urlscan.io logo urlscan.io
SecurityTrails logo

nawbo-sf.org Open in urlscan Pro
66.221.65.15  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://nawbo-sf.org/cdm/Doc.php
Submission: On January 20 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 4 countries across 8 domains to perform 20 HTTP transactions. The main IP is 66.221.65.15, located in Dallas, United States and belongs to CORESPACE-DAL, US. The main domain is nawbo-sf.org.
TLS certificate: Issued by R3 on December 20th 2020. Valid for: 3 months.
This is the only time nawbo-sf.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

1    66.221.65.15 (Dallas, United States)

ASN54489 (CORESPACE-DAL, US)
PTR: form-maker.com
nawbo-sf.org
13    45.60.13.52 (United States)

ASN19551 (INCAPSULA, US)
cdn.clareitysecurity.net
collector.clareity.net
1    2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a02:26f0:6c00:280::35b2 (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)
www.rackspace.com
1    2a00:1450:4001:815::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c08::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
Domain Requested by
11 cdn.clareitysecurity.net nawbo-sf.org
cdn.clareitysecurity.net
2 collector.clareity.net nawbo-sf.org
2 www.google-analytics.com cdn.clareitysecurity.net
www.google-analytics.com
1 stats.g.doubleclick.net www.google-analytics.com
1 fonts.gstatic.com fonts.googleapis.com
1 www.rackspace.com nawbo-sf.org
1 fonts.googleapis.com nawbo-sf.org
1 nawbo-sf.org
20 8

This site contains no links.

Subject Issuer Validity Valid
www.nawbo-sf.org
R3		 2020-12-20 -
2021-03-20		 3 months crt.sh
cdn.clareitysecurity.net
DigiCert SHA2 High Assurance Server CA		 2020-03-31 -
2022-04-05		 2 years crt.sh
upload.video.google.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
www.rackspace.com
DigiCert ECC Extended Validation Server CA		 2020-04-23 -
2022-07-23		 2 years crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.clareity.net
DigiCert SHA2 High Assurance Server CA		 2020-01-06 -
2022-01-10		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://nawbo-sf.org/cdm/Doc.php
Frame ID: C0C27FABBD00B584D678B57AB65B4B4B
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • script /bootstrap[.-]([\d.]*\d)[^/]*\.js/i
Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

20
Requests

100 %
HTTPS

75 %
IPv6

8
Domains

8
Subdomains

9
IPs

4
Countries

408 kB
Transfer

664 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Doc.php
nawbo-sf.org/cdm/ 		19 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nawbo-sf.org/cdm/Doc.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
66.221.65.15 Dallas, United States, ASN54489 (CORESPACE-DAL, US),
Reverse DNS
form-maker.com
Software
Apache/2.4.46 (cPanel) OpenSSL/1.1.1h mod_bwlimited/1.4 mod_fcgid/2.3.9 /
Resource Hash
a9f9abc37179eb5f890c9d0b832fede3ea03e7edee845ddf69049054d5b118e4

Request headers

Host
nawbo-sf.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:22 GMT
Server
Apache/2.4.46 (cPanel) OpenSSL/1.1.1h mod_bwlimited/1.4 mod_fcgid/2.3.9
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
bootstrap-4.1.2.min.css
cdn.clareitysecurity.net/css/ 		139 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/css/bootstrap-4.1.2.min.css
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
cd5525bc887734465161af57feaa4d63c3f5681cb477816b23b6e17d94995707

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
Transfer-Encoding
chunked
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
4-11548724-11548765 NNNN CT(6 7 0) RT(1610378622245 188) q(0 0 0 6) r(0 0) U5, 8-1112323-1112325 NNNN CT(17 37 0) RT(1611164962878 34) q(0 0 0 1) r(0 1) U5
Connection
keep-alive
Content-Encoding
gzip
Alt-Svc
clear
Last-Modified
Tue, 29 Sep 2020 01:31:52 GMT
Server
NetDNA-cache/2.2
ETag
W/"142041-1601343112000"
Content-Type
text/css
Access-Control-Allow-Origin
*
Link
<https://cdn.clareity.net/css/bootstrap-4.1.2.min.css>; rel="canonical"
css
fonts.googleapis.com/ 		6 KB
788 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,400,700
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5018230bc803da921c5e52b4c9e13973754ca8819e302dfe47320decd606a335
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 20 Jan 2021 16:48:24 GMT
server
ESF
date
Wed, 20 Jan 2021 17:49:23 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 20 Jan 2021 17:49:23 GMT
font-awesome-4.6.3.min.css
cdn.clareitysecurity.net/css/ 		28 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/css/font-awesome-4.6.3.min.css
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
277f19546c365ff5a65f44fa6d7d3278a90ee38320f00d02d6386e728df5cb42

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
Transfer-Encoding
chunked
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
4-17165771-17165804 NNNN CT(1 4 0) RT(1610407850322 193) q(0 0 0 2) r(0 0) U5, 10-1809341-1809343 NNNN CT(16 38 0) RT(1611164962879 33) q(0 0 0 1) r(0 0) U5
Connection
keep-alive
Content-Encoding
gzip
Alt-Svc
clear
Last-Modified
Tue, 29 Sep 2020 01:53:05 GMT
Server
NetDNA-cache/2.2
ETag
W/"29117-1601344385000"
Content-Type
text/css
Access-Control-Allow-Origin
*
Link
<https://cdn.clareity.net/css/font-awesome-4.6.3.min.css>; rel="canonical"
iam-login.css
cdn.clareitysecurity.net/sys/realcomp/ 		8 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/sys/realcomp/iam-login.css
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
84a8531ee0c87808a552bef2eda6855cbe2bd788ac215d32336cc8a9b16eabdc

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
Transfer-Encoding
chunked
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
10-194265096-194265113 NNNN CT(0 3 0) RT(1609324081055 190) q(0 0 0 0) r(1 1) U5, 3-1263044-1263046 NNNN CT(17 37 0) RT(1611164962880 33) q(0 0 0 0) r(0 0) U5
Connection
keep-alive
Content-Encoding
gzip
Alt-Svc
clear
Last-Modified
Tue, 29 Sep 2020 01:54:53 GMT
Server
NetDNA-cache/2.2
ETag
W/"8211-1601344493000"
Content-Type
text/css
Access-Control-Allow-Origin
*
Link
<https://cdn.clareity.net/sys/realcomp/iam-login.css>; rel="canonical"
googletrack.js
cdn.clareitysecurity.net/js/ 		407 B
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/js/googletrack.js
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
c28d92e4babc773d73863b4bfeec2547559b58dca63455cd606c0f3fd5cc18d5

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
Transfer-Encoding
chunked
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
10-197779154-197779197 NNNN CT(7 3 0) RT(1609345372099 191) q(0 0 1 2) r(1 1) U5, 4-1879599-1879602 NNNN CT(17 43 0) RT(1611164962880 33) q(0 0 0 0) r(0 0) U5
Connection
keep-alive
Content-Encoding
gzip
Alt-Svc
clear
Last-Modified
Tue, 29 Sep 2020 01:54:41 GMT
Server
NetDNA-cache/2.2
ETag
W/"407-1601344481000"
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Link
<https://cdn.clareity.net/js/googletrack.js>; rel="canonical"
o365-logo.svg
www.rackspace.com/themes/custom/rackspace/libraries/zoolander2/dist/imgs/derek/o365/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rackspace.com/themes/custom/rackspace/libraries/zoolander2/dist/imgs/derek/o365/o365-logo.svg
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:280::35b2 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
3604a101c079a5106f325beb22e2c9bc142045c7b150ffad492bc8debbf5d853
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 17 Dec 2020 01:12:07 GMT
server
Apache
etag
"120c-5b69eae3e9ed2"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=31536000
date
Wed, 20 Jan 2021 17:49:23 GMT
accept-ranges
bytes
content-length
2203
expires
Fri, 17 Dec 2021 02:28:24 GMT
jquery-3.3.1.min.js
cdn.clareitysecurity.net/js/ 		85 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/js/jquery-3.3.1.min.js
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
Transfer-Encoding
chunked
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
3-37519426-37519443 NNNY CT(0 0 0) RT(1610249888401 184) q(0 0 0 0) r(1 1) U5, 5-2395872-2395873 NNNN CT(16 38 0) RT(1611164962880 33) q(0 0 0 0) r(0 1) U5
Connection
keep-alive
Content-Encoding
gzip
Alt-Svc
clear
Last-Modified
Tue, 29 Sep 2020 01:54:41 GMT
Server
NetDNA-cache/2.2
ETag
W/"86927-1601344481000"
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Link
<https://cdn.clareity.net/js/jquery-3.3.1.min.js>; rel="canonical"
script-xkd.2.js
cdn.clareitysecurity.net/js/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/js/script-xkd.2.js
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
21fe87d73360a51899be9fbba8514e8f539149e68ffeaa1503cec2a684f75224

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
Transfer-Encoding
chunked
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
1-4927874-4927890 NNNN CT(1 3 0) RT(1610387564130 183) q(0 0 0 0) r(0 0) U5, 9-1431048-1431049 NNNN CT(17 39 0) RT(1611164962881 32) q(0 0 0 0) r(0 0) U5
Connection
keep-alive
Content-Encoding
gzip
Alt-Svc
clear
Last-Modified
Tue, 29 Sep 2020 01:54:41 GMT
Server
NetDNA-cache/2.2
ETag
W/"12955-1601344481000"
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Link
<https://cdn.clareity.net/js/script-xkd.2.js>; rel="canonical"
bootstrap-4.4.1.min.js
cdn.clareitysecurity.net/js/ 		59 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/js/bootstrap-4.4.1.min.js
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
2ddc752c921c073e6558c329f8392d42d6fbda4c690fcba532a66392d3ea0b87

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
Transfer-Encoding
chunked
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
5-222254922-222254967 NNNN CT(4 3 0) RT(1609353908849 203) q(0 0 0 1) r(1 1) U5, 9-1431048-1431049 SNNN RT(1611164962881 140) q(0 0 0 1) r(0 0) U5
Connection
keep-alive
Content-Encoding
gzip
Alt-Svc
clear
Last-Modified
Tue, 29 Sep 2020 01:54:41 GMT
Server
NetDNA-cache/2.2
ETag
W/"59969-1601344481000"
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Link
<https://cdn.clareity.net/js/bootstrap-4.4.1.min.js>; rel="canonical"
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cdn.clareitysecurity.net
URL: https://cdn.clareitysecurity.net/js/googletrack.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
1791
date
Wed, 20 Jan 2021 17:19:32 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Wed, 20 Jan 2021 19:19:32 GMT
linen.png
cdn.clareitysecurity.net/images/ 		45 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.clareitysecurity.net/images/linen.png
Requested by
Host: cdn.clareitysecurity.net
URL: https://cdn.clareitysecurity.net/sys/realcomp/iam-login.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
0714969b57ac63c5b5f5c0491e1a42f4c830e64b9883935e12f6f21f99cfdc24

Request headers

Referer
https://cdn.clareitysecurity.net/sys/realcomp/iam-login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
4-86177781-86177808 NNNN CT(10 9 0) RT(1611086447543 657) q(0 1 1 4) r(1 1) U5, 8-1112323-1112325 SNNN RT(1611164962878 204) q(0 0 0 4) r(1 1) U5
Connection
keep-alive
Alt-Svc
clear
Content-Length
45585
Last-Modified
Tue, 29 Sep 2020 01:54:41 GMT
Server
NetDNA-cache/2.2
ETag
W/"45585-1601344481000"
Content-Type
image/png
Access-Control-Allow-Origin
*
Accept-Ranges
bytes
Link
<https://cdn.clareity.net/images/linen.png>; rel="canonical"
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://nawbo-sf.org
Referer
https://fonts.googleapis.com/css?family=Roboto:300,400,700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 14 Jan 2021 16:12:05 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
524238
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11016
x-xss-protection
0
expires
Fri, 14 Jan 2022 16:12:05 GMT
fontawesome-webfont.woff2
cdn.clareitysecurity.net/fonts/fa-4.6.3/ 		70 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/fonts/fa-4.6.3/fontawesome-webfont.woff2?v=4.6.3
Requested by
Host: cdn.clareitysecurity.net
URL: https://cdn.clareitysecurity.net/css/font-awesome-4.6.3.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Origin
https://nawbo-sf.org
Referer
https://cdn.clareitysecurity.net/css/font-awesome-4.6.3.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
7-25032620-25032634 NNNN CT(1 2 0) RT(1610865294708 178) q(0 0 0 0) r(1 1) U5, 5-2395878-2395873 PNNN RT(1611164963104 35) q(0 0 0 1) r(0 0) U5
Connection
keep-alive
Alt-Svc
clear
Content-Length
71896
Last-Modified
Tue, 29 Sep 2020 01:54:39 GMT
Server
NetDNA-cache/2.2
ETag
W/"71896-1601344479000"
Content-Type
application/font-woff2
Access-Control-Allow-Origin
*
Accept-Ranges
bytes
Link
<https://cdn.clareity.net/fonts/fa-4.6.3/fontawesome-webfont.woff2>; rel="canonical"
password.ttf
cdn.clareitysecurity.net/fonts/ 		125 KB
126 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/fonts/password.ttf
Requested by
Host: cdn.clareitysecurity.net
URL: https://cdn.clareitysecurity.net/sys/realcomp/iam-login.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
5585d482c2eee6acbeca5fe3d9ffaad32b15c5b26995ee345b0208f557571155

Request headers

Origin
https://nawbo-sf.org
Referer
https://cdn.clareitysecurity.net/sys/realcomp/iam-login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
7-14506177-14506191 NNNN CT(1 3 0) RT(1610485408850 179) q(0 0 0 0) r(0 0) U5, 2-847492-847493 NNNN CT(6 7 0) RT(1611164963122 36) q(0 0 0 0) r(0 0) U5
Connection
keep-alive
Alt-Svc
clear
Content-Length
127740
Last-Modified
Tue, 29 Sep 2020 01:54:39 GMT
Server
NetDNA-cache/2.2
ETag
W/"127740-1601344479000"
Content-Type
font/truetype
Access-Control-Allow-Origin
*
Accept-Ranges
bytes
Link
<https://cdn.clareity.net/fonts/password.ttf>; rel="canonical"
style-xkd.2.css
cdn.clareitysecurity.net/css/ 		6 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.clareitysecurity.net/css/style-xkd.2.css
Requested by
Host: cdn.clareitysecurity.net
URL: https://cdn.clareitysecurity.net/js/jquery-3.3.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
e3e343f02abb359b929059100559be60b2499b0183c7556d9640316b2c31da9b

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 17:49:23 GMT
Via
1.1 google
X-CDN
Incapsula, Incapsula
Transfer-Encoding
chunked
X-Cache
HIT
P3P
CP="CAO PSA OUR"
X-Iinfo
11-6439558-6439606 NNNN CT(1 2 0) RT(1610571532995 181) q(0 0 0 0) r(1 1) U5, 5-2395872-2395873 SNNN RT(1611164962880 229) q(0 0 0 0) r(0 0) U5
Connection
keep-alive
Content-Encoding
gzip
Alt-Svc
clear
Last-Modified
Tue, 29 Sep 2020 01:53:06 GMT
Server
NetDNA-cache/2.2
ETag
W/"5764-1601344386000"
Content-Type
text/css
Access-Control-Allow-Origin
*
Link
<https://cdn.clareity.net/css/style-xkd.2.css>; rel="canonical"
1606202700019
collector.clareity.net/Collector/ 		0
775 B 		Script
General
Check archive.org
Download Go to
Full URL
https://collector.clareity.net/Collector/1606202700019?team=nguage&systemName=realcomp&data={%22resolution%22:%221600x1200%22,%20%22userAgent%22:%22Mozilla/5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/83.0.4103.61%20Safari/537.36%22,%20%22language%22:%22en-US%22,%20%22timezone%22:%22-60%22,%20%22platform%22:%22Linux%20x86_64%22,%20%22db0%22:%22true%22,%20%22db1%22:%22function%22,%20%22plugins%22:%22%22,%20%22canvas%22:%22none%22%20}
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Jan 2021 17:49:23 GMT
via
1.1 google
server
Apache-Coyote/1.1
p3p
CP="CAO PSA OUR"
x-iinfo
1-594345-594347 NNNN CT(3 4 0) RT(1611164963303 0) q(0 0 0 2) r(1 1) U5
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-type
text/javascript
alt-svc
clear
content-length
0
x-cdn
Incapsula
expires
Thu, 01 Jan 1970 00:00:00 GMT
collect
www.google-analytics.com/j/ 		4 B
68 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=542686177&t=pageview&_s=1&dl=https%3A%2F%2Fnawbo-sf.org%2Fcdm%2FDoc.php&ul=en-us&de=UTF-8&dt=Login&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1365572542&gjid=418997971&cid=1881471350.1611164963&tid=UA-45101381-2&_gid=537720340.1611164963&_r=1&_slc=1&z=1676330004
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 20 Jan 2021 17:49:23 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://nawbo-sf.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
1606202700019
collector.clareity.net/Collector/ 		0
617 B 		Script
General
Check archive.org
Download Go to
Full URL
https://collector.clareity.net/Collector/1606202700019?team=geo&systemName=realcomp&data={%22geoerror%22:%221%20%28User%20denied%20Geolocation%29%22%20}
Requested by
Host: nawbo-sf.org
URL: https://nawbo-sf.org/cdm/Doc.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.13.52 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Jan 2021 17:49:22 GMT
via
1.1 google
server
Apache-Coyote/1.1
p3p
CP="CAO PSA OUR"
x-iinfo
1-594346-594348 NNNN CT(1 5 0) RT(1611164963304 0) q(0 0 0 7) r(1 1) U5
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-type
text/javascript
alt-svc
clear
content-length
0
x-cdn
Incapsula
expires
Thu, 01 Jan 1970 00:00:00 GMT
truncated
/ 		945 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a3ff15eda4b7f0a424713e0483b4b1be2de7abef795596b086a60cee22575286

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
collect
stats.g.doubleclick.net/j/ 		1 B
83 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-45101381-2&cid=1881471350.1611164963&jid=1365572542&gjid=418997971&_gid=537720340.1611164963&_u=YEBAAUAAAAAAAC~&z=1064454893
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c08::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://nawbo-sf.org/cdm/Doc.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 20 Jan 2021 17:49:23 GMT
content-type
text/plain
access-control-allow-origin
https://nawbo-sf.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

70 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| GoogleAnalyticsObject function| ga function| $ function| jQuery object| scriptId string| url boolean| qaUrl string| pleasewait boolean| disablepage string| cdnUrl boolean| inputHasFocus boolean| isValid string| inputs object| hiddenUsernameField object| hiddenPasswordField object| hiddenPinField boolean| hasPin boolean| hasOtp boolean| hasCrq boolean| login boolean| saveUser undefined| loginBtnId string| warnalert boolean| geolocationOn boolean| fingerprintOn object| ClareityTimer object| ClareityUtils function| hideshow undefined| disablePageData function| getCookie string| sj_username function| checkCookie function| setUserCookie function| keyPress string| ua boolean| isAndroid function| inputCheck number| idpTimeout number| secondsLeft string| sessionDialogHtml function| sessionPop function| sessionCount function| runSessionDialog function| fileCheck object| bootstrap object| CLAREITY object| CLAREITY_FP object| CLAREITY_NG object| CLAREITY_GEO function| _instanceof function| _classCallCheck function| _defineProperties function| _createClass function| _defineProperty string| iwork function| CLAREITY_KD object| clareityrisk object| google_tag_data object| gaplugins object| gaGlobal object| gaData

3 Cookies

Domain/Path Name / Value
.nawbo-sf.org/ Name: _gat
Value: 1
.nawbo-sf.org/ Name: _gid
Value: GA1.2.537720340.1611164963
.nawbo-sf.org/ Name: _ga
Value: GA1.2.1881471350.1611164963

4 Console Messages

Source Level URL
Text
console-api log URL: https://nawbo-sf.org/cdm/Doc.php(Line 83)
Message:
fingerprint on
console-api log URL: https://nawbo-sf.org/cdm/Doc.php(Line 217)
Message:
geolocation on
console-api log URL: https://nawbo-sf.org/cdm/Doc.php(Line 331)
Message:
[object Object]
console-api log URL: https://nawbo-sf.org/cdm/Doc.php(Line 343)
Message:
called KD hook event

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.clareitysecurity.net
collector.clareity.net
fonts.googleapis.com
fonts.gstatic.com
nawbo-sf.org
stats.g.doubleclick.net
www.google-analytics.com
www.rackspace.com
2a00:1450:4001:800::200e
2a00:1450:4001:802::200a
2a00:1450:4001:809::2003
2a00:1450:4001:815::200e
2a00:1450:400c:c08::9d
2a02:26f0:6c00:280::35b2
45.60.13.52
66.221.65.15
0714969b57ac63c5b5f5c0491e1a42f4c830e64b9883935e12f6f21f99cfdc24
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
21fe87d73360a51899be9fbba8514e8f539149e68ffeaa1503cec2a684f75224
277f19546c365ff5a65f44fa6d7d3278a90ee38320f00d02d6386e728df5cb42
2ddc752c921c073e6558c329f8392d42d6fbda4c690fcba532a66392d3ea0b87
3604a101c079a5106f325beb22e2c9bc142045c7b150ffad492bc8debbf5d853
5018230bc803da921c5e52b4c9e13973754ca8819e302dfe47320decd606a335
5585d482c2eee6acbeca5fe3d9ffaad32b15c5b26995ee345b0208f557571155
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
84a8531ee0c87808a552bef2eda6855cbe2bd788ac215d32336cc8a9b16eabdc
a3ff15eda4b7f0a424713e0483b4b1be2de7abef795596b086a60cee22575286
a9f9abc37179eb5f890c9d0b832fede3ea03e7edee845ddf69049054d5b118e4
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
c28d92e4babc773d73863b4bfeec2547559b58dca63455cd606c0f3fd5cc18d5
cd5525bc887734465161af57feaa4d63c3f5681cb477816b23b6e17d94995707
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e343f02abb359b929059100559be60b2499b0183c7556d9640316b2c31da9b
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b