Submitted URL: https://s5.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Effective URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Submission Tags: falconsandbox
Submission: On February 21 via api from US — Scanned from DE

Summary

This website contacted 6 IPs in 3 countries across 7 domains to perform 29 HTTP transactions. The main IP is 136.243.28.94, located in Germany and belongs to HETZNER-AS, DE. The main domain is www.dosya.tc.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 12th 2023. Valid for: a year.
This is the only time www.dosya.tc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 14 136.243.28.94 24940 (HETZNER-AS)
12 139.45.197.251 9002 (RETN-AS)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 139.45.197.236 9002 (RETN-AS)
1 139.45.195.8 9002 (RETN-AS)
29 6
Apex Domain
Subdomains
Transfer
14 dosya.tc
s5.dosya.tc
www.dosya.tc
162 KB
9 phicmune.net
phicmune.net — Cisco Umbrella Rank: 453702
41 KB
3 uwoaptee.com
uwoaptee.com — Cisco Umbrella Rank: 395832
41 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
20 KB
1 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 12620
543 B
1 itskiddien.club
cdn.itskiddien.club — Cisco Umbrella Rank: 40820
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 77
344 B
29 7
Domain Requested by
13 www.dosya.tc 1 redirects www.dosya.tc
9 phicmune.net www.dosya.tc
phicmune.net
3 uwoaptee.com www.dosya.tc
uwoaptee.com
2 www.google-analytics.com www.dosya.tc
www.google-analytics.com
1 my.rtmark.net www.dosya.tc
1 cdn.itskiddien.club phicmune.net
1 stats.g.doubleclick.net www.google-analytics.com
1 s5.dosya.tc 1 redirects
29 8

This site contains links to these domains. Also see Links.

Domain
greatdexchange.com
www.facebook.com
twitter.com
www.google.com
Subject Issuer Validity Valid
*.dosya.tc
Sectigo RSA Domain Validation Secure Server CA
2023-02-12 -
2024-03-14
a year crt.sh
phicmune.net
R3
2023-01-05 -
2023-04-05
3 months crt.sh
uwoaptee.com
R3
2023-01-17 -
2023-04-17
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-02-01 -
2023-04-26
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-02-01 -
2023-04-26
3 months crt.sh
itskiddien.club
R3
2022-12-27 -
2023-03-27
3 months crt.sh
rtmark.net
R3
2023-02-15 -
2023-05-16
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Frame ID: 3B6C5BFCA5888DD7E61C2EFE5BC15C3D
Requests: 26 HTTP requests in this frame

Screenshot

Page Title

n11_satici_destek_katalog.rar dosyasını indir - download

Page URL History Show full URLs

  1. https://s5.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html HTTP 301
    http://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html HTTP 302
    https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

29
Requests

100 %
HTTPS

33 %
IPv6

7
Domains

8
Subdomains

6
IPs

3
Countries

264 kB
Transfer

571 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s5.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html HTTP 301
    http://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html HTTP 302
    https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request n11_satici_destek_katalog.rar.html
www.dosya.tc/server7/7ekyk7/
Redirect Chain
  • https://s5.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
  • http://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
  • https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
4 KB
4 KB
Document
General
Full URL
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
fc4a7d135d51e46f6cd8367d9b301621562aaa5b794d1b13176d51c73a8c3350

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=ISO-8859-9
Date
Tue, 21 Feb 2023 15:24:27 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Connection
Keep-Alive
Content-Length
254
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 21 Feb 2023 15:24:27 GMT
Keep-Alive
timeout=5, max=100
Location
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Server
Apache
style.css
www.dosya.tc/style/
14 KB
2 KB
Stylesheet
General
Full URL
https://www.dosya.tc/style/style.css
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
2b8c3599f9d693fc1422d4ad7c8fe6b9fbb2ade6b19a89c55e0d94f02252410a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Content-Encoding
gzip
Last-Modified
Fri, 07 Jun 2019 21:04:48 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2005
bootstrap.css
www.dosya.tc/style/
138 KB
21 KB
Stylesheet
General
Full URL
https://www.dosya.tc/style/bootstrap.css
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 May 2019 23:25:25 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
20804
logo.png
www.dosya.tc/images/
7 KB
7 KB
Image
General
Full URL
https://www.dosya.tc/images/logo.png
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
77eba513db8685e5a4b7633684b1d6b175bf8272ccfff3c6a1c0735d37d1d57a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Last-Modified
Tue, 28 May 2019 20:58:54 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
7157
uye-girisi.png
www.dosya.tc/images/
3 KB
3 KB
Image
General
Full URL
https://www.dosya.tc/images/uye-girisi.png
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
6bfa03e8b7d8249e9927cafe801657559f7b7064248bb970b55fb4b689611f2d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Last-Modified
Tue, 28 May 2019 20:58:56 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2979
tag.min.js
phicmune.net/pfe/current/
14 KB
6 KB
Script
General
Full URL
https://phicmune.net/pfe/current/tag.min.js?z=5030740
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
02844ede027746abacfaf8da7722140d6a28fa6cca621204d8a1c8e2ba189e4e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Feb 2023 15:24:27 GMT
content-encoding
gzip
last-modified
Mon, 20 Feb 2023 17:09:26 GMT
server
nginx
etag
W/"63f3a946-392b"
content-type
application/javascript
cache-control
no-cache
access-control-allow-credentials
true
download.gif
www.dosya.tc/images/
7 KB
7 KB
Image
General
Full URL
https://www.dosya.tc/images/download.gif
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
7964b17bc443c3bcf422211a690ac4bc62ad981d77d5c0b6bdddc982b8615a25

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Last-Modified
Tue, 28 May 2019 20:58:46 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
7229
tag.min.js
uwoaptee.com/pfe/current/
14 KB
6 KB
Script
General
Full URL
https://uwoaptee.com/pfe/current/tag.min.js?z=5030740
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
02844ede027746abacfaf8da7722140d6a28fa6cca621204d8a1c8e2ba189e4e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Feb 2023 15:24:27 GMT
content-encoding
gzip
last-modified
Mon, 20 Feb 2023 17:09:26 GMT
server
nginx
etag
W/"63f3a946-392b"
content-type
application/javascript
cache-control
no-cache
access-control-allow-credentials
true
footer-icon1.png
www.dosya.tc/images/
582 B
824 B
Image
General
Full URL
https://www.dosya.tc/images/footer-icon1.png
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
101d88dc759a5588d5c064fe233b6b19c565966a527a03eb9cdc29c733b8d4c3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Last-Modified
Tue, 28 May 2019 20:58:47 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
582
footer-icon2.png
www.dosya.tc/images/
850 B
1 KB
Image
General
Full URL
https://www.dosya.tc/images/footer-icon2.png
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
eea1befd43d3dc930a0eb0335c56ed8bc7e14aa1ee3e6c546cd21c1826362750

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Last-Modified
Tue, 28 May 2019 20:58:47 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
850
footer-icon3.png
www.dosya.tc/images/
2 KB
2 KB
Image
General
Full URL
https://www.dosya.tc/images/footer-icon3.png
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
c84a015988434d7fa0c884f5590de727799abacb9c4a4ad6b4cadea4b97ea732

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Last-Modified
Tue, 28 May 2019 20:58:47 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
1702
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 21 Feb 2023 14:14:50 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
4177
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Tue, 21 Feb 2023 16:14:50 GMT
background.webp
www.dosya.tc/images/
110 KB
110 KB
Image
General
Full URL
https://www.dosya.tc/images/background.webp
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/style/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
0804b26a6993fc6ee8e977f77aa9ce5ddf9c4fe69773b296cc292ee7b2a5ac1b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/style/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Last-Modified
Fri, 07 Jun 2019 21:04:40 GMT
Server
Apache
Content-Type
image/webp
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
112776
menu-ayrac.png
www.dosya.tc/images/
125 B
366 B
Image
General
Full URL
https://www.dosya.tc/images/menu-ayrac.png
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/style/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
9700fc9abb23b0fa04c070487f5aebdcec2cbb22f10788ab7898032abe3fcced

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/style/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:27 GMT
Last-Modified
Tue, 28 May 2019 20:58:55 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
125
zone
phicmune.net/
930 B
1 KB
Fetch
General
Full URL
https://phicmune.net/zone?pub=0&zone_id=5030740&is_mobile=false&domain=www.dosya.tc&var=&ymid=&var_3=
Requested by
Host: phicmune.net
URL: https://phicmune.net/pfe/current/tag.min.js?z=5030740
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
056f62f3f89568a0743202361a2ad6c661bb20b659c48ce87e6e8390005c5545
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-trace-id
e9d69a0b2d47416637a38fcc0fd396e3
date
Tue, 21 Feb 2023 15:24:27 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.dosya.tc
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
930
universal.min.js
phicmune.net/pfe/current/
100 KB
33 KB
Fetch
General
Full URL
https://phicmune.net/pfe/current/universal.min.js?v=3.1.421
Requested by
Host: phicmune.net
URL: https://phicmune.net/pfe/current/tag.min.js?z=5030740
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4fae4f9e4a1f3625a9a91ee7d7176a837cc81f1048be43dda2701d349e1d729f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Feb 2023 15:24:28 GMT
content-encoding
gzip
last-modified
Mon, 20 Feb 2023 17:09:26 GMT
server
nginx
etag
W/"63f3a946-19090"
content-type
application/javascript
access-control-allow-origin
https://www.dosya.tc
cache-control
no-cache
access-control-allow-credentials
true
collect
www.google-analytics.com/j/
4 B
207 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&a=15450681&t=pageview&_s=1&dl=https%3A%2F%2Fwww.dosya.tc%2Fserver7%2F7ekyk7%2Fn11_satici_destek_katalog.rar.html&ul=en-us&de=windows-1254&dt=n11_satici_destek_katalog.rar%20dosyas%C4%B1n%C4%B1%20indir%20-%20download&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1847412316&gjid=1666167579&cid=1556509663.1676993068&tid=UA-60205436-1&_gid=1083028209.1676993068&_r=1&_slc=1&z=1038633309
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.dosya.tc/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 21 Feb 2023 15:24:28 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.dosya.tc
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
zone
uwoaptee.com/
930 B
1 KB
Fetch
General
Full URL
https://uwoaptee.com/zone?pub=0&zone_id=5030740&is_mobile=false&domain=www.dosya.tc&var=&ymid=&var_3=
Requested by
Host: uwoaptee.com
URL: https://uwoaptee.com/pfe/current/tag.min.js?z=5030740
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
056f62f3f89568a0743202361a2ad6c661bb20b659c48ce87e6e8390005c5545
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-trace-id
31a5b259592a34d020a0055f2bbdcf57
date
Tue, 21 Feb 2023 15:24:28 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.dosya.tc
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
930
universal.min.js
uwoaptee.com/pfe/current/
100 KB
33 KB
Fetch
General
Full URL
https://uwoaptee.com/pfe/current/universal.min.js?v=3.1.421
Requested by
Host: uwoaptee.com
URL: https://uwoaptee.com/pfe/current/tag.min.js?z=5030740
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4fae4f9e4a1f3625a9a91ee7d7176a837cc81f1048be43dda2701d349e1d729f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Feb 2023 15:24:28 GMT
content-encoding
gzip
last-modified
Mon, 20 Feb 2023 17:09:26 GMT
server
nginx
etag
W/"63f3a946-19090"
content-type
application/javascript
access-control-allow-origin
https://www.dosya.tc
cache-control
no-cache
access-control-allow-credentials
true
collect
stats.g.doubleclick.net/j/
1 B
344 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-60205436-1&cid=1556509663.1676993068&jid=1847412316&gjid=1666167579&_gid=1083028209.1676993068&_u=IEBAAEAAAAAAACAAI~&z=1533041836
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.dosya.tc/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 21 Feb 2023 15:24:28 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.dosya.tc
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
apu.php
cdn.itskiddien.club/
0
0
Script
General
Full URL
https://cdn.itskiddien.club/apu.php?zoneid=5426561
Requested by
Host: phicmune.net
URL: https://phicmune.net/pfe/current/tag.min.js?z=5030740
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

custom
phicmune.net/
0
0
Preflight
General
Full URL
https://phicmune.net/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.dosya.tc
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://www.dosya.tc
access-control-max-age
86400
content-length
0
content-type
text/plain; charset=utf-8
date
Tue, 21 Feb 2023 15:24:28 GMT
server
nginx
custom
phicmune.net/
39 B
323 B
Fetch
General
Full URL
https://phicmune.net/custom
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://www.dosya.tc/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
application/json

Response headers

x-trace-id
c3e5e9463ca4f8706ece4621ae1837b0
date
Tue, 21 Feb 2023 15:24:28 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.dosya.tc
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
39
sw.js
www.dosya.tc/
5 KB
3 KB
Fetch
General
Full URL
https://www.dosya.tc/sw.js
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
136.243.28.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server.dosya.tc
Software
Apache /
Resource Hash
0cbff0e4787baf4226fcb00db27c8f608a7feede7ebea3552c5f35e7f269334e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 15:24:28 GMT
Content-Encoding
gzip
Last-Modified
Mon, 18 Apr 2022 10:12:28 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
2381
custom
phicmune.net/
0
0
Preflight
General
Full URL
https://phicmune.net/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.dosya.tc
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://www.dosya.tc
access-control-max-age
86400
content-length
0
content-type
text/plain; charset=utf-8
date
Tue, 21 Feb 2023 15:24:28 GMT
server
nginx
custom
phicmune.net/
39 B
323 B
Fetch
General
Full URL
https://phicmune.net/custom
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://www.dosya.tc/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
application/json

Response headers

x-trace-id
48e7d66055b3502daedab78c0bef8c6e
date
Tue, 21 Feb 2023 15:24:28 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.dosya.tc
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
39
gid.js
my.rtmark.net/
65 B
543 B
Fetch
General
Full URL
https://my.rtmark.net/gid.js?pub=0&userId=8578ebb2b03944b895d32afd538ec6e0&zoneId=5030740&checkDuplicate=true&ymid=&var=
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
83d408e3464b89dd9267df34c3619132206516260a395aecd900fcd15c998931
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.dosya.tc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Tue, 21 Feb 2023 15:24:28 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.dosya.tc
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
custom
phicmune.net/
39 B
323 B
Fetch
General
Full URL
https://phicmune.net/custom
Requested by
Host: www.dosya.tc
URL: https://www.dosya.tc/server7/7ekyk7/n11_satici_destek_katalog.rar.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://www.dosya.tc/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type
application/json

Response headers

x-trace-id
57521b6a89b8905f72b4540dd824baed
date
Tue, 21 Feb 2023 15:24:28 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.dosya.tc
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
39
custom
phicmune.net/
0
0
Preflight
General
Full URL
https://phicmune.net/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.dosya.tc
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://www.dosya.tc
access-control-max-age
86400
content-length
0
content-type
text/plain; charset=utf-8
date
Tue, 21 Feb 2023 15:24:28 GMT
server
nginx

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange string| GoogleAnalyticsObject function| ga object| zfgformats object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| sdk boolean| installOnFly boolean| zfgloadedpush boolean| zfgloadedpushopt boolean| zfgloadedpushcode

4 Cookies

Domain/Path Name / Value
.dosya.tc/ Name: _ga
Value: GA1.2.1556509663.1676993068
.dosya.tc/ Name: _gid
Value: GA1.2.1083028209.1676993068
.dosya.tc/ Name: _gat
Value: 1
my.rtmark.net/ Name: ID
Value: 8578ebb2b03944b895d32afd538ec6e0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.itskiddien.club
my.rtmark.net
phicmune.net
s5.dosya.tc
stats.g.doubleclick.net
uwoaptee.com
www.dosya.tc
www.google-analytics.com
136.243.28.94
139.45.195.8
139.45.197.236
139.45.197.251
2a00:1450:4001:82f::200e
2a00:1450:400c:c09::9c
02844ede027746abacfaf8da7722140d6a28fa6cca621204d8a1c8e2ba189e4e
056f62f3f89568a0743202361a2ad6c661bb20b659c48ce87e6e8390005c5545
0804b26a6993fc6ee8e977f77aa9ce5ddf9c4fe69773b296cc292ee7b2a5ac1b
0cbff0e4787baf4226fcb00db27c8f608a7feede7ebea3552c5f35e7f269334e
101d88dc759a5588d5c064fe233b6b19c565966a527a03eb9cdc29c733b8d4c3
2b8c3599f9d693fc1422d4ad7c8fe6b9fbb2ade6b19a89c55e0d94f02252410a
4fae4f9e4a1f3625a9a91ee7d7176a837cc81f1048be43dda2701d349e1d729f
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bfa03e8b7d8249e9927cafe801657559f7b7064248bb970b55fb4b689611f2d
77eba513db8685e5a4b7633684b1d6b175bf8272ccfff3c6a1c0735d37d1d57a
7964b17bc443c3bcf422211a690ac4bc62ad981d77d5c0b6bdddc982b8615a25
83d408e3464b89dd9267df34c3619132206516260a395aecd900fcd15c998931
9700fc9abb23b0fa04c070487f5aebdcec2cbb22f10788ab7898032abe3fcced
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
c84a015988434d7fa0c884f5590de727799abacb9c4a4ad6b4cadea4b97ea732
c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eea1befd43d3dc930a0eb0335c56ed8bc7e14aa1ee3e6c546cd21c1826362750
fc4a7d135d51e46f6cd8367d9b301621562aaa5b794d1b13176d51c73a8c3350
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881