aee55a421b98649 Request headers Referer https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/signin.php?session=386364393365 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 09 Oct 2020 04:06:50 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 8801 status 200 cf-int-pingora-origin-digest {"ext_ip":"162.158.93.235","ext_port":55600,"upstream_rtt":9,"upstream_reused":false,"cipher":"TLS_AES_256_GCM_SHA384","tls_version":"TLSv1.3","cert_digest":"pPeXPBo49990wDlfaKEaMU/vNleu0AF4EsoEWuF7URw","http_version":2} content-length 39153 cf-request-id 05ad2357270000647ffc15f200000001 last-modified Thu, 08 Oct 2020 20:15:30 GMT server cloudflare etag "98f1-5f7f7362-a74264f6312e243f;;;" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 5df53b383e82647f-FRA expires Fri, 16 Oct 2020 01:40:09 GMT
GET H2	200	dcefont.woff nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/img/	53 KB 29 KB	19ms 19ms	Font application/font-woff	2606:4700:3032::681c:879 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/img/dcefont.woff Requested by Host: nbavoice.com URL: https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/css/blue-ui.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::681c:879 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d75bef30599959292f501c97f1c3bbe31dbba72560b4602b9332a83a7794ba37 Request headers Origin https://nbavoice.com Referer https://nbavoice.com/wp-includes/Depp.ssl/df1657d83/style/css/blue-ui.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 09 Oct 2020 04:06:50 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 75 status 200 cf-request-id 05ad2357640000647ffc160200000001 last-modified Thu, 08 Oct 2020 20:15:30 GMT server cloudflare etag W/"d220-5f7f7362-63cc9b2119d0485a;;;" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602216411"}],"group":"cf-nel","max_age":604800} content-type application/font-woff cache-control max-age=14400 x-turbo-charged-by LiteSpeed cf-ray 5df53b38ae8e647f-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| __cfQR object| angular function| $ function| jQuery boolean| __cfRLUnblockHandlers

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.nbavoice.com/	1970-01-19 13:46:48	Name: __cfduid Value: d7b16af95c678c626482d75ba9dbb18e21602216410

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
nbavoice.com
2606:4700:3032::681c:879
2606:4700::6810:a723
2e296be3277a8c86a17400678b813455ae3a602cfb10554830bef26be3d8b3b3
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d
8a789126542ffccd16c10617e6d9c3338924ab3c3dec0a1c7aee55a421b98649
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
9f7e5a5d537eb36b86a5f5a7fc373ec4c72a19b51e03ea8f0bda06e2a0261ae0
a94921b7c398b61c9c0337d56f666d70c0604dd333aa5e7ffa197b4bdc646135
ac2faaa0365cb4fa0389ddffc2957571ab541b85f0113ffdb519dc075c6b3f33
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
d75bef30599959292f501c97f1c3bbe31dbba72560b4602b9332a83a7794ba37