www.bylejm.com.win20.mojsite.com Open in urlscan Pro
185.220.24.20  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.bylejm.com.win20.mojsite.com/	11 KB 11 KB	148ms 49ms	Document text/html	185.220.24.20 DHH-AS
General Check archive.org Show headers Download Go to Full URL https://www.bylejm.com.win20.mojsite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.220.24.20 , Croatia, ASN12417 (DHH-AS, HR), Reverse DNS win20.mojsite.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 39e020396c772a2319565bce64a34196b245e6785ce2218814f469c38848db01 Request headers :method GET :authority www.bylejm.com.win20.mojsite.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-type text/html last-modified Mon, 24 May 2021 10:48:26 GMT accept-ranges bytes etag "03910538a50d71:0" server Microsoft-IIS/10.0 x-powered-by ASP.NET date Sat, 10 Jul 2021 08:15:38 GMT content-length 11282
GET H2	200	css2 fonts.googleapis.com/	4 KB 575 B	16ms 14ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Manrope:wght@300;700;800&display=swap Requested by Host: www.bylejm.com.win20.mojsite.com URL: https://www.bylejm.com.win20.mojsite.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ce1b15adabca83f7af38fa68f256d5d298346a22785637bfb62f7c26513fca09 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bylejm.com.win20.mojsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 10 Jul 2021 08:15:31 GMT server ESF date Sat, 10 Jul 2021 08:15:31 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 10 Jul 2021 08:15:31 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	122 KB 47 KB	24ms 20ms	Script application/javascript	2a00:1450:4001:80f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T6HHLPG2DN Requested by Host: www.bylejm.com.win20.mojsite.com URL: https://www.bylejm.com.win20.mojsite.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8ccb3cc3cee408d59c6d19514dcb30e8fd28c7db7c98f1d136e944a48b71e5dc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.bylejm.com.win20.mojsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 10 Jul 2021 08:15:31 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 48412 x-xss-protection 0 expires Sat, 10 Jul 2021 08:15:31 GMT
GET H2	200	Hamburger.svg www.bylejm.com.win20.mojsite.com/Icons/	367 B 457 B	48ms 46ms	Image image/svg+xml	185.220.24.20 DHH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.bylejm.com.win20.mojsite.com/Icons/Hamburger.svg Requested by Host: www.bylejm.com.win20.mojsite.com URL: https://www.bylejm.com.win20.mojsite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.220.24.20 , Croatia, ASN12417 (DHH-AS, HR), Reverse DNS win20.mojsite.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash d97a33886f41a9bd04db14e5f6f227fc867bb44cdc70ad2a68454c035b29e8f1 Request headers :path /Icons/Hamburger.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.bylejm.com.win20.mojsite.com referer https://www.bylejm.com.win20.mojsite.com/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.bylejm.com.win20.mojsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 10 Jul 2021 08:15:38 GMT last-modified Mon, 17 May 2021 21:40:24 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "014513e654bd71:0" content-type image/svg+xml accept-ranges bytes content-length 367
GET H2	200	logo.png www.bylejm.com.win20.mojsite.com/Images/	4 KB 5 KB	48ms 47ms	Image image/png	185.220.24.20 DHH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.bylejm.com.win20.mojsite.com/Images/logo.png Requested by Host: www.bylejm.com.win20.mojsite.com URL: https://www.bylejm.com.win20.mojsite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.220.24.20 , Croatia, ASN12417 (DHH-AS, HR), Reverse DNS win20.mojsite.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 436cbaa3d709b7d0bdddb8541148921fbb32706fc41d90859b2705d27db05a2b Request headers :path /Images/logo.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.bylejm.com.win20.mojsite.com referer https://www.bylejm.com.win20.mojsite.com/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.bylejm.com.win20.mojsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 10 Jul 2021 08:15:38 GMT last-modified Sat, 22 May 2021 15:07:27 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "8021652d1c4fd71:0" content-type image/png accept-ranges bytes content-length 4543
GET H2	200	lesicka_background.jpg www.bylejm.com.win20.mojsite.com/Images/	2 MB 2 MB	51ms 49ms	Image image/jpeg	185.220.24.20 DHH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.bylejm.com.win20.mojsite.com/Images/lesicka_background.jpg Requested by Host: www.bylejm.com.win20.mojsite.com URL: https://www.bylejm.com.win20.mojsite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.220.24.20 , Croatia, ASN12417 (DHH-AS, HR), Reverse DNS win20.mojsite.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 77410f21968356bc6e56282823c2a4084a2c9e16a6a2d939050eb1c4f4b14b7b Request headers :path /Images/lesicka_background.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.bylejm.com.win20.mojsite.com referer https://www.bylejm.com.win20.mojsite.com/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.bylejm.com.win20.mojsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 10 Jul 2021 08:15:38 GMT last-modified Sun, 09 May 2021 18:24:25 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "80121a8a045d71:0" content-type image/jpeg accept-ranges bytes content-length 1918649
GET H2	200	hi.svg www.bylejm.com.win20.mojsite.com/Images/	2 KB 2 KB	148ms 143ms	Image image/svg+xml	185.220.24.20 DHH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.bylejm.com.win20.mojsite.com/Images/hi.svg Requested by Host: www.bylejm.com.win20.mojsite.com URL: https://www.bylejm.com.win20.mojsite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.220.24.20 , Croatia, ASN12417 (DHH-AS, HR), Reverse DNS win20.mojsite.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 9dcb98a8e8380dc93ef697518bd3d45c2ebc0a74fe4fbaf3b19ee2a1f8ec4740 Request headers :path /Images/hi.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.bylejm.com.win20.mojsite.com referer https://www.bylejm.com.win20.mojsite.com/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.bylejm.com.win20.mojsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 10 Jul 2021 08:15:38 GMT last-modified Sun, 09 May 2021 18:24:25 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "80121a8a045d71:0" content-type image/svg+xml accept-ranges bytes content-length 2018
GET H2	200	lesickacopyright.svg www.bylejm.com.win20.mojsite.com/Images/	7 KB 7 KB	165ms 161ms	Image image/svg+xml	185.220.24.20 DHH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.bylejm.com.win20.mojsite.com/Images/lesickacopyright.svg Requested by Host: www.bylejm.com.win20.mojsite.com URL: https://www.bylejm.com.win20.mojsite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.220.24.20 , Croatia, ASN12417 (DHH-AS, HR), Reverse DNS win20.mojsite.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 6433d3533334c5dc3ea39843db9778316d99008193aed671e07d6a4dbdb87cf5 Request headers :path /Images/lesickacopyright.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.bylejm.com.win20.mojsite.com referer https://www.bylejm.com.win20.mojsite.com/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.bylejm.com.win20.mojsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 10 Jul 2021 08:15:38 GMT last-modified Sun, 09 May 2021 18:24:25 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "80121a8a045d71:0" content-type image/svg+xml accept-ranges bytes content-length 7188
GET H2	200	xn7gYHE41ni1AdIRggexSg.woff2 fonts.gstatic.com/s/manrope/v4/	22 KB 22 KB	10ms 6ms	Font font/woff2	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/manrope/v4/xn7gYHE41ni1AdIRggexSg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Manrope:wght@300;700;800&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a41d60f8ac48aafcddd891ddebb318735c5684c4d8c8971f2a236233f89fc3be Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.bylejm.com.win20.mojsite.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 05 Jul 2021 18:31:15 GMT x-content-type-options nosniff age 395056 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22788 x-xss-protection 0 last-modified Thu, 28 Jan 2021 21:57:26 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 05 Jul 2022 18:31:15 GMT
GET H3-29	200	xn7gYHE41ni1AdIRggmxSuXd.woff2 fonts.gstatic.com/s/manrope/v4/	14 KB 14 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/manrope/v4/xn7gYHE41ni1AdIRggmxSuXd.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Manrope:wght@300;700;800&display=swap Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9aed82de0209bef7136adec63181c02618241fec02a7479191c9df001c1e17bd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.bylejm.com.win20.mojsite.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 06 Jul 2021 08:28:22 GMT x-content-type-options nosniff age 344829 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14404 x-xss-protection 0 last-modified Thu, 28 Jan 2021 22:24:28 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 06 Jul 2022 08:28:22 GMT
GET H3-29	200	js Show response www.googletagmanager.com/gtag/	122 KB 47 KB	23ms 21ms	Script application/javascript	2a00:1450:4001:812::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T6HHLPG2DN&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T6HHLPG2DN Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 1643e4fbe3fb1f46e0a541fe217b5cfe109d759202815efc7c5bb9a972a5a296 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.bylejm.com.win20.mojsite.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 10 Jul 2021 08:15:31 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 48393 x-xss-protection 0 expires Sat, 10 Jul 2021 08:15:31 GMT

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| TogleMenu function| cookiecheck function| acceptcookies object| google_tag_manager object| dataLayer function| onYouTubeIframeAPIReady

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
www.bylejm.com.win20.mojsite.com
www.googletagmanager.com
185.220.24.20
2a00:1450:4001:803::2003
2a00:1450:4001:80f::2008
2a00:1450:4001:812::2008
2a00:1450:4001:82f::200a
1643e4fbe3fb1f46e0a541fe217b5cfe109d759202815efc7c5bb9a972a5a296
39e020396c772a2319565bce64a34196b245e6785ce2218814f469c38848db01
436cbaa3d709b7d0bdddb8541148921fbb32706fc41d90859b2705d27db05a2b
6433d3533334c5dc3ea39843db9778316d99008193aed671e07d6a4dbdb87cf5
77410f21968356bc6e56282823c2a4084a2c9e16a6a2d939050eb1c4f4b14b7b
8ccb3cc3cee408d59c6d19514dcb30e8fd28c7db7c98f1d136e944a48b71e5dc
9aed82de0209bef7136adec63181c02618241fec02a7479191c9df001c1e17bd
9dcb98a8e8380dc93ef697518bd3d45c2ebc0a74fe4fbaf3b19ee2a1f8ec4740
a41d60f8ac48aafcddd891ddebb318735c5684c4d8c8971f2a236233f89fc3be
ce1b15adabca83f7af38fa68f256d5d298346a22785637bfb62f7c26513fca09
d97a33886f41a9bd04db14e5f6f227fc867bb44cdc70ad2a68454c035b29e8f1