URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Submission: On November 10 via api from LU — Scanned from DE

Summary

This website contacted 8 IPs in 3 countries across 5 domains to perform 22 HTTP transactions. The main IP is 136.243.171.225, located in Eitensheim, Germany and belongs to HETZNER-AS, DE. The main domain is www.comparitech.com. The Cisco Umbrella rank of the primary domain is 492235.
TLS certificate: Issued by R10 on October 3rd 2024. Valid for: 3 months.
This is the only time www.comparitech.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 136.243.171.225 24940 (HETZNER-AS)
11 148.251.232.222 24940 (HETZNER-AS)
1 23.192.81.15 16625 (AKAMAI-AS)
3 2a00:1450:400... 15169 (GOOGLE)
1 51.77.64.70 16276 (OVH)
2 2001:4860:480... 15169 (GOOGLE)
2 3.121.108.89 16509 (AMAZON-02)
22 8
Apex Domain
Subdomains
Transfer
13 comparitech.com
www.comparitech.com — Cisco Umbrella Rank: 492235
cdn.comparitech.com — Cisco Umbrella Rank: 534242
283 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
310 KB
3 convertexperiments.com
cdn-3.convertexperiments.com — Cisco Umbrella Rank: 29116
logs.convertexperiments.com — Cisco Umbrella Rank: 26629
1002820.metrics.convertexperiments.com
145 KB
2 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 3643
1 ip-api.com
pro.ip-api.com — Cisco Umbrella Rank: 6020
467 B
22 5
Domain Requested by
11 cdn.comparitech.com www.comparitech.com
3 www.googletagmanager.com www.comparitech.com
www.googletagmanager.com
2 region1.google-analytics.com www.googletagmanager.com
2 www.comparitech.com www.comparitech.com
1 1002820.metrics.convertexperiments.com cdn-3.convertexperiments.com
1 logs.convertexperiments.com cdn-3.convertexperiments.com
1 pro.ip-api.com www.comparitech.com
1 cdn-3.convertexperiments.com www.comparitech.com
22 8

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
pinterest.com
www.linkedin.com
www.universite-paris-saclay.fr
akismet.com
Subject Issuer Validity Valid
comparitech.com
R10
2024-10-03 -
2025-01-01
3 months crt.sh
*.convertexperiments.com
DigiCert TLS RSA SHA256 2020 CA1
2024-09-11 -
2025-09-10
a year crt.sh
*.google-analytics.com
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
*.ip-api.com
Sectigo RSA Domain Validation Secure Server CA
2023-12-21 -
2025-01-20
a year crt.sh
*.metrics.convertexperiments.com
Amazon RSA 2048 M03
2024-11-01 -
2025-11-30
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Frame ID: 7C2BCF221243844E0B11DE6E83AF111E
Requests: 23 HTTP requests in this frame

Screenshot

Page Title

RansomHouse claims ransomware attack on Université Paris-Saclay - 1TB allegedly stolen - Comparitech

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • dataTables.*\.js

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Page Statistics

22
Requests

100 %
HTTPS

29 %
IPv6

5
Domains

8
Subdomains

8
IPs

3
Countries

738 kB
Transfer

2297 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
662 KB
197 KB
Document
General
Full URL
https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
136.243.171.225 Eitensheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
9a7c6310f197157c62a9f681c2ca02d66d60b318675f056bcf652d71ea2b1072
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sun, 10 Nov 2024 16:17:15 GMT
last-modified
Fri, 08 Nov 2024 22:55:19 GMT
link
<https://www.comparitech.com/wp-json/>; rel="https://api.w.org/" <https://www.comparitech.com/wp-json/wp/v2/posts/487143>; rel="alternate"; title="JSON"; type="application/json"
server
nginx
strict-transport-security
max-age=31536000; preload
vary
Accept-Encoding, Cookie
x-frame-options
SAMEORIGIN
x-presslabs-stats
MISS; 0.411s; 35 queries; desktop; ttl 2419200s; refresh in 2270284s
x-request-id
748426104a056799af6a742f4840a4ce
RansomHouse-claims-ransomware-attack-on-Universite-Paris-Saclay.jpg.webp
cdn.comparitech.com/wp-content/uploads/2024/10/
29 KB
29 KB
Image
General
Full URL
https://cdn.comparitech.com/wp-content/uploads/2024/10/RansomHouse-claims-ransomware-attack-on-Universite-Paris-Saclay.jpg.webp
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
693ca7e4612ce0f2b6e60dda8a98d37a83e5e5341724bcb796caed828d6472b3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
684a0511e3b1686eb61e96fd672d31dc
cache-control
max-age = 315360000
etag
"670642b5-72fe"
x-presslabs-cache
MISS
expires
Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges
bytes
content-length
29438
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
image/webp
last-modified
Wed, 09 Oct 2024 08:45:41 GMT
server
nginx
vary
Accept-Encoding
10021806-1002820.js
cdn-3.convertexperiments.com/js/
599 KB
145 KB
Script
General
Full URL
https://cdn-3.convertexperiments.com/js/10021806-1002820.js
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.192.81.15 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-192-81-15.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5b8b1f6509786cbdcff2bad6ec4a8a9159d403f854e0eacb48057902cc043e0f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=15768000
cache-control
public, max-age=213
content-encoding
gzip
x-privacy-policy
You can find our privacy policy at https://www.convert.com/privacy-notice/
content-length
148360
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
application/javascript
vary
Accept-Encoding
tablepress-combined.min.css
cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/
6 KB
3 KB
Stylesheet
General
Full URL
https://cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/tablepress-combined.min.css?ver=1731083386
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
8f5064e162b184b1ea54c9e148a4eb57202d567c1fc1e3ac91b4a200fc2ddba6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
684a0511e3b1686eb61e96fd672d31dc
cache-control
max-age = 315360000
content-encoding
gzip
etag
W/"672e3c7a-18f6"
x-presslabs-cache
HIT
expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
text/css
last-modified
Fri, 08 Nov 2024 16:29:46 GMT
server
nginx
vary
Accept-Encoding
datatables.buttons.css
cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/
9 KB
3 KB
Stylesheet
General
Full URL
https://cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/datatables.buttons.css?ver=1731083386
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
5995014cd71adbf3736442c9fa86bc48d954f2484d27c662fda977703522f2bf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
684a0511e3b1686eb61e96fd672d31dc
cache-control
max-age = 315360000
content-encoding
gzip
etag
W/"672e3c7a-259d"
x-presslabs-cache
HIT
expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
text/css
last-modified
Fri, 08 Nov 2024 16:29:46 GMT
server
nginx
vary
Accept-Encoding
datatables.rowgroup.css
cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/
818 B
511 B
Stylesheet
General
Full URL
https://cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/datatables.rowgroup.css?ver=1731083386
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
677a97228a509a4f6ce6fc37c55a93bda3615653a564f8f99b06497293a96b7f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
684a0511e3b1686eb61e96fd672d31dc
cache-control
max-age = 315360000
content-encoding
gzip
etag
W/"672e3c7a-332"
x-presslabs-cache
HIT
expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
text/css
last-modified
Fri, 08 Nov 2024 16:29:46 GMT
server
nginx
vary
Accept-Encoding
responsive-tables.css
cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/
12 KB
2 KB
Stylesheet
General
Full URL
https://cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/responsive-tables.css?ver=1731083386
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
5e8f8a3cb8ae828ac0cef53ec7cd786fd2733780c831b8e79e6d16c7fb10b434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
684a0511e3b1686eb61e96fd672d31dc
cache-control
max-age = 315360000
content-encoding
gzip
etag
W/"672e3c7a-2ef5"
x-presslabs-cache
HIT
expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
text/css
last-modified
Fri, 08 Nov 2024 16:29:46 GMT
server
nginx
vary
Accept-Encoding
datatables.columnfilterwidgets.css
cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/
313 B
474 B
Stylesheet
General
Full URL
https://cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/datatables.columnfilterwidgets.css?ver=1731083386
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
876bed21d939592a2479ed29d063f9889fcfff433fc7e0901392943ecc7e5209
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
684a0511e3b1686eb61e96fd672d31dc
cache-control
max-age = 315360000
content-encoding
gzip
etag
W/"672e3c7a-139"
x-presslabs-cache
HIT
expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
text/css
last-modified
Fri, 08 Nov 2024 16:29:46 GMT
server
nginx
vary
Accept-Encoding
datatables.serverside-processing.css
cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/
1 KB
686 B
Stylesheet
General
Full URL
https://cdn.comparitech.com/wp-content/uploads/wp_rocket/cache/min/1/wp-content/plugins/tablepress-premium/modules/css/build/datatables.serverside-processing.css?ver=1731083386
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
150e49de5a091691a5d801ff3ac637cd6bfdb73cf482595813fb5bbccd0a5307
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
684a0511e3b1686eb61e96fd672d31dc
cache-control
max-age = 315360000
content-encoding
gzip
etag
W/"672e3c7a-417"
x-presslabs-cache
HIT
expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
text/css
last-modified
Fri, 08 Nov 2024 16:29:46 GMT
server
nginx
vary
Accept-Encoding
in-short.js
cdn.comparitech.com/wp-content/plugins/comparitech-custom/inc/shortcodes/in-short/js/
547 B
616 B
Script
General
Full URL
https://cdn.comparitech.com/wp-content/plugins/comparitech-custom/inc/shortcodes/in-short/js/in-short.js?ver=1.0.3
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
866f60df81bcd8aae53267f4ff7a6159639a388032c48f5843c929799c54d01c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
e012700c121acb2e36e1f1632b86b29f
cache-control
max-age = 315360000
content-encoding
gzip
etag
W/"670d83ad-223"
x-cache-groups
assets
x-presslabs-cache
HIT
expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
application/javascript
last-modified
Mon, 14 Oct 2024 20:48:45 GMT
server
nginx
vary
Accept-Encoding
akismet-frontend.js
cdn.comparitech.com/wp-content/plugins/akismet/_inc/
11 KB
4 KB
Script
General
Full URL
https://cdn.comparitech.com/wp-content/plugins/akismet/_inc/akismet-frontend.js?ver=1728938924
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
6bc5622bfab1a16855ad49b99a3f9ed8eb24f49da469a113f9000b866f109e2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
394790d0239eb5063a38675e278bdcb2
cache-control
max-age = 315360000
content-encoding
gzip
etag
W/"670d83ac-2c7c"
x-cache-groups
assets
x-presslabs-cache
HIT
expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
application/javascript
last-modified
Mon, 14 Oct 2024 20:48:44 GMT
server
nginx
vary
Accept-Encoding
6uK9szCotqRV.js
www.comparitech.com/
83 B
335 B
Script
General
Full URL
https://www.comparitech.com/6uK9szCotqRV.js?ts=74486
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
136.243.171.225 Eitensheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
6cddb69ed120db073795c5c2a04676214476161606e518f483689b93bd928ae3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
8b9c3afa74796a28baabaa381e6d42c1
x-presslabs-stats
desktop
cache-control
no-cache
content-encoding
gzip
expires
Thu, 01 Jan 1970 00:00:01 GMT
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
application/javascript
vary
Accept-Encoding
server
nginx
gtm.js
www.googletagmanager.com/
294 KB
99 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TX6HJV
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
62185bf234f63022568bde233d3f0cff15af3a6c30c651b2071029f5f3b40382
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires
Sun, 10 Nov 2024 16:17:15 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sun, 10 Nov 2024 15:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
100652
x-xss-protection
0
server
Google Tag Manager
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c18d89bb095e1cb26d37e8e757d031aefcf2f54fbe7d80a84b23554ad8e31454

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer

Response headers

Content-Type
image/jpg
GZb58hyWMAAkrRf.jpg.webp
cdn.comparitech.com/wp-content/uploads/2024/10/
40 KB
41 KB
Image
General
Full URL
https://cdn.comparitech.com/wp-content/uploads/2024/10/GZb58hyWMAAkrRf.jpg.webp
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
67628ee9e60a7d3e957051e3cbf08f3da905841cc83f9ce9da0c2a891a35ae4a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
d0c9aa9a5e107b0ca45d0e7e88f648c9
cache-control
max-age = 315360000
etag
"67064e52-a1cc"
x-presslabs-cache
MISS
expires
Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges
bytes
content-length
41420
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
image/webp
last-modified
Wed, 09 Oct 2024 09:35:14 GMT
server
nginx
vary
Accept-Encoding
/
pro.ip-api.com/json/
285 B
467 B
XHR
General
Full URL
https://pro.ip-api.com/json/?key=koxgS94M2RrKa3r
Requested by
Host: www.comparitech.com
URL: https://www.comparitech.com/news/ransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.77.64.70 , Germany, ASN16276 (OVH, FR),
Reverse DNS
de-fra-1.pro.ip-api.com
Software
/
Resource Hash
75693201e665ffb66eb2c8743226e9e32eac7b16b82456f5f84223581cf43913

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.comparitech.com/

Response headers

Access-Control-Allow-Origin
https://www.comparitech.com
Content-Length
285
Date
Sun, 10 Nov 2024 16:17:15 GMT
Content-Type
application/json; charset=utf-8
js
www.googletagmanager.com/gtag/
306 KB
104 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-594Q6WX0ED&l=dataLayer&cx=c&gtm=45He4b70v71649924za200
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TX6HJV
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0810d91c763fc9463c1fb35559874d33d4efac948a7ddff6e824a415d235261f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Sun, 10 Nov 2024 16:17:15 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
105941
x-xss-protection
0
server
Google Tag Manager
js
www.googletagmanager.com/gtag/
322 KB
107 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-MDHRS9ZYXE&l=dataLayer&cx=c&gtm=45He4b70v71649924za200
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TX6HJV
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ae6f507848181d7aac6c0b5a4a6b5f2f9d48fe07769b2eeee1357df7560e3d17
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Sun, 10 Nov 2024 16:17:15 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
109407
x-xss-protection
0
server
Google Tag Manager
collect
region1.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-MDHRS9ZYXE&gtm=45je4b70v9168057853z871649924za200zb71649924&_p=1731255435661&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101823848~101925629&cid=1530981561.1731255436&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1731255435&sct=1&seg=0&dl=https%3A%2F%2Fwww.comparitech.com%2Fnews%2Fransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen%2F&dt=RansomHouse%20claims%20ransomware%20attack%20on%20Universit%C3%A9%20Paris-Saclay%20-%201TB%20allegedly%20stolen%20-%20Comparitech&en=page_view&_fv=1&_nsi=1&_ss=1&epn.screen_width=1600&epn.screen_height=1200&epn.viewport_width=1600&epn.viewport_height=1200&tfd=378
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MDHRS9ZYXE&l=dataLayer&cx=c&gtm=45He4b70v71649924za200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.comparitech.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
text/plain
server
Golfe2
collect
region1.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-594Q6WX0ED&gtm=45je4b70v867600485z871649924za200zb71649924&_p=1731255435661&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101823848~101925629&cid=1530981561.1731255436&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1731255435&sct=1&seg=0&dl=https%3A%2F%2Fwww.comparitech.com%2Fnews%2Fransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen%2F&dt=RansomHouse%20claims%20ransomware%20attack%20on%20Universit%C3%A9%20Paris-Saclay%20-%201TB%20allegedly%20stolen%20-%20Comparitech&en=page_view&_fv=1&_ss=1&ep.path_clean=%2Fnews%2Fransomhouse-claims-ransomware-attack-on-universite-paris-saclay-1tb-allegedly-stolen%2F&epn.screen_width=1600&epn.screen_height=1200&epn.viewport_width=1600&epn.viewport_height=1200&tfd=401
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-594Q6WX0ED&l=dataLayer&cx=c&gtm=45He4b70v71649924za200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.comparitech.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
text/plain
server
Golfe2
log
logs.convertexperiments.com/
2 B
165 B
Ping
General
Full URL
https://logs.convertexperiments.com/log
Requested by
Host: cdn-3.convertexperiments.com
URL: https://cdn-3.convertexperiments.com/js/10021806-1002820.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.121.108.89 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-121-108-89.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Content-Type
text/plain;charset=UTF-8
Referer
https://www.comparitech.com/

Response headers

access-control-allow-origin
https://www.comparitech.com
content-length
2
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
application/json; charset=utf-8
server
Apache
access-control-allow-credentials
true
/
1002820.metrics.convertexperiments.com/log-rep/
2 B
165 B
Ping
General
Full URL
https://1002820.metrics.convertexperiments.com/log-rep/
Requested by
Host: cdn-3.convertexperiments.com
URL: https://cdn-3.convertexperiments.com/js/10021806-1002820.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.121.108.89 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-121-108-89.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Content-Type
text/plain;charset=UTF-8
Referer
https://www.comparitech.com/

Response headers

access-control-allow-origin
https://www.comparitech.com
content-length
2
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
application/json; charset=utf-8
server
Apache
access-control-allow-credentials
true
cropped-favicon-1-32x32.jpg
cdn.comparitech.com/wp-content/uploads/2018/12/
706 B
1003 B
Other
General
Full URL
https://cdn.comparitech.com/wp-content/uploads/2018/12/cropped-favicon-1-32x32.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.232.222 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
edge.presslabs.net
Software
nginx /
Resource Hash
a45e35aa7b65fe3ccdf168510512bc83f12f8f6ed4107bae1d6e62a0eefb8fbd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1
Referer
https://www.comparitech.com/

Response headers

strict-transport-security
max-age=31536000; preload
x-request-id
b6d91931e1b09abba835a7e04c6c33f6
cache-control
max-age = 315360000
etag
"5c119555-2c2"
x-presslabs-cache
HIT
expires
Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges
bytes
content-length
706
date
Sun, 10 Nov 2024 16:17:15 GMT
content-type
image/jpeg
last-modified
Wed, 12 Dec 2018 23:10:13 GMT
server
nginx
vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| ajaxurl object| presslabs object| dataLayer object| COMPARITECH object| ak_js object| commentForm object| comparitech_frontend_data function| recaptcha_load function| login_recaptcha_success object| google_tag_manager object| google_tag_data function| btbCreateCookie function| btbReadCookie function| btbEraseCookie function| btbCheckCookie object| btbTestTracking function| checkValidUserId function| onYouTubeIframeAPIReady object| gaGlobal object| convertData object| matched function| REED_$ object| REED object| convert object| _conv_q object| _gaq function| ga object| _kmq string| CE_SNAPSHOT_NAME function| hj object| _hmt object| _czc object| emosGlobalProperties object| _paq object| _wt1Q function| _typeof function| _toConsumableArray function| _nonIterableSpread function| _unsupportedIterableToArray function| _iterableToArray function| _arrayWithoutHoles function| _arrayLikeToArray object| ClickTracker function| ready string| btbVars string| btbDiag

5 Cookies

Domain/Path Name / Value
.comparitech.com/ Name: _ga_MDHRS9ZYXE
Value: GS1.1.1731255435.1.0.1731255435.0.0.0
.comparitech.com/ Name: _ga
Value: GA1.1.1530981561.1731255436
.comparitech.com/ Name: _conv_v
Value: vi%3A1*sc%3A1*cs%3A1731255436*fs%3A1731255436*pv%3A1*exp%3A%7B100251965.%7Bv.1002827405-g.%7B%7D%7D%7D
.comparitech.com/ Name: _conv_s
Value: si%3A1*sh%3A1731255435868-0.1784106853428964*pv%3A1
.comparitech.com/ Name: _ga_594Q6WX0ED
Value: GS1.1.1731255435.1.0.1731255435.0.0.0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1002820.metrics.convertexperiments.com
cdn-3.convertexperiments.com
cdn.comparitech.com
logs.convertexperiments.com
pro.ip-api.com
region1.google-analytics.com
www.comparitech.com
www.googletagmanager.com
136.243.171.225
148.251.232.222
2001:4860:4802:32::36
23.192.81.15
2a00:1450:4001:830::2008
3.121.108.89
51.77.64.70
0810d91c763fc9463c1fb35559874d33d4efac948a7ddff6e824a415d235261f
150e49de5a091691a5d801ff3ac637cd6bfdb73cf482595813fb5bbccd0a5307
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
5995014cd71adbf3736442c9fa86bc48d954f2484d27c662fda977703522f2bf
5b8b1f6509786cbdcff2bad6ec4a8a9159d403f854e0eacb48057902cc043e0f
5e8f8a3cb8ae828ac0cef53ec7cd786fd2733780c831b8e79e6d16c7fb10b434
62185bf234f63022568bde233d3f0cff15af3a6c30c651b2071029f5f3b40382
67628ee9e60a7d3e957051e3cbf08f3da905841cc83f9ce9da0c2a891a35ae4a
677a97228a509a4f6ce6fc37c55a93bda3615653a564f8f99b06497293a96b7f
693ca7e4612ce0f2b6e60dda8a98d37a83e5e5341724bcb796caed828d6472b3
6bc5622bfab1a16855ad49b99a3f9ed8eb24f49da469a113f9000b866f109e2e
6cddb69ed120db073795c5c2a04676214476161606e518f483689b93bd928ae3
75693201e665ffb66eb2c8743226e9e32eac7b16b82456f5f84223581cf43913
866f60df81bcd8aae53267f4ff7a6159639a388032c48f5843c929799c54d01c
876bed21d939592a2479ed29d063f9889fcfff433fc7e0901392943ecc7e5209
8f5064e162b184b1ea54c9e148a4eb57202d567c1fc1e3ac91b4a200fc2ddba6
9a7c6310f197157c62a9f681c2ca02d66d60b318675f056bcf652d71ea2b1072
a45e35aa7b65fe3ccdf168510512bc83f12f8f6ed4107bae1d6e62a0eefb8fbd
ae6f507848181d7aac6c0b5a4a6b5f2f9d48fe07769b2eeee1357df7560e3d17
c18d89bb095e1cb26d37e8e757d031aefcf2f54fbe7d80a84b23554ad8e31454