urlscan.io logo urlscan.io
SecurityTrails logo

aktifkanpayla4terr.real-resmi.com Open in urlscan Pro
2606:4700:3034::6815:f7f  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://aktifkanpayla4terr.real-resmi.com/
Effective URL: https://aktifkanpayla4terr.real-resmi.com/
Submission: On November 08 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 16 IPs in 4 countries across 14 domains to perform 27 HTTP transactions. The main IP is 2606:4700:3034::6815:f7f, located in United States and belongs to CLOUDFLARENET, US. The main domain is aktifkanpayla4terr.real-resmi.com.
TLS certificate: Issued by WE1 on September 16th 2024. Valid for: 3 months.
This is the only time aktifkanpayla4terr.real-resmi.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DANA (Financial)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 172.67.69.29 13335 (CLOUDFLAR...)
1 104.18.11.207 13335 (CLOUDFLAR...)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 184.24.77.59 20940 (AKAMAI-ASN1)
4 184.24.77.60 20940 (AKAMAI-ASN1)
2 135.181.63.70 24940 (HETZNER-AS)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a02:ec80:300... 14907 (WIKIMEDIA)
1 45.60.154.227 19551 (INCAPSULA)
1 2a00:1450:400... 15169 (GOOGLE)
1 34.36.71.3 396982 (GOOGLE-CL...)
1 104.17.24.14 13335 (CLOUDFLAR...)
1 216.58.212.131 15169 (GOOGLE)
27 16
1    2606:4700:3034::6815:f7f (United States)

ASN13335 (CLOUDFLARENET, US)
aktifkanpayla4terr.real-resmi.com
1    172.67.69.29 (United States)

ASN13335 (CLOUDFLARENET, US)
code.ionicframework.com
1    104.18.11.207 (None, )

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
6    2606:4700::6812:bb1f (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
1    2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    184.24.77.59 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-24-77-59.deploy.static.akamaitechnologies.com
www.dana.id
4    184.24.77.60 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-24-77-60.deploy.static.akamaitechnologies.com
a.m.dana.id
2    135.181.63.70 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: cdn15.top4top.io
l.top4top.io
2    2a00:1450:4001:81d::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
encrypted-tbn0.gstatic.com
1    2a02:ec80:300:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)
upload.wikimedia.org
1    45.60.154.227 (United States)

ASN19551 (INCAPSULA, US)
assets.bukalapak.com
1    2a00:1450:4001:81d::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
blogger.googleusercontent.com
1    34.36.71.3 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 3.71.36.34.bc.googleusercontent.com
infobanknews.com
1    104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    216.58.212.131 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f3.1e100.net
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
6 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 311
49 KB
5 dana.id
www.dana.id — Cisco Umbrella Rank: 186628
a.m.dana.id — Cisco Umbrella Rank: 50012
570 KB
3 gstatic.com
encrypted-tbn0.gstatic.com
fonts.gstatic.com
64 KB
2 top4top.io
l.top4top.io
333 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
28 KB
1 infobanknews.com
infobanknews.com
16 KB
1 googleusercontent.com
blogger.googleusercontent.com — Cisco Umbrella Rank: 10512
78 KB
1 bukalapak.com
assets.bukalapak.com — Cisco Umbrella Rank: 344482
9 KB
1 wikimedia.org
upload.wikimedia.org — Cisco Umbrella Rank: 3371
124 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30
2 KB
1 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1113
20 KB
1 ionicframework.com
code.ionicframework.com — Cisco Umbrella Rank: 20162
9 KB
1 real-resmi.com
aktifkanpayla4terr.real-resmi.com
4 KB
0 mwebs.id Failed
e-formulir.mwebs.id Failed
27 14
Domain Requested by
6 cdn.jsdelivr.net aktifkanpayla4terr.real-resmi.com
cdn.jsdelivr.net
4 a.m.dana.id aktifkanpayla4terr.real-resmi.com
2 encrypted-tbn0.gstatic.com aktifkanpayla4terr.real-resmi.com
2 l.top4top.io aktifkanpayla4terr.real-resmi.com
1 fonts.gstatic.com fonts.googleapis.com
1 cdnjs.cloudflare.com aktifkanpayla4terr.real-resmi.com
1 infobanknews.com aktifkanpayla4terr.real-resmi.com
1 blogger.googleusercontent.com aktifkanpayla4terr.real-resmi.com
1 assets.bukalapak.com aktifkanpayla4terr.real-resmi.com
1 upload.wikimedia.org aktifkanpayla4terr.real-resmi.com
1 www.dana.id aktifkanpayla4terr.real-resmi.com
1 fonts.googleapis.com aktifkanpayla4terr.real-resmi.com
1 maxcdn.bootstrapcdn.com aktifkanpayla4terr.real-resmi.com
1 code.ionicframework.com aktifkanpayla4terr.real-resmi.com
1 aktifkanpayla4terr.real-resmi.com
0 e-formulir.mwebs.id Failed aktifkanpayla4terr.real-resmi.com
27 16

This site contains no links.

Subject Issuer Validity Valid
real-resmi.com
WE1		 2024-09-16 -
2024-12-15		 3 months crt.sh
ionicframework.com
WE1		 2024-09-10 -
2024-12-09		 3 months crt.sh
bootstrapcdn.com
WE1		 2024-09-20 -
2024-12-19		 3 months crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA		 2024-05-04 -
2025-05-04		 a year crt.sh
upload.video.google.com
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
www.dana.id
DigiCert TLS RSA SHA256 2020 CA1		 2024-06-09 -
2025-06-11		 a year crt.sh
a.m.dana.id
DigiCert TLS RSA SHA256 2020 CA1		 2024-06-09 -
2025-06-11		 a year crt.sh
*.top4top.co
R10		 2024-08-29 -
2024-11-27		 3 months crt.sh
*.gstatic.com
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
*.wikipedia.org
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2024-09-26 -
2025-10-17		 a year crt.sh
imperva.com
GlobalSign Atlas R3 DV TLS CA 2024 Q4		 2024-11-07 -
2025-05-06		 6 months crt.sh
*.googleusercontent.com
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
infobanknews.com
Sectigo RSA Domain Validation Secure Server CA		 2024-01-22 -
2025-01-22		 a year crt.sh
cdnjs.cloudflare.com
WE1		 2024-09-28 -
2024-12-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://aktifkanpayla4terr.real-resmi.com/
Frame ID: 3246A7131F077876F7322C35643DC8E7
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

𝗗𝗔𝗡𝗔 𝗜𝗗 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔

Page URL History Show full URLs

  1. http://aktifkanpayla4terr.real-resmi.com/ HTTP 307
    https://aktifkanpayla4terr.real-resmi.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /_nuxt/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+ionicons(?:\.min)?\.css
Overall confidence: 100%
Detected patterns
  • <link [^>]+(?:/([\d.]+)/)?slick-theme\.css
  • (?:/([\d.]+))?/slick(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

27
Requests

93 %
HTTPS

40 %
IPv6

14
Domains

16
Subdomains

16
IPs

4
Countries

1308 kB
Transfer

1705 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://aktifkanpayla4terr.real-resmi.com/ HTTP 307
    https://aktifkanpayla4terr.real-resmi.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
aktifkanpayla4terr.real-resmi.com/
Redirect Chain
  • http://aktifkanpayla4terr.real-resmi.com/
  • https://aktifkanpayla4terr.real-resmi.com/
13 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:f7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb49455c858ed39b0cc791b8fe44ca839061b73f77b8d08f681c41539a2e9bc0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8df213a75c45975c-FRA
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Fri, 08 Nov 2024 02:19:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F0BOivLHUkIl86RqiL0Mph9ndbKDNEDncce9PdayaNVkD%2BFrO03mAfwdzrE%2B2Hj%2BjkJ462j5Rs0q0ACqW8Hj8k4i1JMLTszo3EMTUaY%2FbwzsWx9QlDe6vublnGXhI2KY6Vqzu1DIAwX8nZHPbsdGepnO8a6z324iWcmSKKKMFos%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=6253&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3948&recv_bytes=2333&delivery_rate=590440&cwnd=253&unsent_bytes=0&cid=f228b6935451f6dd&ts=39&x=0"

Redirect headers

Location
https://aktifkanpayla4terr.real-resmi.com/
Non-Authoritative-Reason
HttpsUpgrades
ionicons.min.css
code.ionicframework.com/ionicons/2.0.1/css/ 		50 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://code.ionicframework.com/ionicons/2.0.1/css/ionicons.min.css
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.69.29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92ac508220f5bb60ec94e07650528eb66625f82a4740ada068cde05365781286
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

x-fastly-request-id
70a4914cb4a9e421373d2d38bef2d5e02bafee58
content-encoding
gzip
cf-cache-status
HIT
etag
W/"64382bc3-c854"
age
520145
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U0uy3S%2BYz6D0v1khUVd6%2Fl%2Fl97jXOCtJ8nVIGjokTncgEdKy2QkiYEckbK88EnO%2FpiJ5a5aPDNpltE0DbFnJuouP7cyNdotyNyIDN8ayfqG5n6zfY9%2FQoYvdruoOWUFTcArsxC1kq7Qf"}],"group":"cf-nel","max_age":604800}
x-github-request-id
F078:0DDF:4AF707B:4CF64F1:6717C5C0
x-content-type-options
nosniff
expires
Tue, 22 Oct 2024 15:43:20 GMT
x-proxy-cache
MISS
alt-svc
h3=":443"; ma=86400
x-cache
HIT
server-timing
cfL4;desc="?proto=QUIC&rtt=8651&sent=13&recv=9&lost=0&retrans=0&sent_bytes=4294&recv_bytes=4395&delivery_rate=61388&cwnd=12000&unsent_bytes=0&cid=b8052806ad568fd1&ts=24&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 08 Nov 2024 02:19:11 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-eddf8230026-FRA
x-cache-hits
1
last-modified
Thu, 13 Apr 2023 16:20:19 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15552000
cache-control
max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer
S1730512206.069880,VS0,VE1
via
1.1 varnish
cf-ray
8df213a7cb96d3b1-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
8313
x-origin-cache
HIT
server
cloudflare
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/ 		120 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"5d5357cb3704e1f43a1f5bfed2aebf42"
age
13475
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
date
Fri, 08 Nov 2024 02:19:11 GMT
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
09/24/2024 09:01:20
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
0
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
be3cdb711ac6e4b7cbce0289a62d0d3e
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8df213a7bafcd2a1-FRA
access-control-allow-origin
*
cdn-edgestorageid
1070
server
cloudflare
cdn-requestcountrycode
US
slick.css
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ 		2 KB
873 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.css
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"6f0-qUoFmzF4tK3sCeMoGs4oGaMAlaQ"
age
1331667
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D4fhHSKBMPXbOZtuDRkt0E9oS%2BVAQy1YgTFFgstFHHYwzhASFlEPeCw2nJZlNXee1y7a3A7uehBQaGMZezjPJuXnqXD1AuYq7FRBfVSfOvu0v5GPRPLv%2B%2FwFYbOJdg%2Bx4ibyGQnI%2BwlZg40D9hc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Fri, 08 Nov 2024 02:19:11 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-etou8220022-FRA, cache-lga21947-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8df213a7dbb72bee-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
484
server
cloudflare
x-jsd-version
1.8.1
slick-theme.css
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.css
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7adaf08052c6a6a0f8a0d0055b4f191fd07389fe41c972b69573472b2ecb406a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"c49-gaQ0+U8rESTzIyu4bylE+C+yOsA"
age
536231
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=69bkpPPWQOPr3drZ1SUXxlXLwnOEtsUhXy81a8EcG3zLokZeTkTRjO%2FWP4xS16nDFvX%2FN4%2Bz%2BcYwwOqfcqgPPf6uurfKZ8RR7LzBUNG1E6YGqmy3aXpbyiFvx5GLco8D0uvwV0AhRqkUVJzUJew%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Fri, 08 Nov 2024 02:19:11 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-eddf8230023-FRA, cache-lga21940-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8df213a7dbb92bee-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
928
server
cloudflare
x-jsd-version
1.8.1
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/ 		189 KB
30 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/bootstrap.min.css
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb1763b59f9f5764294b5af9fa5250835ae608282fe6f2f2213a5952aacf1fbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://aktifkanpayla4terr.real-resmi.com
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"2f3f9-YnOsGiPXmhIvAi9qh8W3XCz6/Do"
age
229988
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DGrFbqF9OW0ggvICtq4EDOF3uFin%2Fxp412pDZJFWIVAs%2FN0dUmBHApxvpaBnF5rdt2AYwpzb1Zf64UbGGnWc6oFZdQmn6XdqArtvNmgLAWTfOdGGV19kZcwzSaOHHia%2B%2FYZfnxaO5%2FRiY%2Fdul64%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Fri, 08 Nov 2024 02:19:11 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-etou8220113-FRA, cache-lga21987-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8df213a7df4ed2de-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
30281
server
cloudflare
x-jsd-version
5.2.0-beta1
css2
fonts.googleapis.com/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Open+Sans:wght@500&display=swap
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0ebabf46b3de75a736d3a82319edd773168c1c664bf2b76f81f760567f598fea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 08 Nov 2024 02:19:11 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 08 Nov 2024 02:19:11 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Fri, 08 Nov 2024 01:49:23 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
dana-logo.fe46647.png
www.dana.id/_nuxt/img/ 		12 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.dana.id/_nuxt/img/dana-logo.fe46647.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.77.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-24-77-59.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c67e5431f9c00bb690ea8b8add63d5ca9250bf2925f2c2a691eeee498ac75853
Security Headers
Name Value
Content-Security-Policy default-src 'self';frame-src *.google.com *.youtube.com a.m.dana.id bytedance: sslocal:;img-src https: 'self' data: a.m.dana.id analytics.tiktok.com;style-src 'self' 'unsafe-inline' *.dana.id fonts.googleapis.com *;media-src 'self' *.dana.id blob:;font-src 'self' *.dana.id data: fonts.gstatic.com;script-src 'self' 'unsafe-eval' 'unsafe-inline' *.dana.id app.link cdn.lr-ingest.io cdnjs.cloudflare.com *.google-analytics.com cdn.jsdelivr.net static.cloudflareinsights.com googletagmanager.com *.googletagmanager.com *.google.com *.gstatic.com *.cloudflare.com unpkg.com *.go-mpulse.net analytics.tiktok.com;connect-src 'self' dana.test *.dana.id *.branch.io *.zendesk.com *.google-analytics.com r.lr-ingest.io stats.g.doubleclick.net *.instagram.com *.googleusercontent.com *.google.com *.gstatic.com blob: analytics.tiktok.com;worker-src 'self' data: blob:;form-action 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0, 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

etag
W/"31f2-18c44d19c88"
expect-ct
max-age=0
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff, nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=63, origin; dur=0, ak_p; desc="1731032352061_389467987_43660232_6351_14588_17_89_219";dur=1
x-ua-compatible
IE=Edge
date
Fri, 08 Nov 2024 02:19:12 GMT
content-type
image/png
last-modified
Thu, 07 Dec 2023 15:07:17 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
default-src 'self';frame-src *.google.com *.youtube.com a.m.dana.id bytedance: sslocal:;img-src https: 'self' data: a.m.dana.id analytics.tiktok.com;style-src 'self' 'unsafe-inline' *.dana.id fonts.googleapis.com *;media-src 'self' *.dana.id blob:;font-src 'self' *.dana.id data: fonts.gstatic.com;script-src 'self' 'unsafe-eval' 'unsafe-inline' *.dana.id app.link cdn.lr-ingest.io cdnjs.cloudflare.com *.google-analytics.com cdn.jsdelivr.net static.cloudflareinsights.com googletagmanager.com *.googletagmanager.com *.google.com *.gstatic.com *.cloudflare.com unpkg.com *.go-mpulse.net analytics.tiktok.com;connect-src 'self' dana.test *.dana.id *.branch.io *.zendesk.com *.google-analytics.com r.lr-ingest.io stats.g.doubleclick.net *.instagram.com *.googleusercontent.com *.google.com *.gstatic.com blob: analytics.tiktok.com;worker-src 'self' data: blob:;form-action 'self'
cache-control
public, no-transform, max-age=6779543
x-dns-prefetch-control
off
referrer-policy
origin
x-download-options
noopen
accept-ranges
bytes
content-length
12786
x-xss-protection
0, 1; mode=block
1698922036-Thumbnail---DANA-Games-Cashback-Promo.png
a.m.dana.id/danaweb/promo/ 		99 KB
100 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.m.dana.id/danaweb/promo/1698922036-Thumbnail---DANA-Games-Cashback-Promo.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.77.60 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-24-77-60.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0af593eceacf744375d89be26dd6518329129a0ab75942b3fe4e72736447113e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

content-md5
2k3vjaMjGHb4wNbNDKDetw==
access-control-max-age
86400
x-oss-storage-class
Standard
etag
"DA4DEF8DA3231876F8C0D6CD0CA0DEB7"
x-oss-object-type
Normal
access-control-allow-methods
GET,OPTIONS
expires
Sat, 07 Dec 2024 23:53:36 GMT
date
Fri, 08 Nov 2024 02:19:12 GMT
x-oss-server-time
15
content-type
image/png
last-modified
Thu, 02 Nov 2023 10:47:16 GMT
access-control-allow-headers
*,x-sec-clge-req-type,cache-control
cache-control
max-age=2583264
x-oss-hash-crc64ecma
947017695459305352
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-origin
*
content-length
101456
x-oss-request-id
672D530986A20538382C67BE
1698825513-eMAS-General-October-Thumbnail__1_.png
a.m.dana.id/danaweb/promo/ 		0
0
1697520314-Thumbnail__.png
a.m.dana.id/danaweb/promo/ 		147 KB
148 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.m.dana.id/danaweb/promo/1697520314-Thumbnail__.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.77.60 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-24-77-60.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
15f382368f5370540fdc98c3ec375a9e3d684b038dcba4d4079d13218c46f40d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

content-md5
nqPaXhAtX8jtwCdDzDmfrA==
access-control-max-age
86400
x-oss-storage-class
Standard
etag
"9EA3DA5E102D5FC8EDC02743CC399FAC"
x-oss-object-type
Normal
access-control-allow-methods
GET,OPTIONS
expires
Sat, 07 Dec 2024 23:53:26 GMT
date
Fri, 08 Nov 2024 02:19:12 GMT
x-oss-server-time
15
content-type
image/png
last-modified
Tue, 17 Oct 2023 05:25:15 GMT
access-control-allow-headers
*,x-sec-clge-req-type,cache-control
cache-control
max-age=2583254
x-oss-hash-crc64ecma
3964621441267874350
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-origin
*
content-length
150517
x-oss-request-id
672D530956174D3536A63CA8
1697185251-Thumbnail---BRI-GPN-Disc-20K.png
a.m.dana.id/danaweb/promo/ 		64 KB
64 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.m.dana.id/danaweb/promo/1697185251-Thumbnail---BRI-GPN-Disc-20K.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.77.60 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-24-77-60.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
aa902efb6f6aa6565479e83bf435426e846f4c96d72ab42e5f46349fc1d1d837

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

content-md5
fqjBoDpP5ZSF/UwhIjwEzw==
access-control-max-age
86400
x-oss-storage-class
Standard
etag
"7EA8C1A03A4FE59485FD4C21223C04CF"
x-oss-object-type
Normal
access-control-allow-methods
GET,OPTIONS
expires
Sat, 07 Dec 2024 23:53:05 GMT
date
Fri, 08 Nov 2024 02:19:12 GMT
x-oss-server-time
14
content-type
image/png
last-modified
Fri, 13 Oct 2023 08:20:51 GMT
access-control-allow-headers
*,x-sec-clge-req-type,cache-control
cache-control
max-age=2583233
x-oss-hash-crc64ecma
14303807137308417078
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-origin
*
content-length
65205
x-oss-request-id
672D53097AA308333459FD8E
1697088467-Untitled_design__3_.png
a.m.dana.id/danaweb/promo/ 		245 KB
245 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.m.dana.id/danaweb/promo/1697088467-Untitled_design__3_.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.77.60 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-24-77-60.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fcb37eef56a65fe135c9096ec527f7cc2d280e2a741a90d3a22239ef70e3b6d7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

content-md5
KWZllpjKy44dyzmi4InYgg==
access-control-max-age
86400
x-oss-storage-class
Standard
etag
"2966659698CACB8E1DCB39A2E089D882"
x-oss-object-type
Normal
access-control-allow-methods
GET,OPTIONS
expires
Thu, 05 Dec 2024 14:57:01 GMT
date
Fri, 08 Nov 2024 02:19:12 GMT
x-oss-server-time
16
content-type
image/png
last-modified
Thu, 12 Oct 2023 05:27:47 GMT
access-control-allow-headers
*,x-sec-clge-req-type,cache-control
cache-control
max-age=2378269
x-oss-hash-crc64ecma
3967056210878785704
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-origin
*
content-length
250421
x-oss-request-id
672A321F839D103736703C0D
p_27023dscp0.png
l.top4top.io/ 		193 KB
194 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.top4top.io/p_27023dscp0.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
135.181.63.70 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
cdn15.top4top.io
Software
nginx /
Resource Hash
6e1d4c9719bab7d00ae3cb5b9d586b9fe40d24282a9c7df73ac74834ff5c06d7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

cache-control
max-age=7200
etag
"6470f27a-3051b"
x-file-id
x54826979x
expires
Fri, 08 Nov 2024 04:19:12 GMT
accept-ranges
bytes
content-length
197915
date
Fri, 08 Nov 2024 02:19:12 GMT
content-type
image/png
last-modified
Fri, 26 May 2023 17:55:06 GMT
server
nginx
content-disposition
inline; filename="Screenshot_20230527-004847~2.png"
images
encrypted-tbn0.gstatic.com/ 		34 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTB79XhKABNcX-w5PUk1NGotpxY7lRcNDxn5w&usqp=CAU
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
51cf05e59bdb6c143b7993e5fea0251b56d7b3f272502de31f39de9877f0a8ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

age
5554
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
x-content-type-options
nosniff
expires
Sat, 08 Nov 2025 00:46:38 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 08 Nov 2024 00:46:38 GMT
last-modified
Sun, 02 Apr 2023 03:00:42 GMT
content-type
image/jpeg
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
content-length
34728
x-xss-protection
0
server
sffe
p_2702akd320.png
l.top4top.io/ 		139 KB
140 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.top4top.io/p_2702akd320.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
135.181.63.70 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
cdn15.top4top.io
Software
nginx /
Resource Hash
1ebb6b11be3f4edfe27126ec991b172d388fab45d68d490975008d9682ff9928

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

cache-control
max-age=7200
etag
"6470e604-22c1e"
x-file-id
x54826295x
expires
Fri, 08 Nov 2024 04:19:12 GMT
accept-ranges
bytes
content-length
142366
date
Fri, 08 Nov 2024 02:19:12 GMT
content-type
image/png
last-modified
Fri, 26 May 2023 17:01:56 GMT
server
nginx
content-disposition
inline; filename="Screenshot_20230526-234536~2.png"
OJK_Logo.png
upload.wikimedia.org/wikipedia/commons/8/83/ 		124 KB
124 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://upload.wikimedia.org/wikipedia/commons/8/83/OJK_Logo.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:ec80:300:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),
Reverse DNS
Software
ATS/9.2.5 /
Resource Hash
ba69f363a76dfa12e593b5d42c0b4473153d635d88ee54aeef3bed7e3fefa72f
Security Headers
Name Value
Strict-Transport-Security max-age=106384710; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

access-control-expose-headers
Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
etag
379cb59b00cc8b5984009b4b46f5fb1d
age
1083
x-object-meta-sha1base36
hor7y5l8cx1i8v2w5jb6g01wwh9ixmd
report-to
{ "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
x-content-type-options
nosniff
server-timing
cache;desc="hit-front", host;desc="cp3076"
x-cache
cp3076 hit, cp3076 hit/2
date
Fri, 08 Nov 2024 02:01:08 GMT
content-type
image/png
last-modified
Sat, 27 Feb 2021 04:16:22 GMT
x-client-ip
2a00:c98:2f00:20:a::8
x-cache-status
hit-front
strict-transport-security
max-age=106384710; includeSubDomains; preload
nel
{ "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
timing-allow-origin
*
accept-ranges
bytes
access-control-allow-origin
*
content-length
126532
server
ATS/9.2.5
logo-mitra.png
assets.bukalapak.com/daisy/compro/images/about/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.bukalapak.com/daisy/compro/images/about/logo-mitra.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.154.227 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
b4496dc7f516c020395c6cc1ca2a95fa5697509a7e01d6ba8d1cfe0fc126204e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

x-iinfo
57-10791899-10787232 2CNN RT(1731032351970 33) q(0 0 0 0) r(0 0) U18
cache-control
max-age=1866268, public
etag
"08cd4285910cdc7a94a077cf45f78042"
x-cdn
Imperva
expires
Fri, 29 Nov 2024 16:43:39 GMT
access-control-allow-origin
*
content-length
8556
date
Fri, 08 Nov 2024 02:19:11 GMT
last-modified
Tue, 07 Dec 2021 10:22:31 GMT
content-type
image/png
IMG_20230827_160252.jpg
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7H3AZHRJ8VHqTtUQZVi0MP9fnWfj4q8PXBGeCY8H7TOzwmQBfZrRZ_mqq50lFLvTZTHCnzIR-stdV2Gg_CjT6XUCTdj0fZw4TGq8gC4AJn2kF9vk5O7Doxi0Ove7_b-eIh4dxbvhC0L3BkjGQ... 		77 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7H3AZHRJ8VHqTtUQZVi0MP9fnWfj4q8PXBGeCY8H7TOzwmQBfZrRZ_mqq50lFLvTZTHCnzIR-stdV2Gg_CjT6XUCTdj0fZw4TGq8gC4AJn2kF9vk5O7Doxi0Ove7_b-eIh4dxbvhC0L3BkjGQSSSgtaD5TxImeKlEqfZlhlx2aI-kHD1R5_XSTCQl1k0/s1200/IMG_20230827_160252.jpg
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
3f2b844b52c486f87e86863cfa137e75b7c123f7f9a9d47c7c5f7ec8256fed9a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
etag
"v15f6"
x-content-type-options
nosniff
expires
Sat, 09 Nov 2024 02:19:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
79104
date
Fri, 08 Nov 2024 02:19:12 GMT
x-xss-protection
0
content-type
image/jpeg
vary
Origin
server
fife
content-disposition
inline;filename="IMG_20230827_160252.jpg"
logo-lps.png
infobanknews.com/wp-content/uploads/2019/04/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://infobanknews.com/wp-content/uploads/2019/04/logo-lps.png
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.71.3 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
3.71.36.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
de9a7b06966c704cc5e8da25eba02339e2842a40285e768a99f43d0318740e2a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

x-goog-metageneration
1
x-goog-meta-goog-reserved-file-mtime
1554801036
x-goog-hash
crc32c=RqkKKw==, md5=5pj00kb6swKihtHo63BJ5A==
etag
"e698f4d246fab302a286d1e8eb7049e4"
age
0
x-goog-stored-content-encoding
identity
expires
Fri, 08 Nov 2024 03:19:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
15795
date
Fri, 08 Nov 2024 02:19:12 GMT
last-modified
Wed, 12 Jul 2023 17:15:17 GMT
content-type
image/png
x-guploader-uploadid
AHmUCY096FIur_jVuoIVxMc5ZmBKeGWJyMOTxJF-ZOCPED3WYAm2U1QcwtcuOBfUy93tq8d5lmcRpPLmhA
cache-control
public, max-age=3600
x-goog-storage-class
STANDARD
accept-ranges
bytes
x-goog-generation
1689182117807797
content-length
15795
server
UploadServer
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/ 		87 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb09ed3-15d84"
age
21434
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r%2F9cIWtuUhY6eMI3jIoWPeB4xenm7lJmaSFeynUEVfZJm6IyaoJS%2Bjemag7Kn7CbjSYGy2nr8eADEUf5r2zIDxFYI9TS1dk%2B4eiU83LVHdseOv6dMpzkZ8lTKCKJX24ip94Iq%2F3E"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 29 Oct 2025 02:19:11 GMT
alt-svc
h3=":443"; ma=86400
date
Fri, 08 Nov 2024 02:19:11 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 23:01:39 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8df213a7cd033660-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
27958
server
cloudflare
slick.min.js
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ 		42 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.min.js
Requested by
Host: aktifkanpayla4terr.real-resmi.com
URL: https://aktifkanpayla4terr.real-resmi.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"a76f-O0GzvJVmhQFaNHoiOOcdsp36Dbs"
age
1327272
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Y8Cs%2BuiOAyfkGCnNYtCT%2Fnyh5h5KDkWG6LYL5KWJk8clHMnGNoEqtZ7uIrUX8N3j8V8915VVkmTQrM8hLWPaF3KzMxSNNKnD9Q0%2BctKwlMAOBs8EYkGUe8LNTj8muL4%2FhC1XXNEif7vYXF89AI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Fri, 08 Nov 2024 02:19:11 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-fra-eddf8230159-FRA, cache-lga21981-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8df213a7dbba2bee-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
9994
server
cloudflare
x-jsd-version
1.8.1
BotikaTTS%20_5_.mp3
e-formulir.mwebs.id/ 		0
0
memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v40/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4gaVI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@500&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f3.1e100.net
Software
sffe /
Resource Hash
1f6e5ae697330d08acadf0299418b94a102dcc63f483b3f3ec821cc7e36ef8dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://aktifkanpayla4terr.real-resmi.com
Referer
https://fonts.googleapis.com/

Response headers

age
125758
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 15:23:14 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Nov 2024 15:23:14 GMT
last-modified
Thu, 14 Dec 2023 02:00:41 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
18720
x-xss-protection
0
server
sffe
ajax-loader.gif
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/ajax-loader.gif
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.css

Response headers

access-control-expose-headers
*
cf-cache-status
HIT
etag
W/"1052-ehqkNhQ5Y4K7FeX95XTZzc0haY8"
age
18315
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HFfCo8ByXCPcXvrzj1GjxWMWnmIDh%2Bv2gimvqwYfPFMn%2BIvi9OD7BXwBfjRAWYY3AWePD32NpGqVEJaq4v50usG4bknQ9zaLe1VaN4uoaIDw5r%2BkRokYIehPcWOACGTE9ej5zv8qiHIOkWiW%2Fwk%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Fri, 08 Nov 2024 02:19:12 GMT
content-type
image/gif
x-served-by
cache-fra-etou8220104-FRA, cache-lga21986-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8df213a86bdf2bee-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
4178
server
cloudflare
x-jsd-version
1.8.1
slick.woff
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/fonts/ 		1 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/fonts/slick.woff
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26726bac4060abb1226e6ceebc1336e84930fe7a7af1b3895a109d067f5b5dcc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://aktifkanpayla4terr.real-resmi.com
Referer
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick-theme.css

Response headers

access-control-expose-headers
*
cf-cache-status
HIT
etag
W/"564-r5HBLw9Aak+AGus7OYdo/kHY+GQ"
age
1323873
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4qy%2B5t5p2DRoPJ1rX3JL%2FKT7LsQALEDmuvUSYtBH0vLvGeyZxoX4RqvUKR5%2FuaP%2FmXlQ91PuFR53HRQPhGlSf%2BgHWfcl90udQkRvKIZZfOwaENor3XDiKchVylHF9lgTeuPg1JdtDjXTB6s%2Bmn0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Fri, 08 Nov 2024 02:19:12 GMT
content-type
font/woff
x-served-by
cache-fra-etou8220033-FRA, cache-lga21975-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8df213a87ffcd2de-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
1380
server
cloudflare
x-jsd-version
1.8.1
images
encrypted-tbn0.gstatic.com/ 		11 KB
11 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQZ9dATs_nkzyO-gSoQWbtIhJV7bG51r3gOKg&usqp=CAU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0546f98f9019a3d2afbe9372ba08aba895e2aa716bd0fec8e78ff5879162f134
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://aktifkanpayla4terr.real-resmi.com/

Response headers

age
4719
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
x-content-type-options
nosniff
expires
Sat, 08 Nov 2025 01:00:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 08 Nov 2024 01:00:34 GMT
last-modified
Sun, 15 Sep 2019 17:10:09 GMT
content-type
image/jpeg
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
content-length
11540
x-xss-protection
0
server
sffe

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
a.m.dana.id
URL
https://a.m.dana.id/danaweb/promo/1698825513-eMAS-General-October-Thumbnail__1_.png
Domain
e-formulir.mwebs.id
URL
https://e-formulir.mwebs.id/BotikaTTS%20_5_.mp3

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DANA (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| playaudio

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://e-formulir.mwebs.id/BotikaTTS%20_5_.mp3
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.m.dana.id
aktifkanpayla4terr.real-resmi.com
assets.bukalapak.com
blogger.googleusercontent.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.ionicframework.com
e-formulir.mwebs.id
encrypted-tbn0.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
infobanknews.com
l.top4top.io
maxcdn.bootstrapcdn.com
upload.wikimedia.org
www.dana.id
a.m.dana.id
e-formulir.mwebs.id
104.17.24.14
104.18.11.207
135.181.63.70
172.67.69.29
184.24.77.59
184.24.77.60
216.58.212.131
2606:4700:3034::6815:f7f
2606:4700::6812:bb1f
2a00:1450:4001:803::200a
2a00:1450:4001:81d::2001
2a00:1450:4001:81d::200e
2a02:ec80:300:ed1a::2:b
34.36.71.3
45.60.154.227
0546f98f9019a3d2afbe9372ba08aba895e2aa716bd0fec8e78ff5879162f134
0af593eceacf744375d89be26dd6518329129a0ab75942b3fe4e72736447113e
0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
0ebabf46b3de75a736d3a82319edd773168c1c664bf2b76f81f760567f598fea
15f382368f5370540fdc98c3ec375a9e3d684b038dcba4d4079d13218c46f40d
1ebb6b11be3f4edfe27126ec991b172d388fab45d68d490975008d9682ff9928
1f6e5ae697330d08acadf0299418b94a102dcc63f483b3f3ec821cc7e36ef8dc
26726bac4060abb1226e6ceebc1336e84930fe7a7af1b3895a109d067f5b5dcc
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
3f2b844b52c486f87e86863cfa137e75b7c123f7f9a9d47c7c5f7ec8256fed9a
51cf05e59bdb6c143b7993e5fea0251b56d7b3f272502de31f39de9877f0a8ae
6e1d4c9719bab7d00ae3cb5b9d586b9fe40d24282a9c7df73ac74834ff5c06d7
7adaf08052c6a6a0f8a0d0055b4f191fd07389fe41c972b69573472b2ecb406a
92ac508220f5bb60ec94e07650528eb66625f82a4740ada068cde05365781286
aa902efb6f6aa6565479e83bf435426e846f4c96d72ab42e5f46349fc1d1d837
b4496dc7f516c020395c6cc1ca2a95fa5697509a7e01d6ba8d1cfe0fc126204e
ba69f363a76dfa12e593b5d42c0b4473153d635d88ee54aeef3bed7e3fefa72f
c67e5431f9c00bb690ea8b8add63d5ca9250bf2925f2c2a691eeee498ac75853
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
de9a7b06966c704cc5e8da25eba02339e2842a40285e768a99f43d0318740e2a
e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b
eb49455c858ed39b0cc791b8fe44ca839061b73f77b8d08f681c41539a2e9bc0
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fb1763b59f9f5764294b5af9fa5250835ae608282fe6f2f2213a5952aacf1fbf
fcb37eef56a65fe135c9096ec527f7cc2d280e2a741a90d3a22239ef70e3b6d7