alta-high.com
Open in
urlscan Pro
38.81.131.217
Malicious Activity!
Public Scan
Effective URL: https://alta-high.com/wp-includes/Telus/Telus/TELUS.html
Submission: On November 18 via manual from CA
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 11th 2019. Valid for: 3 months.
This is the only time alta-high.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telus (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 185.130.59.165 185.130.59.165 | 43260 (AS43260) (AS43260) | |
11 | 38.81.131.217 38.81.131.217 | 14144 (ADMIN-ON-...) (ADMIN-ON-DEMAND-LLC - Admin on Demand) | |
9 | 2406:da00:ff0... 2406:da00:ff00::3213:fe6e | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 2606:2800:234... 2606:2800:234:660:118e:28f:1d8a:2522 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
3 | 34.243.82.109 34.243.82.109 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 72.247.225.88 72.247.225.88 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
3 | 34.240.143.140 34.240.143.140 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 15.188.105.205 15.188.105.205 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 2 | 66.117.28.86 66.117.28.86 | 15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.) | |
32 | 8 |
ASN14144 (ADMIN-ON-DEMAND-LLC - Admin on Demand, LLC, US)
PTR: tkg1-tul1.aodhosting.com
alta-high.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
static.telus.com |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
fast.fonts.net |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-243-82-109.eu-west-1.compute.amazonaws.com
dpm.demdex.net |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a72-247-225-88.deploy.static.akamaitechnologies.com
assets.adobedtm.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-240-143-140.eu-west-1.compute.amazonaws.com
telus.demdex.net |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-15-188-105-205.eu-west-3.compute.amazonaws.com
b.telus.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
telus.com
static.telus.com b.telus.com |
280 KB |
11 |
alta-high.com
alta-high.com |
261 KB |
6 |
demdex.net
dpm.demdex.net telus.demdex.net |
8 KB |
2 |
everesttech.net
2 redirects
cm.everesttech.net |
997 B |
2 |
adobedtm.com
assets.adobedtm.com |
24 KB |
1 |
fonts.net
fast.fonts.net |
152 B |
1 |
akcan-turizm.com
akcan-turizm.com |
476 B |
32 | 7 |
Domain | Requested by | |
---|---|---|
11 | alta-high.com |
alta-high.com
|
9 | static.telus.com |
alta-high.com
|
3 | telus.demdex.net |
alta-high.com
assets.adobedtm.com |
3 | dpm.demdex.net |
alta-high.com
|
2 | cm.everesttech.net | 2 redirects |
2 | b.telus.com |
alta-high.com
|
2 | assets.adobedtm.com |
alta-high.com
|
1 | fast.fonts.net |
alta-high.com
|
1 | akcan-turizm.com | |
32 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.telus.com |
pwm.telus.net |
forum.telus.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
akcan-turizm.com Let's Encrypt Authority X3 |
2019-11-04 - 2020-02-02 |
3 months | crt.sh |
alta-high.com cPanel, Inc. Certification Authority |
2019-09-11 - 2019-12-10 |
3 months | crt.sh |
static.telus.com DigiCert Global CA G2 |
2019-04-02 - 2020-04-25 |
a year | crt.sh |
s9.wac.edgecastcdn.net DigiCert SHA2 Secure Server CA |
2019-01-16 - 2021-02-03 |
2 years | crt.sh |
*.demdex.net DigiCert SHA2 High Assurance Server CA |
2018-01-09 - 2021-02-12 |
3 years | crt.sh |
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA |
2019-10-22 - 2021-10-01 |
2 years | crt.sh |
b.telus.com DigiCert SHA2 High Assurance Server CA |
2019-05-11 - 2020-08-13 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://alta-high.com/wp-includes/Telus/Telus/TELUS.html
Frame ID: 4612174D16BA2FA72AC9F185D68DB3F7
Requests: 30 HTTP requests in this frame
Frame:
https://telus.demdex.net/dest5.html?d_nsid=0
Frame ID: 4AB0F1B8D99FC48C75646FA5B179E749
Requests: 1 HTTP requests in this frame
Frame:
https://telus.demdex.net/dest5.html?d_nsid=0
Frame ID: 01281BC9E44522A86E4734A2763918AC
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://akcan-turizm.com/..TELUS.php Page URL
- https://alta-high.com/wp-includes/Telus/Telus/TELUS.html Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Adobe DTM (Tag Managers) Expand
Detected patterns
- script /\/\/assets.adobedtm.com\//i
SiteCatalyst (Analytics) Expand
Detected patterns
- script /\/s[_-]code.*\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Forgot?
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: Need help?
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://akcan-turizm.com/..TELUS.php Page URL
- https://alta-high.com/wp-includes/Telus/Telus/TELUS.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 26- https://cm.everesttech.net/cm/dd?d_uuid=80899589465286436642473484118123178437 HTTP 302
- https://dpm.demdex.net/ibs:dpid=411&dpuuid=XdLDmgAAFi5KphN_
- https://cm.everesttech.net/cm/dd?d_uuid=80899589465286436642473484118123178437 HTTP 302
- https://dpm.demdex.net/ibs:dpid=411&dpuuid=XdLDmgAAFi5KphN_&d_uuid=80899589465286436642473484118123178437
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
..TELUS.php
akcan-turizm.com/ |
284 B 476 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
TELUS.html
alta-high.com/wp-includes/Telus/Telus/ |
16 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
990 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
passwordStrength.css
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
satelliteLib-a52ff1846227cd72b8a68d1e0351f08aba274184.js
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
114 KB 115 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
94 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icheck.js
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pStrength.js
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
10 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery_002.js
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
TELUS-logo.svg
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
refresh.png
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
TELUS-logo-white.svg
alta-high.com/wp-includes/Telus/Telus/TELUS_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
framework.css
static.telus.com/my-account/186/assets/css/uss-framework/ |
120 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shared-login.css
static.telus.com/my-account/194/assets/css/uss-shared-login/ |
76 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.css
fast.fonts.net/t/ |
0 152 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
id
dpm.demdex.net/ |
3 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dil-contents-5ee0fe83b2600884b99ed28f6109168105d2fb52.js
assets.adobedtm.com/6462022b939758565769298a6393ed7a46ee6817/ |
31 KB 11 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icheck-green.png
static.telus.com/my-account/assets/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flower-small.png
static.telus.com/my-account/assets/images/login/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telusdings-regular-webfont.woff2
static.telus.com/common/fonts// |
29 KB 30 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
530dee22-e3c1-4e9f-bf62-c31d510d9656.woff
static.telus.com/common/fonts// |
56 KB 57 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
50d35bbc-dfd4-48f1-af16-cf058f69421d.woff
static.telus.com/common/fonts// |
59 KB 60 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
static.telus.com/common/fonts// |
48 KB 48 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3600b37f-2bf1-45f3-be3a-03365f16d9cb.woff2
static.telus.com/common/fonts//h65/ |
34 KB 35 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s-code-contents-2f65f9fccbc156c9f9a3f54fbbc01651dc6a39a4.js
assets.adobedtm.com/6462022b939758565769298a6393ed7a46ee6817/ |
35 KB 13 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
dest5.html
telus.demdex.net/ Frame 4AB0 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id
b.telus.com/ |
49 B 467 B |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=411&dpuuid=XdLDmgAAFi5KphN_
dpm.demdex.net/ Redirect Chain
|
42 B 873 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s98340549228408
b.telus.com/b/ss/teluswebmail/1/JS-2.3.0-D7QN/ |
43 B 221 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
dest5.html
telus.demdex.net/ Frame 0128 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
event
telus.demdex.net/ |
3 KB 4 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=411&dpuuid=XdLDmgAAFi5KphN_&d_uuid=80899589465286436642473484118123178437
dpm.demdex.net/ Redirect Chain
|
0 840 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telus (Telecommunication)35 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| Visitor object| _satellite object| s_c_il number| s_c_in function| $ function| jQuery string| _determinate string| _indeterminate string| _update string| _type string| _click string| _touch string| _add string| _remove string| _callback string| _label string| _cursor boolean| _mobile object| link function| bichange function| clientChange function| showWhatsThis function| onLoad function| captchainit function| toggle_password function| DIL function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| s_i_teluswebmail5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.demdex.net/ | Name: dextp Value: 771-1-1574093722732|1123-1-1574093722833|1127-1-1574093722933|1121-1-1574093723034 |
|
.demdex.net/ | Name: demdex Value: 80899589465286436642473484118123178437 |
|
.alta-high.com/ | Name: s_cc Value: true |
|
alta-high.com/ | Name: AMCV_67A50FC0539F0BBD0A490D45%40AdobeOrg Value: -894706358%7CMCIDTS%7C18219%7CMCMID%7C80923281125996369262475682323827308587%7CMCAAMLH-1574698522%7C6%7CMCAAMB-1574698522%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1574100922s%7CNONE%7CMCSYNCSOP%7C411-18226%7CMCAID%7CNONE%7CvVersion%7C2.3.0 |
|
alta-high.com/ | Name: AMCVS_67A50FC0539F0BBD0A490D45%40AdobeOrg Value: 1 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
akcan-turizm.com
alta-high.com
assets.adobedtm.com
b.telus.com
cm.everesttech.net
dpm.demdex.net
fast.fonts.net
static.telus.com
telus.demdex.net
15.188.105.205
185.130.59.165
2406:da00:ff00::3213:fe6e
2606:2800:234:660:118e:28f:1d8a:2522
34.240.143.140
34.243.82.109
38.81.131.217
66.117.28.86
72.247.225.88
1c6c66c70d4812e89b35101b6a95510f5fb5efc81f4fcff63dab5a68d4783b21
2988da979b63f22bd2a08a47d438254b6508a643fabee1b3d2d00867daad8ba1
36d783f48e53a6e74f485f350a79f323f2ec1a0f25d34ef198fa72e2bc56bdc6
382c30319f5c79a66c7aba94b69014498e57486602a3ebe040a6c0be8b19e5b6
517fd6dd3c44b0dc6390330673883e9a345b6b57e449ab5a4fb6bf59328da0c5
52e685b652ad085f0a75b1db1eef16926485862db6d2779195d106879d7857e4
5a9ce4d93bc8fd30ad48503f5eefce9d741aec86f7edee7eb89a30137662f479
6025306d9e0e979432a2f3c6943bdd666e54202082d3c6f6104cfec026774a8f
69dcca2c6f2186ae89360369e2c8420a6f87c8049b9582274d6957024c68bc27
6eb414b7f0472ab83602947e4f3afdead2ef45742ae6eb3e73671dcb682a886e
6fff21b677855218e8124077903484763cd152358458da075136c057813c5c66
7bc73fb1d77a1d2827825fc9b429b1848d9c182552a1bdd47e858c704574f817
7c50c64d44a2aac0008dd2d4c722f8a431371210653dc5cf1ccd7ea755189c42
887a05728d2c646cbfa32dae68132e905bf805bf9d9dbb99f7187dfcc87f2a22
8c0b230f7dcf65e2f232a2825bc769fb4dcff96982af865b1f6e72a86f196d2b
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a89cdd5dce9e809759d3964c9e8175210715a571bbb7afef11e1d4f26d8357ba
ab7590bb29cbfccd8e4687db961e737f54d8a4b3da4ecfb098bb56f9f7d65f9d
b340cdcdd2575b24cc61b9a5d0f77d947852c28774fba181de9d30c638a4b475
c4374a0d15e0d271fb8a0113fd31e4eb4a15d8c255a509fe534c16f43024a3dc
c80222e63b82472ac739234bd849c6672735e1f97ac38ec2c7f660ab35dd237a
d0c2ff827b9df69ad52ad854d326a9ee61ac2efde8f68d10201173a000c87385
dad3b1dcd997cfdbee52209e910a2f9866b7273d4707c8d9eeefad237c9abe65
dad89945539fc6b9b012dba9d750cc4cec4c1c969aa1694887d42a5080cfa80c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e822673ef5c826a33358969138490871efeae176f4e3ccdb8c2a0ca4159d29fc
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0718dd44766296547e2153766bdc56d31e8aac51c7ed78b6499d59aa0ffac2f