balmoralmortgagebrokers.com Open in urlscan Pro
192.254.232.227  Malicious Activity! Public Scan

URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Submission: On February 24 via automatic, source openphish — Scanned from DE

Summary

This website contacted 10 IPs in 3 countries across 4 domains to perform 24 HTTP transactions. The main IP is 192.254.232.227, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is balmoralmortgagebrokers.com.
This is the only time balmoralmortgagebrokers.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Daum (Online)

Domain & IP information

IP Address AS Autonomous System
1 192.254.232.227 46606 (UNIFIEDLA...)
3 203.133.167.18 9764 (DAUM-NET ...)
9 2a03:5f80:a::... 50952 (DATAIX-AS...)
1 121.53.105.218 38099 (KAKAO-AS-...)
1 211.231.108.164 38099 (KAKAO-AS-...)
1 27.0.237.134 38099 (KAKAO-AS-...)
1 4 121.53.104.76 38099 (KAKAO-AS-...)
1 2a03:5f80:a::... 50952 (DATAIX-AS...)
2 211.249.221.119 9457 (DREAMX-AS...)
2 121.53.202.253 9457 (DREAMX-AS...)
24 10
Apex Domain
Subdomains
Transfer
11 daumcdn.net
t1.daumcdn.net — Cisco Umbrella Rank: 20372
m1.daumcdn.net — Cisco Umbrella Rank: 75577
img1.daumcdn.net — Cisco Umbrella Rank: 47581
201 KB
11 daum.net
logins.daum.net — Cisco Umbrella Rank: 152641
display.ad.daum.net — Cisco Umbrella Rank: 30527
track.tiara.daum.net — Cisco Umbrella Rank: 366960
webid.ad.daum.net — Cisco Umbrella Rank: 75140
ka.ad.daum.net — Cisco Umbrella Rank: 93642
kyson.ad.daum.net — Cisco Umbrella Rank: 40564
22 KB
2 kakao.com
developers.kakao.com — Cisco Umbrella Rank: 44494
webid.kakao.com — Cisco Umbrella Rank: 93549
111 KB
1 balmoralmortgagebrokers.com
balmoralmortgagebrokers.com
5 KB
24 4
Domain Requested by
9 t1.daumcdn.net balmoralmortgagebrokers.com
logins.daum.net
t1.daumcdn.net
3 logins.daum.net balmoralmortgagebrokers.com
2 kyson.ad.daum.net balmoralmortgagebrokers.com
2 ka.ad.daum.net balmoralmortgagebrokers.com
2 track.tiara.daum.net balmoralmortgagebrokers.com
1 img1.daumcdn.net t1.daumcdn.net
1 webid.kakao.com balmoralmortgagebrokers.com
1 webid.ad.daum.net 1 redirects
1 display.ad.daum.net t1.daumcdn.net
1 m1.daumcdn.net balmoralmortgagebrokers.com
1 developers.kakao.com balmoralmortgagebrokers.com
1 balmoralmortgagebrokers.com
24 12

This site contains links to these domains. Also see Links.

Domain
www.daum.net
member.daum.net
www.kakaocorp.com
cs.daum.net
Subject Issuer Validity Valid
logins.daum.net
DigiCert SHA2 Extended Validation Server CA
2020-04-23 -
2022-06-24
2 years crt.sh
*.daumcdn.net
DigiCert SHA2 Secure Server CA
2021-09-29 -
2022-09-29
a year crt.sh
*.kakao.com
Thawte TLS RSA CA G1
2021-09-17 -
2022-09-30
a year crt.sh
ad.daum.net
Thawte TLS RSA CA G1
2022-01-25 -
2023-01-31
a year crt.sh
www.tiara.kakao.com
Thawte TLS RSA CA G1
2021-09-17 -
2022-08-06
a year crt.sh

This page contains 2 frames:

Primary Page: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Frame ID: DD2ECF69C7CB264452302F29A3B5BFB8
Requests: 16 HTTP requests in this frame

Frame: https://t1.daumcdn.net/adfit/adunit_style/6ab5ec5b821bc9bc6aad6210feec8add27278b51
Frame ID: 6CF05774F4487D77CA2BC9AA26D97296
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Daum 로그인

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

24
Requests

83 %
HTTPS

20 %
IPv6

4
Domains

12
Subdomains

10
IPs

3
Countries

337 kB
Transfer

608 kB
Size

8
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13
  • https://webid.ad.daum.net/sync?v=0.0.1 HTTP 302
  • https://webid.kakao.com/sync?data=FN0MNyo1uZYrM2dGkDPriZmUbEFnVOS4lv70IbzOINmKzrQ8XUfBpk4QYQegBdAHHHnyw4uIhDMWLQ0PJ2eb4LAZkalVGkSk9nNQtasrssFQKTaqTcEQ%2BGZpHcc8eFyp

24 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Daum1.html
balmoralmortgagebrokers.com/sxde/Daum/
13 KB
5 KB
Document
General
Full URL
http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
HTTP/1.1
Server
192.254.232.227 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-254-232-227.unifiedlayer.com
Software
Apache /
Resource Hash
e82da83961ca0207a8ce5269c8c06ebaf04b9e6e1159f571e312255b6aef74a2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Thu, 24 Feb 2022 13:16:05 GMT
Server
Apache
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Last-Modified
Thu, 24 Feb 2022 00:50:19 GMT
Accept-Ranges
none
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
4601
Keep-Alive
timeout=5, max=75
Content-Type
text/html
pc.css
logins.daum.net/contents/min/css/
17 KB
4 KB
Stylesheet
General
Full URL
https://logins.daum.net/contents/min/css/pc.css
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
203.133.167.18 , Korea, Republic Of, ASN9764 (DAUM-NET Kakao Corp, KR),
Reverse DNS
Software
Apache Tomcat /
Resource Hash
3e70b4792cec8323f565abd7afe03f39ee6516a8cb4a44fbdd8a26057f3efa77

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 13:16:07 GMT
Content-Encoding
gzip
Last-Modified
Thu, 24 Feb 2022 08:38:36 GMT
Server
Apache Tomcat
ETag
W/"17063-1645691916000"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Accept-Ranges
bytes
font_pc.css
logins.daum.net/contents/min/css/
0
0
Stylesheet
General
Full URL
https://logins.daum.net/contents/min/css/font_pc.css
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
203.133.167.18 , Korea, Republic Of, ASN9764 (DAUM-NET Kakao Corp, KR),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

jquery-1.12.1.min.js
t1.daumcdn.net/id/statics/common/js-lib/
95 KB
33 KB
Script
General
Full URL
https://t1.daumcdn.net/id/statics/common/js-lib/jquery-1.12.1.min.js
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:5f80:a::b212:e7a3 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
openresty /
Resource Hash
2359d383bf2d4ab65ebf7923bdf74ce40e4093f6e58251b395a64034b3c39772

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:06 GMT
content-encoding
gzip
last-modified
Tue, 05 Dec 2017 04:26:37 GMT
server
openresty
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=283840527
x-wcss
dC1jb21tb24wMS1id2NhY2hlNDE6MDpjaHR0cDoxNw==
accept-ranges
bytes
content-length
33894
expires
Sat, 22 Feb 2031 17:51:33 GMT
jquery.cookie-1.3.1.min.js
t1.daumcdn.net/id/statics/common/js-lib/
1000 B
777 B
Script
General
Full URL
https://t1.daumcdn.net/id/statics/common/js-lib/jquery.cookie-1.3.1.min.js
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:5f80:a::b212:e7a3 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
openresty /
Resource Hash
e59bba1708d06698afe08ebc4c9ce3c9a14e1fca0d7826e824bd6ed04a153b54

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:06 GMT
content-encoding
gzip
last-modified
Tue, 12 Dec 2017 07:29:04 GMT
server
openresty
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=283842239
x-wcss
dC1jb21tb24wMS1id2NhY2hlMjY6MDpjaHR0cDoyMw==
accept-ranges
bytes
content-length
556
expires
Sat, 22 Feb 2031 18:20:05 GMT
kakao.min.js
developers.kakao.com/sdk/js/
109 KB
110 KB
Script
General
Full URL
https://developers.kakao.com/sdk/js/kakao.min.js
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
121.53.105.218 , Korea, Republic Of, ASN38099 (KAKAO-AS-KR Kakao Corp, KR),
Reverse DNS
Software
/
Resource Hash
ef5834fb849172f0b9759ce7dce4916ea6434afe0bd8bd16677db4afe42d44fd
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:06 GMT
last-modified
Thu, 17 Feb 2022 02:25:23 GMT
strict-transport-security
max-age=15724800; includeSubDomains
content-type
application/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
content-length
112022
expires
Thu, 24 Feb 2022 14:16:06 GMT
login-default.js
logins.daum.net/contents/min/js/
36 KB
13 KB
Script
General
Full URL
https://logins.daum.net/contents/min/js/login-default.js
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
203.133.167.18 , Korea, Republic Of, ASN9764 (DAUM-NET Kakao Corp, KR),
Reverse DNS
Software
Apache Tomcat /
Resource Hash
da547e7e12687f15c5fbc3b7c4dd7a7aa94a54fb8191742e48faaa78aa36ffb5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 13:16:07 GMT
Content-Encoding
gzip
Last-Modified
Thu, 24 Feb 2022 08:38:36 GMT
Server
Apache Tomcat
ETag
W/"36902-1645691916000"
Vary
Accept-Encoding
Content-Type
application/javascript
Transfer-Encoding
chunked
Accept-Ranges
bytes
ad.min.js
t1.daumcdn.net/adfit/static/
2 KB
1 KB
Script
General
Full URL
http://t1.daumcdn.net/adfit/static/ad.min.js
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
HTTP/1.1
Server
2a03:5f80:a::b212:e7a3 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
/
Resource Hash
10397020b18155c46f267362d8c811c2a787ccf57dc2b5412b509f0a8d8ec7fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-WCSS
dC1jb21tb24wMS1id2NhY2hlMjQ6MDpjaHR0cDoxOA==
Date
Thu, 24 Feb 2022 13:16:08 GMT
Content-Encoding
gzip
Last-Modified
Mon, 01 Nov 2021 10:51:01 GMT
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=356
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1059
Expires
Thu, 24 Feb 2022 13:22:04 GMT
logo_daum.png
t1.daumcdn.net/id/logins/2020/
1 KB
1 KB
Image
General
Full URL
https://t1.daumcdn.net/id/logins/2020/logo_daum.png
Requested by
Host: logins.daum.net
URL: https://logins.daum.net/contents/min/css/pc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:5f80:a::b212:e7a3 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
openresty /
Resource Hash
50d4a8f26b0c851839a82ee89ac4cdbe92a520049d2cc005c45d04b872e6defe

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://logins.daum.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:08 GMT
last-modified
Thu, 14 May 2020 07:46:09 GMT
server
openresty
content-type
image/png
cache-control
max-age=15089
x-wcss
dC1jb21tb24wMS1id2NhY2hlMzU6MDpjaHR0cDowOQ==
accept-ranges
bytes
content-length
1306
expires
Thu, 24 Feb 2022 17:27:37 GMT
ico_login_201224.png
t1.daumcdn.net/id/logins/2020/
5 KB
5 KB
Image
General
Full URL
https://t1.daumcdn.net/id/logins/2020/ico_login_201224.png
Requested by
Host: logins.daum.net
URL: https://logins.daum.net/contents/min/css/pc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:5f80:a::b212:e7a3 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
openresty /
Resource Hash
6845a3538e9237f310d087c193a3626926bd22dd49041836614673b1fa553813

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://logins.daum.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:08 GMT
last-modified
Thu, 24 Dec 2020 00:08:34 GMT
server
openresty
content-type
image/png
cache-control
max-age=15962
x-wcss
dC1jb21tb24wMS1id2NhY2hlNTE6MDpjaHR0cDoxMw==
accept-ranges
bytes
content-length
5333
expires
Thu, 24 Feb 2022 17:42:10 GMT
td.min.js
m1.daumcdn.net/tiara/js/
38 KB
10 KB
Script
General
Full URL
http://m1.daumcdn.net/tiara/js/td.min.js
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
HTTP/1.1
Server
211.231.108.164 , Korea, Republic Of, ASN38099 (KAKAO-AS-KR Kakao Corp, KR),
Reverse DNS
Software
nginx /
Resource Hash
5ab4f05cbe1a5cf7b22b8609cefc5e0f09f8b8577fe9d9b2e775279045a027b4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 13:16:09 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Nov 2019 06:50:37 GMT
Server
nginx
Age
4343
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
text/javascript
Cache-Control
max-age=7200
X-WCSS
dC1jb21tb24wMS1id2NhY2hlNTM6MDpjaHR0cDoyMQ==
Accept-Ranges
bytes
Content-Length
10260
Expires
Thu, 24 Feb 2022 14:03:45 GMT
ba.min.js
t1.daumcdn.net/kas/static/
169 KB
50 KB
Script
General
Full URL
https://t1.daumcdn.net/kas/static/ba.min.js
Requested by
Host: t1.daumcdn.net
URL: http://t1.daumcdn.net/adfit/static/ad.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:5f80:a::b212:e7a3 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
openresty /
Resource Hash
cb88aab70e965565b9c96355273a6cb129715167c9a44872f17337429c16fe8f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:08 GMT
content-encoding
gzip
last-modified
Fri, 14 Jan 2022 02:03:59 GMT
server
openresty
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=319
x-wcss
dC1jb21tb24wMS1id2NhY2hlMTowOmNodHRwOjEz
accept-ranges
bytes
content-length
50828
expires
Thu, 24 Feb 2022 13:21:27 GMT
banner
display.ad.daum.net/sdk/
6 KB
3 KB
XHR
General
Full URL
https://display.ad.daum.net/sdk/banner?id=00Y28&sdktype=web&sdkver=4.1.5&secretmode=N&pxratio=1&pwidth=1600&pheight=1200&network=6&surl=http%3A%2F%2Fbalmoralmortgagebrokers.com%2Fsxde%2FDaum%2FDaum1.html&containerid=kakao_ad_2HqeOv&cookiedisabled=N&ppi=96&lmt=N&test=N&ctag=%7B%7D&rfseq=1&sdkid=525f0670-6632-4fc2-aeab-39e71a89ec61
Requested by
Host: t1.daumcdn.net
URL: https://t1.daumcdn.net/kas/static/ba.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
27.0.237.134 , Korea, Republic Of, ASN38099 (KAKAO-AS-KR Kakao Corp, KR),
Reverse DNS
Software
Apache /
Resource Hash
27be1d8a7ca2bb1dd3af0c1dbec5179e28c1e22696eed50c142d423af3fc3f99

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 13:16:09 GMT
Content-Encoding
gzip
Referrer-Policy
origin-when-cross-origin, strict-origin-when-cross-origin
Server
Apache
Vary
Origin,Accept-Encoding
P3P
CP="ALL CURa ADMa DEVa TAIa OUR BUS IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC OTC"
Access-Control-Allow-Origin
http://balmoralmortgagebrokers.com
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
close
Content-Type
application/json
Content-Length
1833
footsteps
track.tiara.daum.net/queen/
13 B
136 B
Image
General
Full URL
https://track.tiara.daum.net/queen/footsteps?dummy=1646108884757&ishome=U&referer=&title=Daum%20%EB%A1%9C%EA%B7%B8%EC%9D%B8&version=2.8.7&dpr=1&cke=Y&tz=0&rand_id=1645708569508&pck=Y&puid=1645708569508&url=http%3A%2F%2Fbalmoralmortgagebrokers.com%2Fsxde%2FDaum%2FDaum1.html
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
121.53.104.76 , Korea, Republic Of, ASN38099 (KAKAO-AS-KR Kakao Corp, KR),
Reverse DNS
Software
/
Resource Hash
7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:10 GMT
content-length
13
strict-transport-security
max-age=15724800; includeSubDomains
content-type
text/plain; charset=utf-8
sync
webid.kakao.com/
Redirect Chain
  • https://webid.ad.daum.net/sync?v=0.0.1
  • https://webid.kakao.com/sync?data=FN0MNyo1uZYrM2dGkDPriZmUbEFnVOS4lv70IbzOINmKzrQ8XUfBpk4QYQegBdAHHHnyw4uIhDMWLQ0PJ2eb4LAZkalVGkSk9nNQtasrssFQKTaqTcEQ%2BGZpHcc8eFyp
35 B
711 B
Image
General
Full URL
https://webid.kakao.com/sync?data=FN0MNyo1uZYrM2dGkDPriZmUbEFnVOS4lv70IbzOINmKzrQ8XUfBpk4QYQegBdAHHHnyw4uIhDMWLQ0PJ2eb4LAZkalVGkSk9nNQtasrssFQKTaqTcEQ%2BGZpHcc8eFyp
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
H2
Server
121.53.104.76 , Korea, Republic Of, ASN38099 (KAKAO-AS-KR Kakao Corp, KR),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 24 Feb 2022 13:16:11 GMT
x-frame-options
DENY
access-control-allow-methods
GET
p3p
CP="ALL DSP COR MON LAW IVDi HIS IVAi DELi SAMi OUR LEG PHY UNI ONL DEM STA INT NAV PUR FIN OTC GOV"
access-control-allow-origin
*
access-control-max-age
120
cache-control
no-cache, no-store
strict-transport-security
max-age=15724800; includeSubDomains
content-type
image/gif
content-length
35
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 24 Feb 2022 13:16:10 GMT
location
https://webid.kakao.com/sync?data=FN0MNyo1uZYrM2dGkDPriZmUbEFnVOS4lv70IbzOINmKzrQ8XUfBpk4QYQegBdAHHHnyw4uIhDMWLQ0PJ2eb4LAZkalVGkSk9nNQtasrssFQKTaqTcEQ%2BGZpHcc8eFyp
x-frame-options
DENY
access-control-allow-methods
GET
p3p
CP="ALL DSP COR MON LAW IVDi HIS IVAi DELi SAMi OUR LEG PHY UNI ONL DEM STA INT NAV PUR FIN OTC GOV"
access-control-allow-origin
*
access-control-max-age
120
cache-control
no-cache, no-store
strict-transport-security
max-age=15724800; includeSubDomains
content-type
image/gif
content-length
35
expires
Thu, 01 Jan 1970 00:00:00 GMT
6ab5ec5b821bc9bc6aad6210feec8add27278b51
t1.daumcdn.net/adfit/adunit_style/ Frame 6CF0
30 KB
12 KB
Document
General
Full URL
https://t1.daumcdn.net/adfit/adunit_style/6ab5ec5b821bc9bc6aad6210feec8add27278b51
Requested by
Host: t1.daumcdn.net
URL: https://t1.daumcdn.net/kas/static/ba.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:5f80:a::b212:e7a3 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
openresty /
Resource Hash
cc2772141486c562b3b146084eff380f02162af3fc239548767b3047504a5091

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/

Response headers

server
openresty
content-type
text/html
last-modified
Thu, 24 Feb 2022 01:04:17 GMT
accept-ranges
bytes
x-wcss
dC1jb21tb24wMS1id2NhY2hlNTg6MDpjaHR0cDoyNQ==
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=16909
expires
Thu, 24 Feb 2022 17:57:59 GMT
date
Thu, 24 Feb 2022 13:16:10 GMT
content-length
11568
/
img1.daumcdn.net/thumb/S500x500/ Frame 6CF0
81 KB
81 KB
Image
General
Full URL
https://img1.daumcdn.net/thumb/S500x500/?fname=https://t1.kakaocdn.net/kakao_ka_public/creative/337737-f5b90f67-33f2-4cb1-8881-45f0825ddf75.jpg&scode=b2_01
Requested by
Host: t1.daumcdn.net
URL: https://t1.daumcdn.net/adfit/adunit_style/6ab5ec5b821bc9bc6aad6210feec8add27278b51
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:5f80:a::b212:e7ab , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
openresty /
Resource Hash
1559c8b1d40c236e2d2ffaafd4065a52d0f9e0449d7fb9a76b9b9de2777774bb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://t1.daumcdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:10 GMT
last-modified
Wed, 16 Feb 2022 00:52:50 GMT
server
openresty
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=241
x-wcss
dC1pbWcwMS1id2NhY2hlNTY6MDpjaHR0cDowNg==
accept-ranges
bytes
content-length
82498
expires
Thu, 24 Feb 2022 13:20:11 GMT
pixel.png
t1.daumcdn.net/biz/ui/adshopping/ Frame 6CF0
930 B
1 KB
Image
General
Full URL
https://t1.daumcdn.net/biz/ui/adshopping/pixel.png
Requested by
Host: t1.daumcdn.net
URL: https://t1.daumcdn.net/adfit/adunit_style/6ab5ec5b821bc9bc6aad6210feec8add27278b51
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:5f80:a::b212:e7a3 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
openresty /
Resource Hash
dd7495cfc853f1659328c57d9e48a5d5460687962d6a9267611c8836f96bd2f6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://t1.daumcdn.net/adfit/adunit_style/6ab5ec5b821bc9bc6aad6210feec8add27278b51
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:10 GMT
last-modified
Thu, 04 Oct 2018 09:08:01 GMT
server
openresty
content-type
image/png
cache-control
max-age=11854
x-wcss
dC1jb21tb24wMS1id2NhY2hlMzowOmNodHRwOjI1
accept-ranges
bytes
content-length
930
expires
Thu, 24 Feb 2022 16:33:44 GMT
ico_adlogo2.png
t1.daumcdn.net/biz/ui/ad/ Frame 6CF0
5 KB
5 KB
Image
General
Full URL
https://t1.daumcdn.net/biz/ui/ad/ico_adlogo2.png
Requested by
Host: t1.daumcdn.net
URL: https://t1.daumcdn.net/adfit/adunit_style/6ab5ec5b821bc9bc6aad6210feec8add27278b51
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:5f80:a::b212:e7a3 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software
openresty /
Resource Hash
750c0c8f5484e0b7ca7c69f0f4ef3eb382dd96a133f24592a9bb23586290c08f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://t1.daumcdn.net/adfit/adunit_style/6ab5ec5b821bc9bc6aad6210feec8add27278b51
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:10 GMT
last-modified
Wed, 17 Mar 2021 02:58:49 GMT
server
openresty
content-type
image/png
cache-control
max-age=11929
x-wcss
dC1jb21tb24wMS1id2NhY2hlMTA6MDpjaHR0cDoyNw==
accept-ranges
bytes
content-length
4637
expires
Thu, 24 Feb 2022 16:34:59 GMT
footsteps
track.tiara.daum.net/queen/
13 B
135 B
Image
General
Full URL
https://track.tiara.daum.net/queen/footsteps?dummy=1646108884757&ishome=U&referer=&title=Daum%20%EB%A1%9C%EA%B7%B8%EC%9D%B8&version=2.8.7&dpr=1&cke=Y&tz=0&rand_id=1645708569508&pck=Y&puid=1645708569508&url=http%3A%2F%2Fbalmoralmortgagebrokers.com%2Fsxde%2FDaum%2FDaum1.html
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
121.53.104.76 , Korea, Republic Of, ASN38099 (KAKAO-AS-KR Kakao Corp, KR),
Reverse DNS
Software
/
Resource Hash
7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://balmoralmortgagebrokers.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:10 GMT
content-length
13
strict-transport-security
max-age=15724800; includeSubDomains
content-type
text/plain; charset=utf-8
Tpn9jrMaHHPsWmxn2b6D509EjR1uWPTkmiusWteWMwxjgIIreA9tsQrgUI0MGejV1IbFg3DVdeKf2dZdOgs3Prt4wTzs_OQEpUC8vKLdz0anPcvsspxKcVAz0LFKCG3vm9cyXm2HEsmwlJOdNTQAyI2FUDzP_Pe-aIUQYn2IZ3pcmIPyEoQC
ka.ad.daum.net/rimp/ Frame 6CF0
43 B
155 B
Image
General
Full URL
https://ka.ad.daum.net/rimp/Tpn9jrMaHHPsWmxn2b6D509EjR1uWPTkmiusWteWMwxjgIIreA9tsQrgUI0MGejV1IbFg3DVdeKf2dZdOgs3Prt4wTzs_OQEpUC8vKLdz0anPcvsspxKcVAz0LFKCG3vm9cyXm2HEsmwlJOdNTQAyI2FUDzP_Pe-aIUQYn2IZ3pcmIPyEoQC?p=17XHb0UhloK2ESuD0m14ZA&ac=AI2o0-BwGDT9CnonpO_E6w8QjE9mCaa_kz6mUYWUKA8qiNIyLF5ksRLgDY0IEqLQ
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
211.249.221.119 , Korea, Republic Of, ASN9457 (DREAMX-AS DREAMLINE CO., KR),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://t1.daumcdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:12 GMT
content-length
43
strict-transport-security
max-age=15724800; includeSubDomains
content-type
image/gif
rendered
kyson.ad.daum.net/ad/ Frame 6CF0
43 B
271 B
Image
General
Full URL
https://kyson.ad.daum.net/ad/rendered?request_id=c2f17e88-93cd-4e9f-af98-6d629f523777&adunit_id=00Y28&bid_id=af68c172-01b4-42d2-844c-2e3a05e526cf1&dsp_id=KEYWORDAD&med_dsp_id=KAAS_CM&network_type=DAUM&sdk_type=web&sdk_version=4.1.5&ad_type=Banner&w=250&h=250&template_seq=34
Requested by
Host: balmoralmortgagebrokers.com
URL: http://balmoralmortgagebrokers.com/sxde/Daum/Daum1.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
121.53.202.253 , Korea, Republic Of, ASN9457 (DREAMX-AS DREAMLINE CO., KR),
Reverse DNS
Software
/
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://t1.daumcdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 24 Feb 2022 13:16:11 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Tpn9jrMaHHPsWmxn2b6D509EjR1uWPTkmiusWteWMwxjgIIreA9tsQrgUI0MGejV1IbFg3DVdeKf2dZdOgs3Prt4wTzs_OQEpUC8vKLdz0anPcvsspxKcVAz0LFKCG3vm9cyXm2HEsmwlJOdNTQAyI2FUDzP_Pe-aIUQYn2IZ3pcmIPyEoQC
ka.ad.daum.net/vimp/ Frame 6CF0
43 B
154 B
Image
General
Full URL
https://ka.ad.daum.net/vimp/Tpn9jrMaHHPsWmxn2b6D509EjR1uWPTkmiusWteWMwxjgIIreA9tsQrgUI0MGejV1IbFg3DVdeKf2dZdOgs3Prt4wTzs_OQEpUC8vKLdz0anPcvsspxKcVAz0LFKCG3vm9cyXm2HEsmwlJOdNTQAyI2FUDzP_Pe-aIUQYn2IZ3pcmIPyEoQC?p=17XHb0UhloK2ESuD0m14ZA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
211.249.221.119 , Korea, Republic Of, ASN9457 (DREAMX-AS DREAMLINE CO., KR),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://t1.daumcdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 13:16:12 GMT
content-length
43
strict-transport-security
max-age=15724800; includeSubDomains
content-type
image/gif
viewable
kyson.ad.daum.net/ad/ Frame 6CF0
43 B
271 B
Image
General
Full URL
https://kyson.ad.daum.net/ad/viewable?request_id=c2f17e88-93cd-4e9f-af98-6d629f523777&adunit_id=00Y28&bid_id=af68c172-01b4-42d2-844c-2e3a05e526cf1&dsp_id=KEYWORDAD&med_dsp_id=KAAS_CM&network_type=DAUM&sdk_type=web&sdk_version=4.1.5&ad_type=Banner&w=250&h=250&template_seq=34
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
121.53.202.253 , Korea, Republic Of, ASN9457 (DREAMX-AS DREAMLINE CO., KR),
Reverse DNS
Software
/
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://t1.daumcdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 24 Feb 2022 13:16:11 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Daum (Online)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone function| $ function| jQuery object| Kakao undefined| easyXDM object| daumlogin function| requestUpdateToken function| LoginTextField function| VirtualKeyView function| LoginForm function| toggleBodyClass function| rng_seed_int function| rng_seed_time function| pool_init object| _tiq object| __adfit__ object| regeneratorRuntime function| adfit function| Jackdaw object| __Tiara object| __cm

8 Cookies

Domain/Path Name / Value
balmoralmortgagebrokers.com/ Name: adfit_sdk_id
Value: 525f0670-6632-4fc2-aeab-39e71a89ec61
.ad.daum.net/ Name: aid
Value: 567478a6d5e445e6b7349f7c18381f67
.ad.daum.net/ Name: aid_ts
Value: 1645708569662
.daum.net/ Name: webid
Value: 567478a6d5e445e6b7349f7c18381f67
.daum.net/ Name: webid_sync
Value: 1645708570695
.daum.net/ Name: webid_ts
Value: 1645708569662
.kakao.com/ Name: webid
Value: 567478a6d5e445e6b7349f7c18381f67
.kakao.com/ Name: webid_ts
Value: 1645708569662

3 Console Messages

Source Level URL
Text
network error URL: https://logins.daum.net/contents/min/css/font_pc.css
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://track.tiara.daum.net/queen/footsteps?dummy=1646108884757&ishome=U&referer=&title=Daum%20%EB%A1%9C%EA%B7%B8%EC%9D%B8&version=2.8.7&dpr=1&cke=Y&tz=0&rand_id=1645708569508&pck=Y&puid=1645708569508&url=http%3A%2F%2Fbalmoralmortgagebrokers.com%2Fsxde%2FDaum%2FDaum1.html
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://track.tiara.daum.net/queen/footsteps?dummy=1646108884757&ishome=U&referer=&title=Daum%20%EB%A1%9C%EA%B7%B8%EC%9D%B8&version=2.8.7&dpr=1&cke=Y&tz=0&rand_id=1645708569508&pck=Y&puid=1645708569508&url=http%3A%2F%2Fbalmoralmortgagebrokers.com%2Fsxde%2FDaum%2FDaum1.html
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

balmoralmortgagebrokers.com
developers.kakao.com
display.ad.daum.net
img1.daumcdn.net
ka.ad.daum.net
kyson.ad.daum.net
logins.daum.net
m1.daumcdn.net
t1.daumcdn.net
track.tiara.daum.net
webid.ad.daum.net
webid.kakao.com
121.53.104.76
121.53.105.218
121.53.202.253
192.254.232.227
203.133.167.18
211.231.108.164
211.249.221.119
27.0.237.134
2a03:5f80:a::b212:e7a3
2a03:5f80:a::b212:e7ab
10397020b18155c46f267362d8c811c2a787ccf57dc2b5412b509f0a8d8ec7fd
1559c8b1d40c236e2d2ffaafd4065a52d0f9e0449d7fb9a76b9b9de2777774bb
2359d383bf2d4ab65ebf7923bdf74ce40e4093f6e58251b395a64034b3c39772
27be1d8a7ca2bb1dd3af0c1dbec5179e28c1e22696eed50c142d423af3fc3f99
3e70b4792cec8323f565abd7afe03f39ee6516a8cb4a44fbdd8a26057f3efa77
50d4a8f26b0c851839a82ee89ac4cdbe92a520049d2cc005c45d04b872e6defe
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5ab4f05cbe1a5cf7b22b8609cefc5e0f09f8b8577fe9d9b2e775279045a027b4
6845a3538e9237f310d087c193a3626926bd22dd49041836614673b1fa553813
750c0c8f5484e0b7ca7c69f0f4ef3eb382dd96a133f24592a9bb23586290c08f
7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
cb88aab70e965565b9c96355273a6cb129715167c9a44872f17337429c16fe8f
cc2772141486c562b3b146084eff380f02162af3fc239548767b3047504a5091
da547e7e12687f15c5fbc3b7c4dd7a7aa94a54fb8191742e48faaa78aa36ffb5
dd7495cfc853f1659328c57d9e48a5d5460687962d6a9267611c8836f96bd2f6
e59bba1708d06698afe08ebc4c9ce3c9a14e1fca0d7826e824bd6ed04a153b54
e82da83961ca0207a8ce5269c8c06ebaf04b9e6e1159f571e312255b6aef74a2
ef5834fb849172f0b9759ce7dce4916ea6434afe0bd8bd16677db4afe42d44fd