urlscan.io logo urlscan.io
SecurityTrails logo

www.thecollectionontario.com Open in urlscan Pro
3.224.141.128  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.thecollectionontario.com/
Effective URL: https://www.thecollectionontario.com/
Submission: On March 07 via api from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 2 countries across 7 domains to perform 20 HTTP transactions. The main IP is 3.224.141.128, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.thecollectionontario.com.
TLS certificate: Issued by R3 on December 27th 2021. Valid for: 3 months.
This is the only time www.thecollectionontario.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 3.224.141.128 14618 (AMAZON-AES)
2 99.84.42.64 16509 (AMAZON-02)
2 2600:9000:216... 16509 (AMAZON-02)
6 104.17.73.206 13335 (CLOUDFLAR...)
1 52.21.234.110 14618 (AMAZON-AES)
3 99.84.47.72 16509 (AMAZON-02)
1 2607:f8b0:400... 15169 (GOOGLE)
3 2607:f8b0:400... 15169 (GOOGLE)
20 9
2    3.224.141.128 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-141-128.compute-1.amazonaws.com
www.thecollectionontario.com
2    99.84.42.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-42-64.ewr52.r.cloudfront.net
builder-assets.unbounce.com
2    2600:9000:2162:7400:1d:11cf:5800:93a1 (United States)

ASN16509 (AMAZON-02, US)
d34qb8suadcc4g.cloudfront.net
6    104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)
pages.lewismc.com
1    52.21.234.110 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-234-110.compute-1.amazonaws.com
events.ub-analytics.com
3    99.84.47.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-47-72.ewr52.r.cloudfront.net
d9hhrg4mnvzow.cloudfront.net
1    2607:f8b0:4006:80d::200a (Queens, United States)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
3    2607:f8b0:4006:816::2003 (Queens, United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
6 lewismc.com
pages.lewismc.com
142 KB
5 cloudfront.net
d34qb8suadcc4g.cloudfront.net
d9hhrg4mnvzow.cloudfront.net
220 KB
3 gstatic.com
fonts.gstatic.com
48 KB
2 unbounce.com
builder-assets.unbounce.com — Cisco Umbrella Rank: 15975
36 KB
2 thecollectionontario.com
www.thecollectionontario.com
5 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35
1 KB
1 ub-analytics.com
events.ub-analytics.com — Cisco Umbrella Rank: 22936
245 B
20 7
Domain Requested by
6 pages.lewismc.com www.thecollectionontario.com
pages.lewismc.com
3 fonts.gstatic.com fonts.googleapis.com
3 d9hhrg4mnvzow.cloudfront.net www.thecollectionontario.com
2 d34qb8suadcc4g.cloudfront.net www.thecollectionontario.com
d34qb8suadcc4g.cloudfront.net
2 builder-assets.unbounce.com www.thecollectionontario.com
2 www.thecollectionontario.com 1 redirects
1 fonts.googleapis.com builder-assets.unbounce.com
1 events.ub-analytics.com www.thecollectionontario.com
20 8

This site contains no links.

Subject Issuer Validity Valid
www.thecollectionontario.com
R3		 2021-12-27 -
2022-03-27		 3 months crt.sh
*.unbounce.com
Amazon		 2022-02-08 -
2023-03-09		 a year crt.sh
*.cloudfront.net
Amazon		 2022-02-01 -
2023-01-31		 a year crt.sh
pages.lewismc.com
Cloudflare Inc ECC CA-3		 2021-06-13 -
2022-06-12		 a year crt.sh
*.ub-analytics.com
Amazon		 2021-05-10 -
2022-06-08		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://www.thecollectionontario.com/
Frame ID: 4CAC443A7B374E15E8C27E4B9F314FAF
Requests: 19 HTTP requests in this frame

Frame: https://pages.lewismc.com/index.php/form/XDFrame
Frame ID: B1C5AD4F9CAE88AAE6F1BF76B41C6915
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://www.thecollectionontario.com/ HTTP 301
    https://www.thecollectionontario.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

20
Requests

95 %
HTTPS

38 %
IPv6

7
Domains

8
Subdomains

9
IPs

2
Countries

453 kB
Transfer

910 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.thecollectionontario.com/ HTTP 301
    https://www.thecollectionontario.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.thecollectionontario.com/
Redirect Chain
  • http://www.thecollectionontario.com/
  • https://www.thecollectionontario.com/
17 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.thecollectionontario.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.224.141.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-141-128.compute-1.amazonaws.com
Software
/
Resource Hash
ab353d9e638bbda924ed1e09874290ca1e8d04eb23648cf2a16405b7922f9b3a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

date
Mon, 07 Mar 2022 02:48:20 GMT
content-type
text/html; charset=UTF-8
transfer-encoding
chunked
p3p
CP="This is not a privacy policy."
x-unbounce-pageid
30b5d61c-689d-4cf2-9c5c-c38c12c1f8a9
etag
"a:7733a40df89962f1a320f82f21819a0d"
last-modified
Sat, 21 Aug 2021 20:31:54 GMT
x-unbounce-visitorid
89beac34-b001-46b2-9f7f-d1d9386b8718
x-unbounce-variant
a
content-location
https://www.thecollectionontario.com/
link
<https://www.thecollectionontario.com/>; rel="canonical"
content-encoding
gzip
x-proxy-backend
page-server
connection
close

Redirect headers

date
Mon, 07 Mar 2022 02:48:20 GMT
content-length
0
p3p
CP="This is not a privacy policy."
location
https://www.thecollectionontario.com/
x-proxy-backend
page-server
connection
close
main-7b78720.z.css
builder-assets.unbounce.com/published-css/ 		15 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://builder-assets.unbounce.com/published-css/main-7b78720.z.css
Requested by
Host: www.thecollectionontario.com
URL: https://www.thecollectionontario.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.42.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-42-64.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7b787207f29ffd5672ab91b95f681b387b4d6433081cc8b47070f1d564827863

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 02 Mar 2022 12:46:07 GMT
content-encoding
gzip
last-modified
Tue, 18 Jan 2022 22:28:54 GMT
server
AmazonS3
age
396134
etag
"43729a62fb549c1f6784cd5cc32082e0"
x-cache
Hit from cloudfront
x-amz-version-id
kJDetr_gaa4mXuLbtL4sIGZNSy2Uu.RY
via
1.1 a2b911ba341aa7e1e7d2f292be789000.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR52-C4
accept-ranges
bytes
content-type
text/css
content-length
2902
x-amz-cf-id
yupevt6Y4kTuXiM8YKtNrlXDTxaOJH76M5kH4H5ZgFcyj_DvJ5RpeA==
ub.js
d34qb8suadcc4g.cloudfront.net/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d34qb8suadcc4g.cloudfront.net/ub.js?1618514269
Requested by
Host: www.thecollectionontario.com
URL: https://www.thecollectionontario.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2162:7400:1d:11cf:5800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0bbb0c157e8aad81455cc5e2d258b835053a0b404b32632adaed6a9075042bc4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 06 Mar 2022 21:47:57 GMT
content-encoding
gzip
last-modified
Thu, 15 Apr 2021 19:15:08 GMT
server
AmazonS3
age
18024
etag
"f6420c864830b5860bfaadd47a2bb21b"
x-cache
Hit from cloudfront
x-amz-version-id
bKC28ufbc849z_LglraHgQe9TbPw1SIU
via
1.1 1f6489805a1a0c23aa23a8aa0cb28716.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR52-C3
accept-ranges
bytes
content-type
application/javascript
content-length
1856
x-amz-cf-id
oEE51kLUfJXkR7AM4x0842Q5XZ7y1dhRXJqASTOHfCN2oMJyVCvdMg==
forms2.min.js
pages.lewismc.com/js/forms2/js/ 		205 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pages.lewismc.com/js/forms2/js/forms2.min.js
Requested by
Host: www.thecollectionontario.com
URL: https://www.thecollectionontario.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 07 Mar 2022 02:48:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
MISS
last-modified
Wed, 12 Jan 2022 18:47:30 GMT
server
cloudflare
etag
"1e0a64-33210-5d567007b9480"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
6e8002fa9a3b53f5-YYZ
vary
Accept-Encoding
expires
Mon, 07 Mar 2022 06:48:20 GMT
main.bundle-fed11df.z.js
builder-assets.unbounce.com/published-js/ 		102 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://builder-assets.unbounce.com/published-js/main.bundle-fed11df.z.js
Requested by
Host: www.thecollectionontario.com
URL: https://www.thecollectionontario.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.42.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-42-64.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fed11df35baed7ee38458ff705b4b46ed7993830ea46f9b166c7e4d08afb3ab3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 02 Mar 2022 22:21:50 GMT
content-encoding
gzip
last-modified
Tue, 18 Jan 2022 21:17:50 GMT
server
AmazonS3
age
361591
etag
"0baa7928a61eec0ae7b70702e0a16542"
x-cache
Hit from cloudfront
x-amz-version-id
unUaqO9013Xc011S.3KQRlXYPC3pdAjV
via
1.1 a2b911ba341aa7e1e7d2f292be789000.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR52-C4
accept-ranges
bytes
content-type
application/javascript
content-length
33154
x-amz-cf-id
SrWluPUtHakuZhX61Lo8MNNl4zxE73wCW-4JrRvfK7gzhSrIQwS08g==
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/gif
sp-2.14.0.js
d34qb8suadcc4g.cloudfront.net/ 		98 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d34qb8suadcc4g.cloudfront.net/sp-2.14.0.js
Requested by
Host: d34qb8suadcc4g.cloudfront.net
URL: https://d34qb8suadcc4g.cloudfront.net/ub.js?1618514269
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2162:7400:1d:11cf:5800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2e8292b18fc2acc297e1aa6acc6abe05136604137e744ba1b49984df330562bb

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 06 Mar 2022 21:23:43 GMT
content-encoding
gzip
last-modified
Wed, 04 Nov 2020 01:35:32 GMT
server
AmazonS3
age
19478
etag
"73de733c308b8b5e44d2a6242dc4bd99"
x-cache
Hit from cloudfront
x-amz-version-id
rVTqklA1qqyT_0VdOCY323BKPISR0uej
via
1.1 1f6489805a1a0c23aa23a8aa0cb28716.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR52-C3
accept-ranges
bytes
content-type
application/javascript
content-length
30399
x-amz-cf-id
nTt8W2YgnfpVPuGKxVwlbEAT9F0hxtulxzU7T5nc1CHJZhG82ZiudQ==
i
events.ub-analytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events.ub-analytics.com/i?stm=1646621300858&e=pv&url=https%3A%2F%2Fwww.thecollectionontario.com%2F&tv=js-2.14.0&tna=sp-ub&aid=landing_page&p=web&tz=UTC&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&res=1600x1200&cd=24&eid=064f90bb-1ad1-4293-9f6c-9d5ed52b83a5&dtm=1646621300855&vp=1600x1200&ds=1600x1200&vid=1&sid=c841e9fa-1f30-4678-b9de-80544e490dc9&duid=c8d90890-630b-43cb-bf41-e92ac9569dc7&uid=89beac34-b001-46b2-9f7f-d1d9386b8718&cx=eyJzY2hlbWEiOiJpZ2x1OmNvbS5zbm93cGxvd2FuYWx5dGljcy5zbm93cGxvdy9jb250ZXh0cy9qc29uc2NoZW1hLzEtMC0wIiwiZGF0YSI6W3sic2NoZW1hIjoianNfdHJhY2tlcl9jb250ZXh0X3YxLjEuanNvbiIsImRhdGEiOnsicGFnZUlkIjoiMzBiNWQ2MWMtNjg5ZC00Y2YyLTljNWMtYzM4YzEyYzFmOGE5IiwidmFyaWFudElkIjoiYSIsImV2ZW50VHlwZSI6InZpc2l0IiwiZXZlbnRNZXRhZGF0YSI6W10sInJvdXRpbmdTdHJhdGVneSI6IndlaWdodGVkIn19XX0
Requested by
Host: www.thecollectionontario.com
URL: https://www.thecollectionontario.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.234.110 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-234-110.compute-1.amazonaws.com
Software
akka-http/10.0.9 /
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 07 Mar 2022 02:48:20 GMT
access-control-allow-credentials
true
server
akka-http/10.0.9
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
content-length
43
content-type
image/gif
getForm
pages.lewismc.com/index.php/form/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pages.lewismc.com/index.php/form/getForm?munchkinId=561-LJY-710&form=3860&url=https%3A%2F%2Fwww.thecollectionontario.com%2F&callback=jQuery112405121878504366884_1646621301034&_=1646621301035
Requested by
Host: pages.lewismc.com
URL: https://pages.lewismc.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0543c8a018a303d87d9688b88078e6e31e33323c9a534846aa204330dfb00294
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 07 Mar 2022 02:48:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cf-ray
6e8002fbabf653f5-YYZ
cached
false
32316349-ontario-piemonte-corner-rendering-high_11hc0tq1hc0sk00000l01o.jpg
d9hhrg4mnvzow.cloudfront.net/www.thecollectionontario.com/ 		183 KB
184 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d9hhrg4mnvzow.cloudfront.net/www.thecollectionontario.com/32316349-ontario-piemonte-corner-rendering-high_11hc0tq1hc0sk00000l01o.jpg
Requested by
Host: www.thecollectionontario.com
URL: https://www.thecollectionontario.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.47.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-47-72.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
29bb1414b5d19361ebccbeac707c6137d9a47c85f130393ef2a020cb7ee242e4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 07 Mar 2022 02:48:22 GMT
via
1.1 ff74a1dbc74f82ecce9bc5f46350f30a.cloudfront.net (CloudFront)
last-modified
Sat, 21 Aug 2021 20:31:54 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C4
etag
"1cf999889bb9ddb1aa387390ac9d5903"
x-cache
Miss from cloudfront
x-amz-version-id
FXajwkAnFLVHEQt6isrunUKiSlYu4x.X
cache-control
max-age=31557600
accept-ranges
bytes
content-type
image/jpeg
content-length
187591
x-amz-cf-id
zmjRw9WoYT_TcCB4ziMk-oundZ_Ua-Winf7HpAhYL8rfVRP0xEQ6Rg==
6979387d-83fa-4cc2-ace7-cff5be2704c5
https://www.thecollectionontario.com/ 		5 KB
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
blob:https://www.thecollectionontario.com/6979387d-83fa-4cc2-ace7-cff5be2704c5
Requested by
Host: builder-assets.unbounce.com
URL: https://builder-assets.unbounce.com/published-js/main.bundle-fed11df.z.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9c29517d31f5827419cfb4f4ff8cd13b478ec5345cfbb24e4f02072c723a87e7

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Length
5603
Content-Type
text/css
css
fonts.googleapis.com/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400%7CRoboto:500,700
Requested by
Host: builder-assets.unbounce.com
URL: https://builder-assets.unbounce.com/published-js/main.bundle-fed11df.z.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::200a Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d2feaf2996d7a55a69406186b8fc11c42c7e6e186775d3a5319eaaf7c03ee68d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 07 Mar 2022 02:48:21 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Mon, 07 Mar 2022 02:48:21 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 07 Mar 2022 02:48:21 GMT
95e4443e-the-collection-logo_108c02y000000000000028.png
d9hhrg4mnvzow.cloudfront.net/www.thecollectionontario.com/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d9hhrg4mnvzow.cloudfront.net/www.thecollectionontario.com/95e4443e-the-collection-logo_108c02y000000000000028.png
Requested by
Host: www.thecollectionontario.com
URL: https://www.thecollectionontario.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.47.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-47-72.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
16baecea64d62d39964bbfd1021702b53578ede9eb3f8b518be29f7d6419a3f3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 07 Mar 2022 02:48:22 GMT
via
1.1 ff74a1dbc74f82ecce9bc5f46350f30a.cloudfront.net (CloudFront)
last-modified
Sat, 21 Aug 2021 20:31:54 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C4
etag
"068b758704c42a3ce8ac41610ed4246a"
x-cache
Miss from cloudfront
x-amz-version-id
zXTv4POt1XYf4rikpLKcOFFajYF6o52a
cache-control
max-age=31557600
accept-ranges
bytes
content-type
image/png
content-length
3168
x-amz-cf-id
-NT8NCTa3TGyk8zEA55nWP1wMlI28N6KaPo0hO7ptXqfHH8vIpS2DQ==
441bd11e-https-app-unbouncepreview-com-publish-assets-0947bd1d-33f6-4997-a576-f42f8c844daa-4061581c-5282541-fb-social-media-facebook-facebook-logo-social-network-icon-100u00u000000000000028_1000000...
d9hhrg4mnvzow.cloudfront.net/www.thecollectionontario.com/ 		262 B
643 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d9hhrg4mnvzow.cloudfront.net/www.thecollectionontario.com/441bd11e-https-app-unbouncepreview-com-publish-assets-0947bd1d-33f6-4997-a576-f42f8c844daa-4061581c-5282541-fb-social-media-facebook-facebook-logo-social-network-icon-100u00u000000000000028_1000000000000000000028.png
Requested by
Host: www.thecollectionontario.com
URL: https://www.thecollectionontario.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.47.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-47-72.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
172f8e336707f2c83d57eaacd74c98982cb11db84dbc9707d7d98369fc67504a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 07 Mar 2022 02:48:22 GMT
via
1.1 ff74a1dbc74f82ecce9bc5f46350f30a.cloudfront.net (CloudFront)
last-modified
Sat, 21 Aug 2021 20:31:54 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C4
etag
"33d4016efb0f49eaa63ce281b8c4e698"
x-cache
Miss from cloudfront
x-amz-version-id
xsazyuwQWWJfB7x4RlYja8BrxwKa__8B
cache-control
max-age=31557600
accept-ranges
bytes
content-type
image/png
content-length
262
x-amz-cf-id
YpOD_6pf06e7D34fM6nekifJVOl87DeP-RCl1sBbxBDVzkinan2jvA==
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400%7CRoboto:500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2003 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.thecollectionontario.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 02 Mar 2022 19:45:15 GMT
x-content-type-options
nosniff
age
370986
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 02 Mar 2023 19:45:15 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400%7CRoboto:500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2003 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.thecollectionontario.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 03 Mar 2022 08:30:30 GMT
x-content-type-options
nosniff
age
325071
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 03 Mar 2023 08:30:30 GMT
memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v28/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v28/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400%7CRoboto:500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2003 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cce577471c2586f3e0c2518fff84a970d33f61491fb8c629341b86f238cf07c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.thecollectionontario.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Tue, 01 Mar 2022 22:44:51 GMT
x-content-type-options
nosniff
age
446610
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16692
x-xss-protection
0
last-modified
Tue, 01 Mar 2022 22:06:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Mar 2023 22:44:51 GMT
forms2.css
pages.lewismc.com/js/forms2/css/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://pages.lewismc.com/js/forms2/css/forms2.css
Requested by
Host: pages.lewismc.com
URL: https://pages.lewismc.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 07 Mar 2022 02:48:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
MISS
last-modified
Wed, 12 Jan 2022 18:47:30 GMT
server
cloudflare
etag
"1e0a67-3437-5d567007b9480"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
6e8002ffab5653f5-YYZ
content-length
2623
expires
Mon, 07 Mar 2022 06:48:21 GMT
forms2-theme-simple.css
pages.lewismc.com/js/forms2/css/ 		826 B
327 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://pages.lewismc.com/js/forms2/css/forms2-theme-simple.css
Requested by
Host: pages.lewismc.com
URL: https://pages.lewismc.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 07 Mar 2022 02:48:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
MISS
vary
Accept-Encoding
content-length
242
last-modified
Wed, 12 Jan 2022 18:47:30 GMT
server
cloudflare
etag
"1a0a02-33a-5d567007b9480"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
6e8002ffab5753f5-YYZ
expires
Mon, 07 Mar 2022 06:48:21 GMT
XDFrame
pages.lewismc.com/index.php/form/ Frame B1C5 		2 KB
877 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pages.lewismc.com/index.php/form/XDFrame
Requested by
Host: pages.lewismc.com
URL: https://pages.lewismc.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e937a377b1a71bb34f377014a1a8eb3e02cd5862ee19e0547c644a27c8d0aca4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.thecollectionontario.com/

Response headers

date
Mon, 07 Mar 2022 02:48:22 GMT
content-type
text/html; charset=utf-8
cache-control
max-age=3600
x-content-type-options
nosniff
vary
Accept-Encoding
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6e800300bd5253f5-YYZ
content-encoding
gzip
forms2.min.js
pages.lewismc.com/js/forms2/js/ Frame B1C5 		205 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pages.lewismc.com/js/forms2/js/forms2.min.js
Requested by
Host: pages.lewismc.com
URL: https://pages.lewismc.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pages.lewismc.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 07 Mar 2022 02:48:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Wed, 12 Jan 2022 18:47:30 GMT
server
cloudflare
age
2
etag
"1e0a64-33210-5d567007b9480"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
6e800302d90053f5-YYZ
vary
Accept-Encoding
expires
Mon, 07 Mar 2022 06:48:22 GMT

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored object| ub object| UnbounceSnowplowNamespace function| ubSnowplow function| ownKeys function| _objectSpread function| _defineProperty function| _typeof object| Snowplow object| MktoForms2 function| setImmediate function| clearImmediate boolean| VimeoPlayerResizeEmbeds_ object| jQuery112405121878504366884

4 Cookies

Domain/Path Name / Value
www.thecollectionontario.com/ Name: ubpv
Value: a%2C30b5d61c-689d-4cf2-9c5c-c38c12c1f8a9
www.thecollectionontario.com/ Name: ubvs
Value: 89beac34-b001-46b2-9f7f-d1d9386b8718
.thecollectionontario.com/ Name: ubvt
Value: 89beac34-b001-46b2-9f7f-d1d9386b8718
.pages.lewismc.com/ Name: __cf_bm
Value: ZOucLOgk_k3xFwO1gy2CNlwg7ysF9NBrtvbYldyuWTY-1646621300-0-AaDFDbLJ0uSoeks9wc1DWumkARxukeCn18eQTEFmUMBSGIoAVPRLF7lyi+isBkUJgfS2w+I9Cf+6X5LkRmvijJw=

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

builder-assets.unbounce.com
d34qb8suadcc4g.cloudfront.net
d9hhrg4mnvzow.cloudfront.net
events.ub-analytics.com
fonts.googleapis.com
fonts.gstatic.com
pages.lewismc.com
www.thecollectionontario.com
104.17.73.206
2600:9000:2162:7400:1d:11cf:5800:93a1
2607:f8b0:4006:80d::200a
2607:f8b0:4006:816::2003
3.224.141.128
52.21.234.110
99.84.42.64
99.84.47.72
0543c8a018a303d87d9688b88078e6e31e33323c9a534846aa204330dfb00294
0bbb0c157e8aad81455cc5e2d258b835053a0b404b32632adaed6a9075042bc4
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
16baecea64d62d39964bbfd1021702b53578ede9eb3f8b518be29f7d6419a3f3
172f8e336707f2c83d57eaacd74c98982cb11db84dbc9707d7d98369fc67504a
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43
29bb1414b5d19361ebccbeac707c6137d9a47c85f130393ef2a020cb7ee242e4
2e8292b18fc2acc297e1aa6acc6abe05136604137e744ba1b49984df330562bb
7b787207f29ffd5672ab91b95f681b387b4d6433081cc8b47070f1d564827863
9c29517d31f5827419cfb4f4ff8cd13b478ec5345cfbb24e4f02072c723a87e7
ab353d9e638bbda924ed1e09874290ca1e8d04eb23648cf2a16405b7922f9b3a
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cce577471c2586f3e0c2518fff84a970d33f61491fb8c629341b86f238cf07c0
d2feaf2996d7a55a69406186b8fc11c42c7e6e186775d3a5319eaaf7c03ee68d
e937a377b1a71bb34f377014a1a8eb3e02cd5862ee19e0547c644a27c8d0aca4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fed11df35baed7ee38458ff705b4b46ed7993830ea46f9b166c7e4d08afb3ab3