clients.imagesbydalton.com
Open in
urlscan Pro
2606:4700::6810:bbad
Public Scan
Submission: On July 13 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 13th 2020. Valid for: a year.
This is the only time clients.imagesbydalton.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 2606:4700::68... 2606:4700::6810:bbad | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 2606:4700::68... 2606:4700::6810:84e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:825::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:9000:215... 2600:9000:2156:ca00:15:6250:fe40:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2a00:1450:400... 2a00:1450:4001:817::2003 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2600:9000:215... 2600:9000:2156:4a00:6:a3e8:e180:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 2a00:1450:400... 2a00:1450:4001:819::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:400c:c04::9d | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:81d::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 151.101.114.110 151.101.114.110 | 54113 (FASTLY) (FASTLY) | |
2 | 162.247.242.19 162.247.242.19 | 23467 (NEWRELIC-...) (NEWRELIC-AS-1) | |
27 | 10 |
ASN13335 (CLOUDFLARENET, US)
clients.imagesbydalton.com | |
static.pixieset.com |
ASN15169 (GOOGLE, US)
ssl.google-analytics.com |
ASN23467 (NEWRELIC-AS-1, US)
PTR: bam-7.nr-data.net
bam.nr-data.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
pixieset.com
static.pixieset.com logos.pixieset.com images.pixieset.com |
1 MB |
6 |
cloudflare.com
cdnjs.cloudflare.com |
63 KB |
3 |
gstatic.com
fonts.gstatic.com |
42 KB |
2 |
nr-data.net
bam.nr-data.net |
467 B |
2 |
google-analytics.com
1 redirects
ssl.google-analytics.com |
17 KB |
1 |
newrelic.com
js-agent.newrelic.com |
10 KB |
1 |
google.de
www.google.de |
106 B |
1 |
google.com
1 redirects
www.google.com |
183 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net |
153 B |
1 |
googleapis.com
fonts.googleapis.com |
559 B |
1 |
imagesbydalton.com
clients.imagesbydalton.com |
6 KB |
27 | 11 |
Domain | Requested by | |
---|---|---|
7 | static.pixieset.com |
clients.imagesbydalton.com
|
6 | cdnjs.cloudflare.com |
clients.imagesbydalton.com
|
3 | images.pixieset.com |
clients.imagesbydalton.com
|
3 | fonts.gstatic.com |
cdnjs.cloudflare.com
clients.imagesbydalton.com |
2 | bam.nr-data.net |
js-agent.newrelic.com
|
2 | ssl.google-analytics.com |
1 redirects
clients.imagesbydalton.com
|
1 | js-agent.newrelic.com |
clients.imagesbydalton.com
|
1 | www.google.de |
clients.imagesbydalton.com
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
1 | logos.pixieset.com |
clients.imagesbydalton.com
|
1 | fonts.googleapis.com |
clients.imagesbydalton.com
|
1 | clients.imagesbydalton.com | |
27 | 13 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.facebook.com |
instagram.com |
imagesbydalton.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
clients.imagesbydalton.com Cloudflare Inc ECC CA-3 |
2020-07-13 - 2021-07-13 |
a year | crt.sh |
cloudflare.com Cloudflare Inc ECC CA-3 |
2020-07-04 - 2021-07-04 |
a year | crt.sh |
ssl469551.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2020-05-20 - 2020-11-26 |
6 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
*.pixieset.com Amazon |
2019-12-07 - 2021-01-07 |
a year | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
www.google.de GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
f4.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2020-05-29 - 2021-05-07 |
a year | crt.sh |
*.nr-data.net DigiCert SHA2 Secure Server CA |
2020-02-05 - 2022-02-08 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://clients.imagesbydalton.com/
Frame ID: 211364747BA2EE4F55C8C03FE95C7663
Requests: 27 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 22- https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=770387005&utmhn=clients.imagesbydalton.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Images%20by%20Dalton&utmhid=1588984912&utmr=-&utmp=%2F&utmht=1594612163018&utmac=UA-39686919-1&utmcc=__utma%3D78901190.1952667933.1594612163.1594612163.1594612163.1%3B%2B__utmz%3D78901190.1594612163.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1837441174&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-39686919-1&cid=1952667933.1594612163&jid=1837441174&_v=5.7.2&z=770387005 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-39686919-1&cid=1952667933.1594612163&jid=1837441174&_v=5.7.2&z=770387005 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-39686919-1&cid=1952667933.1594612163&jid=1837441174&_v=5.7.2&z=770387005&slf_rd=1&random=828008614
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
clients.imagesbydalton.com/ |
15 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
normalize.min.css
cdnjs.cloudflare.com/ajax/libs/normalize/1.1.0/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/2.3.1/css/ |
103 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap-responsive.min.css
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/2.3.1/css/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client.combined.min.css
static.pixieset.com/release/css/ |
305 KB 69 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 559 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
customLinkPager.css
static.pixieset.com/css/ |
1 KB 798 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/ |
90 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr.min.js
cdnjs.cloudflare.com/ajax/libs/modernizr/2.8.3/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JsTrans.min.js
static.pixieset.com/js/vendor/JsTranslations/ |
1 KB 841 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
af07a0b425729f3c830c917b7a902a14-small.png
logos.pixieset.com/891757/ |
31 KB 31 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/2.3.1/js/ |
28 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client.combined.min.js
static.pixieset.com/release/js/ |
707 KB 193 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
346da118ac602b077b4c1be1cb7a66d3-large.jpg
images.pixieset.com/86880962/ |
202 KB 203 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f15ceaafdbfbe8d4181b4c39ae1cd8ba-large.jpg
images.pixieset.com/79613562/ |
223 KB 224 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0b49c5c67e4bc9ce271ac3068b9e8982-large.jpg
images.pixieset.com/80536462/ |
238 KB 239 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fa-brands-400.woff2
static.pixieset.com/release/webfonts/ |
70 KB 71 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fa-solid-900.woff2
static.pixieset.com/release/webfonts/ |
115 KB 116 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fa-light-300.woff2
static.pixieset.com/release/webfonts/ |
153 KB 154 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v16/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6u9w4BMUTPHh7USSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v16/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
ssl.google-analytics.com/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 106 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-1169.min.js
js-agent.newrelic.com/ |
27 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2131890c87
bam.nr-data.net/1/ |
57 B 274 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
2131890c87
bam.nr-data.net/events/1/ |
24 B 193 B |
XHR
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
64 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| NREUM object| newrelic function| __nr_require function| $ function| jQuery object| html5 object| Modernizr object| PixiesetHelpers object| _gaq object| jQuery19108490940076879954 object| _gat object| gaGlobal function| FastClick function| getHiddenProp function| isHidden object| Handlebars object| Gamma object| Sentry object| PixiesetCallbackGroup object| PixiesetInitialize object| PixiesetBgVideo object| PixiesetCollectionCover object| PixiesetCookieConsent object| SentryInitializer object| QuantitySelectorWidget object| PixiesetClient object| PixiesetDisplayToggle function| Mediator function| url function| EvEmitter function| imagesLoaded function| _svResizeImage function| _getFinalImgConfig function| _singleview function| _singleviewitem function| _loadSVItemFromGrid function| _initShareButtonOnSV function| _initFavoriteButtonOnSV function| _initDownloadButtonOnSV function| _initCartButtonOnSV function| _initMarkPrivateButtonOnSV function| _initNoteButtonOnSV function| _getFinalSizePosition function| _closesingleview function| _visChange function| _prepareSlideshow function| _preloadNext function| _startSlideshow function| _stopSlideshow function| _initEvents function| _setTransition function| _applyAnimation function| add function| reload function| closeSV function| disableResizeListener function| enableResizeListener function| _ object| plyr object| cookieconsent function| PhotoSwipe function| PhotoSwipeUI_Default object| PixiesetProductOptionSelection object| PixiesetProductEditor8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.clients.imagesbydalton.com/ | Name: __utmb Value: 78901190.1.10.1594612163 |
|
.clients.imagesbydalton.com/ | Name: __utmz Value: 78901190.1594612163.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.clients.imagesbydalton.com/ | Name: __cf_bm Value: 1b13e3c862584f2b2e3dcb9e16e283e5cf635596-1594612162-1800-AUGWd7m1C0LZQLY6070TXZWMORJYapU5lAno2VsRIKyQlSW0vC5wQ3WiHzOIhtFNrQBx9owJ6dbKa7Ic4V3zOqo= |
|
.clients.imagesbydalton.com/ | Name: __utmc Value: 78901190 |
|
.clients.imagesbydalton.com/ | Name: __utma Value: 78901190.1952667933.1594612163.1594612163.1594612163.1 |
|
.clients.imagesbydalton.com/ | Name: __utmt Value: 1 |
|
clients.imagesbydalton.com/ | Name: PHPSESSID Value: r93jvpken92iv11mqhol5s4f91 |
|
.clients.imagesbydalton.com/ | Name: __cfduid Value: d8f65a2b49e0986093545fca21a7657241594612161 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bam.nr-data.net
cdnjs.cloudflare.com
clients.imagesbydalton.com
fonts.googleapis.com
fonts.gstatic.com
images.pixieset.com
js-agent.newrelic.com
logos.pixieset.com
ssl.google-analytics.com
static.pixieset.com
stats.g.doubleclick.net
www.google.com
www.google.de
151.101.114.110
162.247.242.19
2600:9000:2156:4a00:6:a3e8:e180:93a1
2600:9000:2156:ca00:15:6250:fe40:93a1
2606:4700::6810:84e5
2606:4700::6810:bbad
2a00:1450:4001:817::2003
2a00:1450:4001:819::2008
2a00:1450:4001:81d::2003
2a00:1450:4001:81d::2004
2a00:1450:4001:825::200a
2a00:1450:400c:c04::9d
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
03951a517c7774eb52addb5d007d9645500d44db90005260acfdf0055ec4e9ef
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
201cb796c90996c657409ade1036865a33c6901d01a0ac0573670522c6520aa6
2464fed2e397199bad5541846e498f959321637af0ccd443502750ccf57807d6
397733364041c86da6e5df0150e120e3b642bb91b2edb6b0fa7f2661cfb1e122
55250344623ea613fd1ac37b66675602770147468e51f2d0687059fbf01c5fb6
61c4cbe25e293afa3b623bea18c5f1e4cb466daa302bacb42fd35b251ad9bfd5
67946658587ec3dff2d2ebee7f900c68365e43b35916f404067a7c5d6bacc974
6895b25c1d00b6f3df86927b80de383995c123ec70649ce008d8e3f2863bc0a2
706494a230ae9c22ebbda2b9fce9af786bac0ea5f315c80e3fbe9f44e7883c38
7470f9d78491838f5cc3ee51d4ed4d8a232f6c80ae80706dff96c062d3d663b6
76a06227945b3f8215623543deed9aef209aad313f90eb1ab3b7ed367d0c238c
8c120d3f4aa6ca41722988688db00ad262d8ee6bf216bc96e7649bba3fe352bf
92d58c18e39ed09fddb2caa9b28312fc411629265dc76e9b0c3a6ec53f6558a2
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
a02f83209dec53dae25f9d4e67935ac4351005aa4757fc69524204084b946ffa
ad870134e00e713a173b1be210378b4b7b85f8081e578e85e13fffeec0ae78a0
c0f028a60269875745358be545bae0a967cfbe0764bd62c1373634b4cccba3e0
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
cddee6bb37cab7b576ddf080fd6ba00fa8420d0afc0531f413633175e9e5f9c8
d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe
d64849d9ec4afd8eb21b289c99a9d785eb7079d893b899490132fb4707447457
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6