secure.helpscout.net
Open in
urlscan Pro
52.86.112.183
Public Scan
Effective URL: https://secure.helpscout.net/members/authorize?jump=http%3A%2F%2Fsupport.x2ai.com%2Fauthorize%3FsiteId%3D5cfe880f04286333a264...
Submission: On July 24 via automatic, source certstream-suspicious — Scanned from US
Summary
TLS certificate: Issued by DigiCert EV RSA CA G2 on January 2nd 2024. Valid for: a year.
This is the only time secure.helpscout.net was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.196.242.26 54.196.242.26 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 52.86.112.183 52.86.112.183 | 14618 (AMAZON-AES) (AMAZON-AES) | |
6 | 108.139.38.105 108.139.38.105 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:80e::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c1b::54 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.251.40.130 142.251.40.130 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2600:9000:23c... 2600:9000:23ca:8800:13:cdcc:77c0:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 142.250.65.162 142.250.65.162 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:80b::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.80.36 142.250.80.36 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2607:f8b0:400... 2607:f8b0:4006:816::200e | 15169 (GOOGLE) (GOOGLE) | |
19 | 11 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-196-242-26.compute-1.amazonaws.com
support.x2ai.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-86-112-183.compute-1.amazonaws.com
secure.helpscout.net |
ASN16509 (AMAZON-02, US)
PTR: server-108-139-38-105.jfk50.r.cloudfront.net
dhmmnd775wlnp.cloudfront.net |
ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net
www.googleadservices.com |
ASN16509 (AMAZON-02, US)
d2qapr080mx9b.cloudfront.net |
ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f2.1e100.net
googleads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f4.1e100.net
www.google.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
cloudfront.net
dhmmnd775wlnp.cloudfront.net d2qapr080mx9b.cloudfront.net |
1 MB |
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 104 |
22 KB |
2 |
google.com
accounts.google.com — Cisco Umbrella Rank: 46 www.google.com — Cisco Umbrella Rank: 10 |
84 KB |
1 |
gstatic.com
fonts.gstatic.com |
16 KB |
1 |
doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 77 |
1 KB |
1 |
googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 176 |
21 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110 |
1002 B |
1 |
helpscout.net
secure.helpscout.net — Cisco Umbrella Rank: 85571 |
12 KB |
1 |
x2ai.com
1 redirects
support.x2ai.com |
564 B |
19 | 9 |
Domain | Requested by | |
---|---|---|
6 | dhmmnd775wlnp.cloudfront.net |
secure.helpscout.net
dhmmnd775wlnp.cloudfront.net |
3 | www.google-analytics.com |
d2qapr080mx9b.cloudfront.net
www.google-analytics.com |
3 | d2qapr080mx9b.cloudfront.net |
secure.helpscout.net
|
1 | www.google.com |
secure.helpscout.net
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | googleads.g.doubleclick.net |
www.googleadservices.com
|
1 | www.googleadservices.com |
secure.helpscout.net
|
1 | accounts.google.com |
secure.helpscout.net
|
1 | fonts.googleapis.com |
secure.helpscout.net
|
1 | secure.helpscout.net | |
1 | support.x2ai.com | 1 redirects |
19 | 11 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.helpscout.com |
www.whatbrowser.org |
www.google.com |
www.firefox.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.helpscout.com DigiCert EV RSA CA G2 |
2024-01-02 - 2025-02-01 |
a year | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2023-10-10 - 2024-09-19 |
a year | crt.sh |
upload.video.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
accounts.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.googleadservices.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.g.doubleclick.net WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.google-analytics.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://secure.helpscout.net/members/authorize?jump=http%3A%2F%2Fsupport.x2ai.com%2Fauthorize%3FsiteId%3D5cfe880f04286333a264622c
Frame ID: 447EB90E41A161D152F6675B71B21853
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
Help Scout - Log InPage URL History Show full URLs
-
https://support.x2ai.com/
HTTP 303
https://secure.helpscout.net/members/authorize?jump=http%3A%2F%2Fsupport.x2ai.com%2Fauthorize%3FsiteId%3D... Page URL
Detected technologies
Google Sign-in (Social logins) ExpandDetected patterns
- accounts\.google\.com/gsi/client
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Try Help Scout
Search URL Search Domain Scan URL
Title: Upgrade
Search URL Search Domain Scan URL
Title: Google Chrome
Search URL Search Domain Scan URL
Title: Firefox
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://support.x2ai.com/
HTTP 303
https://secure.helpscout.net/members/authorize?jump=http%3A%2F%2Fsupport.x2ai.com%2Fauthorize%3FsiteId%3D5cfe880f04286333a264622c Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
authorize
secure.helpscout.net/members/ Redirect Chain
|
24 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
onboarding.css
dhmmnd775wlnp.cloudfront.net/443bcff770/css/newBrand/ |
710 KB 294 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pre-global-4d1f12f182549561710e.js
dhmmnd775wlnp.cloudfront.net/443bcff770/js/apps/dist/ |
103 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 1002 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client
accounts.google.com/gsi/ |
221 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chat-reports.png
dhmmnd775wlnp.cloudfront.net/443bcff770/images/login/ |
26 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
conversion.js
www.googleadservices.com/pagead/ |
57 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors-d7f0d31e95bc5345fb7a.js
d2qapr080mx9b.cloudfront.net/main/hs-app/ |
2 MB 396 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2fa~apps~authentication~beacons~custom-fields~customers~dashboard~docs~docs-settings~docs-setup~edit~182be7e5-ef43167cb84f19e36dd1.js
d2qapr080mx9b.cloudfront.net/main/hs-app/ |
202 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-67ceb1591ff06cc067ff.js
d2qapr080mx9b.cloudfront.net/main/hs-app/ |
92 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
207 KB 207 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AktivGrotesk_W_Bd.woff2
dhmmnd775wlnp.cloudfront.net/443bcff770/fonts/webfonts/aktiv/ |
160 KB 161 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/971521024/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AktivGrotesk_W_Md.woff2
dhmmnd775wlnp.cloudfront.net/443bcff770/fonts/webfonts/aktiv/ |
165 KB 166 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
20 KB 20 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.google.com/pagead/1p-user-list/971521024/ |
42 B 64 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
linkid.js
www.google-analytics.com/plugins/ua/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
3 B 211 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
dhmmnd775wlnp.cloudfront.net/443bcff770/images/ |
17 KB 17 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
60 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| jsResourceBaseUrl string| c function| $ function| jQuery string| timezone object| hsGlobal object| bx object| google_tag_data function| GooglemKTybQhCsO number| google_conversion_snippets number| google_conversion_first_time object| webpackJsonp object| Mousetrap object| jQuery18303057042541623207 function| noty object| __core-js_shared__ function| SelectParser function| AbstractChosen function| get_side_border_padding object| HS function| Pusher object| PusherClient function| moment function| _ function| _str object| Handlebars object| Backbone object| Marionette object| Cocktail string| GoogleAnalyticsObject function| ga function| setGAData object| client function| doGoogleSignIn function| onSignIn object| emailField object| passwordInput object| logInButton object| loginForm object| passwordContainer object| signInChangeLink object| googleButton object| orSection object| forgotPasswordLink object| rememberMeContainer function| getCookie function| isSamlLogin function| samlCheck function| setSamlLoginCookie function| showFormWithEmailAndPassword function| showFormWithEmailOnly function| showingEmailOnlySsoLoginForm function| keepAlive object| default_gsi object| _F_toggles object| google object| closure_lm_473013 object| gaplugins object| gaGlobal object| gaData6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
support.x2ai.com/ | Name: PLAY_SESSION Value: "79fa21795c456d03e554f19b6fdb6cadecfddab2-siteId=5cfe880f04286333a264622c&hs.session.id=IinLcCkayFn2qTHnyCOuqDi8RiLDwcjl4gWMOMaQmSC8Yg45emDg5Dbq0sEo926X&hs.session.exp=1721902143831&hs.session.redirect=%2F" |
|
secure.helpscout.net/ | Name: PHPSESSID Value: 272c67646885989afb35dac8a04cb997 |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
.helpscout.net/ | Name: _ga Value: GA1.2.1561937232.1721815745 |
|
.helpscout.net/ | Name: _gid Value: GA1.2.220155886.1721815745 |
|
.helpscout.net/ | Name: _gat Value: 1 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'none'; connect-src 'self' 'unsafe-inline' app.getsentry.com *.sentry.io *.mixpanel.com https://grsm.io https://*.visualwebsiteoptimizer.com https://*.clarity.ms https://*.pusher.com *.olark.com olark-file-uploads.s3-us-west-1.amazonaws.com wss://ws-helpscout.pusher.com:* *.wistia.com *.wistia.net *.akamaihd.net fg8vvsvnieiv3ej16jby.litix.io https://sentry.io https://www.google-analytics.com https://*.doubleclick.net https://bat.bing.com https://web.delighted.com *.facebook.com https://accounts.google.com/gsi/ *.hsenv.io/* *.hs-app-ui.pages.dev/* translate.googleapis.com docsapi.helpscout.net https://*.browser-intake-datadoghq.com stream.secure.helpscout.net d3hb14vkzrxvla.cloudfront.net helpscout.helpscoutdocs.com beaconapi.helpscout.net chatapi.helpscout.net *.helpscout.workers.dev; child-src 'self' blob: *.google.com fast.wistia.com fast.wistia.net *.g.doubleclick.net player.vimeo.com *.olark.com www.youtube.com www.loom.com share.getcloudapp.com https://accounts.google.com/gsi/ beacon-v2.helpscout.net; font-src 'self' 'unsafe-inline' data: fonts.gstatic.com d12wqas9hcki3z.cloudfront.net *.wistia.com *.wistia.net dhmmnd775wlnp.cloudfront.net; img-src * data: 'self' cid:; media-src 'self' 'unsafe-inline' 'self' blob: 'self' data: *.akamaihd.net embed.wistia.com embed-ssl.wistia.com *.olark.com *.wistia.com d33v4339jhl8k0.cloudfront.net dhmmnd775wlnp.cloudfront.net beacon-v2.helpscout.net; object-src 'self' www.youtube.com beacon-v2.helpscout.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.getdrip.com *.optimizely.com t.co www.google-analytics.com *.google.com https://accounts.google.com/gsi/client ajax.googleapis.com www.googleadservices.com www.googletagmanager.com www.gstatic.com *.g.doubleclick.net https://*.pusher.com cdn.mxpnl.com https://snippet.growsumo.com https://*.visualwebsiteoptimizer.com https://*.clarity.ms js.hs-scripts.com js.hs-analytics.net js.hs-banner.com fast.wistia.com fast.wistia.net src.litix.io fg8vvsvnieiv3ej16jby.litix.io *.olark.com sentry.io app.getsentry.com connect.facebook.net signin.infusionsoft.com ct.capterra.com https://bat.bing.com https://*.licdn.com https://*.linkedin.com https://www.redditstatic.com d2yyd1h5u9mauk.cloudfront.net *.hsenv.io/* *.hs-app-ui.pages.dev/* https://d2qapr080mx9b.cloudfront.net dhmmnd775wlnp.cloudfront.net translate.googleapis.com d12wqas9hcki3z.cloudfront.net d33v4339jhl8k0.cloudfront.net beacon-v2.helpscout.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com *.olark.com https://accounts.google.com/gsi/style dhmmnd775wlnp.cloudfront.net translate.googleapis.com d12wqas9hcki3z.cloudfront.net beacon-v2.helpscout.net; frame-src 'self' blob: *.google.com fast.wistia.com fast.wistia.net *.g.doubleclick.net player.vimeo.com *.olark.com www.youtube.com www.loom.com share.getcloudapp.com https://accounts.google.com/gsi/ beacon-v2.helpscout.net; worker-src blob: https://hs-app.local.hsenv.io https://secure.helpscout.net |
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.google.com
d2qapr080mx9b.cloudfront.net
dhmmnd775wlnp.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
secure.helpscout.net
support.x2ai.com
www.google-analytics.com
www.google.com
www.googleadservices.com
108.139.38.105
142.250.65.162
142.250.80.36
142.251.40.130
2600:9000:23ca:8800:13:cdcc:77c0:21
2607:f8b0:4004:c1b::54
2607:f8b0:4006:80b::2003
2607:f8b0:4006:80e::200a
2607:f8b0:4006:816::200e
52.86.112.183
54.196.242.26
059fa1c8a658bf4d8fd337ce9328f42e27d5db90ab44f167fb18c384cfe9d1f5
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
3282d7389c8bc9aa2ce6bd37ba1a33455334293fa17bd2cfd7308af62fcccd34
458668f28afb4312269f042c3262084882aa40e38bd9d8d0a30d5500bad08fe5
4d4fa720594518a9dee35de52d8d82fa222721bf4619f5bd98835d942cc59e3b
518140e43be551afc0a37ad5933c6843da59a5758f594c44a727bd945152e5e1
57585e46a658357d4476492fe4fd7ff0933746222d3c5443f586279c476703c5
5823aa82628c43a7dc6f86cc8bb83893853e42517023fb70b3306d8969f48138
69e6932c376da6a91060a828b1368fc03674317d449fc34611e57a265f853bed
8285284b52069d42d4bbcbde5fed84d235a3dc675925de936347e45e6a019b93
87e71d7cf200d2e983f42c12458d78055e0fe9b1adf0f11f38ddc1e4c95350b6
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
983e94189e3c56c7ab5a755f5c515622ed5d33a48d7aad6c511849ec04b15011
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
bf85983cb3975a68fdcda6564e37cb802d0167221b83940c1f10c5f5a68544ea
c92b04194b91aa2133fbef33ef0abcecf44e450474602d1e0dc348919c5851df
d8d622af7c58a31a2672b8661a1634e58cc38eac1677ccc44632203dd7dcab94
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e6c9b66754a4cd7eaf5bcd046420cd4de6b3efd658cf4ad6a68d0695643a71e6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f500ec860ae222c2a8f8a06fbe2e6b713dd3d12bd4554fabee199ffd0918624e