login.w3.ibm.com
Open in
urlscan Pro
2a02:26f0:e300::211:93a1
Public Scan
Submitted URL: https://ibm.buf.dev/
Effective URL: https://login.w3.ibm.com/idaas/mtfim/sps/idaas/login?client_id=MTExOTQ3NjctNGQ3My00&Target=https%3A%2F%2Flogin.w3.ibm.com...
Submission: On June 12 via api from US — Scanned from DE
Effective URL: https://login.w3.ibm.com/idaas/mtfim/sps/idaas/login?client_id=MTExOTQ3NjctNGQ3My00&Target=https%3A%2F%2Flogin.w3.ibm.com...
Submission: On June 12 via api from US — Scanned from DE
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 20 HTTP transactions.
The main IP is 2a02:26f0:e300::211:93a1, located in
Prague, Czech Republic and
belongs to AKAMAI-ASN1, NL.
The main domain is login.w3.ibm.com.
The Cisco Umbrella rank of the primary domain is 352877.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 13th 2024. Valid for: a year.
This is the only time login.w3.ibm.com was scanned on urlscan.io!
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 13th 2024. Valid for: a year.
This is the only time login.w3.ibm.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 2 | 34.111.54.87 34.111.54.87 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
| 1 4 | 2a02:26f0:e30... 2a02:26f0:e300::211:93a1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 12 | 84.53.164.237 84.53.164.237 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 5 | 2a02:26f0:e30... 2a02:26f0:e300:181::b3a | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 20 | 3 |
2
34.111.54.87
(Kansas City, United States)
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.54.111.34.bc.googleusercontent.com
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.54.111.34.bc.googleusercontent.com
| ibm.buf.dev |
12
84.53.164.237
(Netherlands)
ASN16625 (AKAMAI-AS, US)
PTR: a84-53-164-237.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a84-53-164-237.deploy.static.akamaitechnologies.com
| w3id-ns.sso.ibm.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 16 |
ibm.com
1 redirects
login.w3.ibm.com — Cisco Umbrella Rank: 352877 w3id-ns.sso.ibm.com — Cisco Umbrella Rank: 463135 |
510 KB |
| 5 |
s81c.com
1.www.s81c.com — Cisco Umbrella Rank: 49194 |
181 KB |
| 2 |
buf.dev
2 redirects
ibm.buf.dev |
818 B |
| 20 | 3 |
| Domain | Requested by | |
|---|---|---|
| 12 | w3id-ns.sso.ibm.com |
login.w3.ibm.com
w3id-ns.sso.ibm.com |
| 5 | 1.www.s81c.com |
w3id-ns.sso.ibm.com
|
| 4 | login.w3.ibm.com |
1 redirects
login.w3.ibm.com
|
| 2 | ibm.buf.dev | 2 redirects |
| 20 | 4 |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| login.w3.ibm.com DigiCert TLS RSA SHA256 2020 CA1 |
2024-03-13 - 2025-03-13 |
a year | crt.sh |
| w3idprofile.sso.ibm.com DigiCert TLS RSA SHA256 2020 CA1 |
2024-03-09 - 2025-03-12 |
a year | crt.sh |
| www.ibm.com GeoTrust RSA CA 2018 |
2023-07-20 - 2024-07-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://login.w3.ibm.com/idaas/mtfim/sps/idaas/login?client_id=MTExOTQ3NjctNGQ3My00&Target=https%3A%2F%2Flogin.w3.ibm.com%2Foidc%2Fendpoint%2Fdefault%2Fauthorize%3FqsId%3Da751c44a-c25d-4913-bfb1-bf435fa51729%26client_id%3DMTExOTQ3NjctNGQ3My00
Frame ID: C9F8EA1009F0E58DFABEBA7500968384
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
w3idPage URL History Show full URLs
-
https://ibm.buf.dev/
HTTP 307
https://ibm.buf.dev/login?original_uri=%2F HTTP 307
https://login.w3.ibm.com/v1.0/endpoint/default/authorize?client_id=MTExOTQ3NjctNGQ3My00&nonce=083d98e... HTTP 302
https://login.w3.ibm.com/oidc/sps/auth?client_id=MTExOTQ3NjctNGQ3My00&Target=https%3A%2F%2Flogin.w3.i... Page URL
- https://login.w3.ibm.com/idaas/mtfim/sps/idaas/login?client_id=MTExOTQ3NjctNGQ3My00&Target=https%3A%2... Page URL
Detected technologies
Akamai Bot Manager
(Security)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
URL: https://ibm.biz/w3id-faq
Title: FAQ
Title: FAQ
Search URL Search Domain Scan URL
URL: https://ibm.biz/w3id-status
Title: Status
Title: Status
Search URL Search Domain Scan URL
URL: https://ibm.biz/w3id-forum
Title: Visit Forums
Title: Visit Forums
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ibm.buf.dev/
HTTP 307
https://ibm.buf.dev/login?original_uri=%2F HTTP 307
https://login.w3.ibm.com/v1.0/endpoint/default/authorize?client_id=MTExOTQ3NjctNGQ3My00&nonce=083d98e1-3877-4b88-bbff-87b0e3ec1667&redirect_uri=https%3A%2F%2Fibm.buf.dev%2Foauth2%2Fcallback&response_type=code&scope=openid+profile+email+offline_access&state=CiRmOTM1ODBmYS0zZjFmLTQzMGEtYjJiNi03MmVkMWRlZDFjYjASFGh0dHBzOi8vaWJtLmJ1Zi5kZXYv HTTP 302
https://login.w3.ibm.com/oidc/sps/auth?client_id=MTExOTQ3NjctNGQ3My00&Target=https%3A%2F%2Flogin.w3.ibm.com%2Foidc%2Fendpoint%2Fdefault%2Fauthorize%3FqsId%3Da751c44a-c25d-4913-bfb1-bf435fa51729%26client_id%3DMTExOTQ3NjctNGQ3My00 Page URL
- https://login.w3.ibm.com/idaas/mtfim/sps/idaas/login?client_id=MTExOTQ3NjctNGQ3My00&Target=https%3A%2F%2Flogin.w3.ibm.com%2Foidc%2Fendpoint%2Fdefault%2Fauthorize%3FqsId%3Da751c44a-c25d-4913-bfb1-bf435fa51729%26client_id%3DMTExOTQ3NjctNGQ3My00 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://ibm.buf.dev/ HTTP 307
- https://ibm.buf.dev/login?original_uri=%2F HTTP 307
- https://login.w3.ibm.com/v1.0/endpoint/default/authorize?client_id=MTExOTQ3NjctNGQ3My00&nonce=083d98e1-3877-4b88-bbff-87b0e3ec1667&redirect_uri=https%3A%2F%2Fibm.buf.dev%2Foauth2%2Fcallback&response_type=code&scope=openid+profile+email+offline_access&state=CiRmOTM1ODBmYS0zZjFmLTQzMGEtYjJiNi03MmVkMWRlZDFjYjASFGh0dHBzOi8vaWJtLmJ1Zi5kZXYv HTTP 302
- https://login.w3.ibm.com/oidc/sps/auth?client_id=MTExOTQ3NjctNGQ3My00&Target=https%3A%2F%2Flogin.w3.ibm.com%2Foidc%2Fendpoint%2Fdefault%2Fauthorize%3FqsId%3Da751c44a-c25d-4913-bfb1-bf435fa51729%26client_id%3DMTExOTQ3NjctNGQ3My00
20 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
auth
login.w3.ibm.com/oidc/sps/ Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
login
login.w3.ibm.com/idaas/mtfim/sps/idaas/ |
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bundle.s110.css
w3id-ns.sso.ibm.com/static/css/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
w3ds.css
w3id-ns.sso.ibm.com/static/css/w3ds/w3ds-6.2.4/ |
327 KB 328 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.5.0.min.js
w3id-ns.sso.ibm.com/static/js/ |
87 KB 88 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
capslockstate.js
w3id-ns.sso.ibm.com/static/js/ |
4 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fetch-polyfill.js
w3id-ns.sso.ibm.com/static/js/ |
14 KB 15 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
promise-polyfill.js
w3id-ns.sso.ibm.com/static/js/ |
3 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.s192.js
w3id-ns.sso.ibm.com/static/js/ |
6 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.s195.js
w3id-ns.sso.ibm.com/static/js/ |
17 KB 17 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ibm.svg
w3id-ns.sso.ibm.com/static/img/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
c.svg
w3id-ns.sso.ibm.com/static/img/ |
868 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ibmplexsans-bold.woff2
1.www.s81c.com/common/fonts/plex/v1/ |
35 KB 35 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ibmplexsans-medium.woff2
1.www.s81c.com/common/fonts/plex/v1/ |
36 KB 37 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ibmplexsans-regular.woff2
1.www.s81c.com/common/fonts/plex/v1/ |
34 KB 35 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ibmplexsans-light.woff2
1.www.s81c.com/common/fonts/plex/v1/ |
36 KB 37 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ibmplexsans-italic.woff2
1.www.s81c.com/common/fonts/plex/v1/ |
37 KB 37 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
key-icon.svg
w3id-ns.sso.ibm.com/static/img/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
w3ds-icons.woff2
w3id-ns.sso.ibm.com/static/css/w3ds/w3ds-6.2.4/icons/ |
13 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
login.w3.ibm.com/ |
15 KB 15 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
86 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| $ function| jQuery object| supported function| isDataView object| viewClasses function| isArrayBufferView function| normalizeName function| normalizeValue function| iteratorFor function| Headers function| consumed function| fileReaderReady function| readBlobAsArrayBuffer function| readBlobAsText function| readArrayBufferAsText function| bufferClone function| Body object| methods function| normalizeMethod function| Request function| decode function| parseHeaders function| Response object| redirectStatuses string| userAgent boolean| isIE function| isBrowser function| isMacOs boolean| isMac function| isWindows boolean| isPC function| isWin10 function| isMobile function| browserSupportsFIDO2 boolean| supportsFIDO function| showQRcode boolean| supportsQR function| clearTimer function| disableOptions function| hideDiv function| showDiv function| toggleButtonState function| allyClick function| createSpacer function| postForm function| enableButton function| replaceButtonText string| domainOrigin function| setCookie function| getCookie function| slackBotEnvironment object| loginProviderInstructions function| checkMethod string| currentAuthMethod function| checkEnv function| credsClickHandler function| fidoClickHandler function| qrClickHandler function| passwordlessInit function| updateOptionSelect function| createIdSourceOption function| getClickHandler function| selectIdSourceHandler function| updateSigninOptionDropdown number| checkFrequency number| refreshTime object| currentQrJson undefined| interval number| checkCount number| checkLimit function| initQRLogin function| checkQrStatus function| doQRLogin function| pauseQrStatus function| resumeQrStatus function| getIdentitySourceIDs function| getMsg function| getTargetUrl function| getThemeId object| idSources string| errorMessage boolean| submitting object| antiClickjack7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .ibm.buf.dev/oauth2/callback | Name: oauth2-state Value: CiRmOTM1ODBmYS0zZjFmLTQzMGEtYjJiNi03MmVkMWRlZDFjYjASFGh0dHBzOi8vaWJtLmJ1Zi5kZXYv |
|
| .ibm.buf.dev/oauth2/callback | Name: oauth2-nonce Value: 083d98e1-3877-4b88-bbff-87b0e3ec1667 |
|
| login.w3.ibm.com/idaas/mtfim/sps | Name: SessionCTXID_authbroker Value: 7ef98dd5-17ac-4cab-a5ff-0a1300a70f59 |
|
| .login.w3.ibm.com/ | Name: CISESSIONIDPR07B Value: PBC5YS:2114405574 |
|
| login.w3.ibm.com/ | Name: CIPD-S-SESSION-ID Value: 0:2:rediscol02b:P2GmT6uOXOQAACVpWlIJvu0RWa6Ja06s5lRzmGo+tkE= |
|
| .w3.ibm.com/ | Name: ak_bmsc Value: 80CFE6D3CC39A4B5A1D1599581491448~000000000000000000000000000000~YAAQnZMRArledQuQAQAAoKBTDRi7jOS7088wvj7SvnEdcKghIBBngcBKz0FKU6W4SGZUBYzssBWjNZHySJiyIDROT2yNuscpPQQv+662dDI3K++EJhZpiwYMjC5+2VCo0yZfFfmaCBn2/2bH+TUvaXNT1S2jFzhsoWTnC/VrW9P6ye4f1oM83U1F2iou6gdH5663jhVGL5bpQl1XqPpDsxb/oqmRIsb42udKNx80fVxJ6rPoIrJZqsCQkTXE08ME/qpyqyODvnFr+TCfaLYoGW9Ir3efZLXshavQPXn/qSAX2GrAgqlMm/5WwEpQjoDhWS+rfeSitaaMOtqHiB0GdoSKimIB0VGqv7WJZGc2DZz2MLm8BSTsG4rsWyle0LAWY0y6JKLnKcmvqhRkT/6Wb1Qmpam84L4hX/h17QzEeCK0 |
|
| .w3.ibm.com/ | Name: bm_sv Value: FBD22E3D8528215972FDBE868C9308E8~YAAQnZMRAsdedQuQAQAAR6JTDRh86RaD6G70Rtq5+Z5+A3hZIsBJ3rSd4p4aSfvw7xFtdiLETfpeZV8C661S7fsqPtPlpJ6GNcIXe8wbGs7dcjVdQCdRHFly8Ev9JQXWE+IhXX1PWnKiATwF3FEPCBN+sMladJABlVAfva0TMoBuDQyqfdnDaUWaR2iOmRXaWe9Ez9x5lJpmF55OeY0fMc5Y0SvGPNuBgV5fLU5xbo0gwTzgN0lyEJOY4JpYk5g8~1 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | frame-ancestors 'self' https://*.ibm.com https://*.force.com https://*.service-now.com https://*.lightning.force.com https://*.visualforce.com https://*.multicloud-ibm.com https://*.seismic.com https://*.wdc.dst.ibm.com https://*.mail.ibm.com https://*.my.salesforce.com https://*.salesforce.com https://*.ondemand.com https://*.start-at-ibm-home.cis.ibm.net |
| Strict-Transport-Security | max-age=31536000 ; includeSubDomains |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | DENY |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1.www.s81c.com
ibm.buf.dev
login.w3.ibm.com
w3id-ns.sso.ibm.com
2a02:26f0:e300:181::b3a
2a02:26f0:e300::211:93a1
34.111.54.87
84.53.164.237
0864edce1c6497bd1d05a8ae8085d5e239275867aac74d06a996f2e48da1cc7d
0d04f7c4d8f077ce31fd1a311a7c6902bcbf01a7c98f0b68868bfa50709c83b0
0d1286879246229875caa626ca20656cb3f1ecca8b7b6e5a3088b9be98cd07b1
23a79ef694036fd5bb67bef66660f01a81f81e4617d8a93f89341c9a13d569fd
3c857c2f511b8fe9189ed3af29183c4dad75ea4ddb5ce4e7d0218fe93ad2ef29
4f9205e34e8b02fd9f4f2a7e07eb2122e526c030ecf2703ad961baad451c517d
58a9c64de02a286ee278b4218955217cc34dc73a632347f9c3b87973d6955bf4
900743cb4beaddf71def113d11b5225b7bc279ba376408924a11488041600651
a25c0b54f4b77edcd52119fa0cb86bd7834d632b90758d8eff880b7b794d61a2
a6d41fe5ca98ca2293faf7e3989601ae5387d3aaef87c2fe305b6b994a1c658a
b151eeaced444d5892ef2bbac7bfe2176333f1f2f340bf111d5ff8c7834cc48b
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
ce4d80430d2bcef27ca5ef5322e45d27915f92bd24f55b5f4a89d1ad2f34bf18
de06b3a6ff81922bb273a2c648b0b99ebfd4e2d8f795750477e77d7eea140d43
de80b2b0c32b938ed432b49c0f3dc09f8c6152fc6b090ac49294b891ad8933bc
e08d5e241b7b8c1e124bc42008d2c0fe9e6b29202025b9769e65d59c39a2336c
edc9ee0088e8008f5b960f2fb6805ee1a03f1aaad14818c4e0e0cc37a7ce3476
efac03f791c1790c5fb7d6e0bda0c9cd3dbceea726008140f08f2f1a9c2bd245
f4e093b9219a607c3e2cfc0865c196fded6745941e92bb40c0d2dd1f60b8a12e