online-citi-serv.sewec46652.workers.dev
Open in
urlscan Pro
2a06:98c1:3121::3
Malicious Activity!
Public Scan
Submission: On September 13 via automatic, source openphish — Scanned from NL
Summary
TLS certificate: Issued by E1 on September 7th 2022. Valid for: 3 months.
This is the only time online-citi-serv.sewec46652.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citibank (Banking)Domain & IP information
ASN13335 (CLOUDFLARENET, US)
online-citi-serv.sewec46652.workers.dev |
ASN16625 (AKAMAI-AS, US)
PTR: a104-96-154-38.deploy.static.akamaitechnologies.com
www.citi.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-242-170.compute-1.amazonaws.com
api.ipify.org |
ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-72.fra56.r.cloudfront.net
nexus.ensighten.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-7.fra56.r.cloudfront.net
cdn.pbbl.co |
ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
sr.rlcdn.com |
ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net
www.googleadservices.com |
ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com
udc-neb.kampyle.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
dropboxusercontent.com
dl.dropboxusercontent.com — Cisco Umbrella Rank: 14989 |
788 KB |
13 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 141 |
607 KB |
10 |
ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 3968 |
88 KB |
9 |
google.nl
www.google.nl — Cisco Umbrella Rank: 6102 |
1 KB |
9 |
google.com
2 redirects
www.google.com — Cisco Umbrella Rank: 19 |
2 KB |
9 |
doubleclick.net
2 redirects
googleads.g.doubleclick.net — Cisco Umbrella Rank: 73 |
9 KB |
2 |
medallia.com
resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 33484 |
85 KB |
1 |
kampyle.com
udc-neb.kampyle.com — Cisco Umbrella Rank: 3493 |
317 B |
1 |
googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 159 |
16 KB |
1 |
rlcdn.com
sr.rlcdn.com — Cisco Umbrella Rank: 17528 |
98 B |
1 |
pbbl.co
cdn.pbbl.co — Cisco Umbrella Rank: 13589 |
|
1 |
rfihub.com
20766699p.rfihub.com — Cisco Umbrella Rank: 53523 |
680 B |
1 |
rfihub.net
c1.rfihub.net — Cisco Umbrella Rank: 7471 |
6 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 3019 |
215 B |
1 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 11536 |
3 KB |
1 |
citi.com
www.citi.com — Cisco Umbrella Rank: 34060 |
3 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 480 |
31 KB |
1 |
workers.dev
online-citi-serv.sewec46652.workers.dev |
65 KB |
74 | 18 |
Domain | Requested by | |
---|---|---|
15 | dl.dropboxusercontent.com |
online-citi-serv.sewec46652.workers.dev
|
13 | www.googletagmanager.com |
dl.dropboxusercontent.com
www.googletagmanager.com |
10 | nexus.ensighten.com |
online-citi-serv.sewec46652.workers.dev
dl.dropboxusercontent.com |
9 | www.google.nl | |
9 | www.google.com | 2 redirects |
9 | googleads.g.doubleclick.net |
2 redirects
www.googleadservices.com
|
2 | resources.digital-cloud-citi.medallia.com |
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com |
1 | udc-neb.kampyle.com | |
1 | www.googleadservices.com |
www.googletagmanager.com
|
1 | sr.rlcdn.com |
nexus.ensighten.com
|
1 | cdn.pbbl.co |
nexus.ensighten.com
|
1 | 20766699p.rfihub.com |
c1.rfihub.net
|
1 | c1.rfihub.net |
nexus.ensighten.com
|
1 | api.ipify.org |
online-citi-serv.sewec46652.workers.dev
|
1 | i.ibb.co |
online-citi-serv.sewec46652.workers.dev
|
1 | www.citi.com |
online-citi-serv.sewec46652.workers.dev
|
1 | ajax.googleapis.com |
online-citi-serv.sewec46652.workers.dev
|
1 | online-citi-serv.sewec46652.workers.dev | |
74 | 18 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.sewec46652.workers.dev E1 |
2022-09-07 - 2022-12-06 |
3 months | crt.sh |
dl.dropbox.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-02-08 - 2023-03-11 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-08-22 - 2022-11-14 |
3 months | crt.sh |
www.citi.com DigiCert SHA2 Extended Validation Server CA |
2021-11-02 - 2022-12-03 |
a year | crt.sh |
ibb.co R3 |
2022-08-07 - 2022-11-05 |
3 months | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2022-02-07 - 2023-03-10 |
a year | crt.sh |
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-09-14 - 2022-10-12 |
a year | crt.sh |
*.rfihub.net Amazon |
2021-12-29 - 2023-01-27 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-08-22 - 2022-11-14 |
3 months | crt.sh |
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA |
2022-05-24 - 2023-05-24 |
a year | crt.sh |
*.digital-cloud-citi.medallia.com SSL.com RSA SSL subCA |
2021-11-15 - 2022-10-20 |
a year | crt.sh |
*.pbbl.co Amazon |
2021-11-04 - 2022-12-02 |
a year | crt.sh |
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA |
2022-02-03 - 2023-02-25 |
a year | crt.sh |
www.googleadservices.com GTS CA 1C3 |
2022-08-22 - 2022-11-14 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2022-08-22 - 2022-11-14 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2022-08-22 - 2022-11-14 |
3 months | crt.sh |
*.google.nl GTS CA 1C3 |
2022-08-22 - 2022-11-14 |
3 months | crt.sh |
*.kampyle.com SSL.com RSA SSL subCA |
2022-02-28 - 2023-03-31 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://online-citi-serv.sewec46652.workers.dev/
Frame ID: F3B7F959D36DB9358BC44A4E122B121B
Requests: 72 HTTP requests in this frame
Frame:
https://20766699p.rfihub.com/ca.html?ver=9&ra=1824&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fonline-citi-serv.sewec46652.workers.dev%2F&pf=&ra=9814082668899611
Frame ID: F0943C8CC3C38711B1E8950815D99003
Requests: 1 HTTP requests in this frame
Frame:
https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 0BF7ADEBB65A677E339CC7A204893EA7
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Sign On to Your Citi Account - CitibankDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Ensighten (Tag Managers) Expand
Detected patterns
- //nexus\.ensighten\.com/
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 52- https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1663032518637&cv=9&fst=1663032518637&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline-citi-serv.sewec46652.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=724633823.1663032518&hn=www.googleadservices.com&async=1 HTTP 302
- https://www.google.com/pagead/1p-user-list/916451471/?random=1663032518637&cv=9&fst=1663030800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline-citi-serv.sewec46652.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2284112588&resp=GooglemKTybQhCsO HTTP 302
- https://www.google.nl/pagead/1p-user-list/916451471/?random=1663032518637&cv=9&fst=1663030800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline-citi-serv.sewec46652.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2284112588&resp=GooglemKTybQhCsO&ipr=y
- https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1663032518638&cv=9&fst=1663032518638&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline-citi-serv.sewec46652.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=724633823.1663032518&hn=www.googleadservices.com&async=1 HTTP 302
- https://www.google.com/pagead/1p-user-list/644574043/?random=1663032518638&cv=9&fst=1663030800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline-citi-serv.sewec46652.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=1022678792&resp=GooglemKTybQhCsO HTTP 302
- https://www.google.nl/pagead/1p-user-list/644574043/?random=1663032518638&cv=9&fst=1663030800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline-citi-serv.sewec46652.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=1022678792&resp=GooglemKTybQhCsO&ipr=y
74 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
online-citi-serv.sewec46652.workers.dev/ |
1 MB 65 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Bootstrap.js
dl.dropboxusercontent.com/s/z095l2wk45dt9ci/ |
280 KB 101 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Interstate-Light.woff
dl.dropboxusercontent.com/s/5pecxff6thpa7bk/ |
74 KB 75 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Interstate-Bold.woff
dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/ |
70 KB 70 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Interstate-Regular.woff
dl.dropboxusercontent.com/s/eltd16c80yf2gxb/ |
77 KB 77 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
dl.dropboxusercontent.com/s/esn6641krlordqt/ |
1 MB 198 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
citilogoredesign.png
www.citi.com/CBOL/IA/Angular/assets/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
050-location%402x.svg
dl.dropboxusercontent.com/s/ttemfbjw200ljgk/ |
2 KB 988 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_globe_med-grey%402x.svg
dl.dropboxusercontent.com/s/0v474zauzy1yqib/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ajax-loader.gif
i.ibb.co/RpLNy4f/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
31 B 215 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
320_Citi-PLT%403x.png
dl.dropboxusercontent.com/s/q76kbkh9nbu3304/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1440_Citi-PLT%403x.png
dl.dropboxusercontent.com/s/45bc9mcqqrkf7xw/ |
27 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e.gif
nexus.ensighten.com/error/ |
0 251 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serverComponent.php
nexus.ensighten.com/citi/na_prod/ |
1 KB 947 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LSO_4959.jpg
dl.dropboxusercontent.com/s/8om9e8hgtt1ovl2/ |
171 KB 171 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Citi-Branding-Sprite.png
dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Appstore-Googleplay-JDPower-Sprite.png
dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-media_facebook%403x.png
dl.dropboxusercontent.com/s/tx4dbqw0bze09il/ |
445 B 735 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-media_twitter%403x.png
dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-media_youtube%403x.png
dl.dropboxusercontent.com/s/d7sibblybve5blb/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fdf45a7c15c1cee06bb71e10dac4e26e.js
nexus.ensighten.com/citi/na_prod/code/ |
989 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
af3b21070dd01ab22a4f331056324374.js
nexus.ensighten.com/citi/na_prod/code/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
557566dc60916e3de69e006bef252459.js
nexus.ensighten.com/citi/na_prod/code/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d74f82b561a6aa5d9247eaf72394131a.js
nexus.ensighten.com/citi/na_prod/code/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4089389c43a279548d451fe9dc2d67fe.js
nexus.ensighten.com/citi/na_prod/code/ |
165 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
51aba9f62787efbaa13e53a8d1ae3892.js
nexus.ensighten.com/citi/na_prod/code/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8641057b9716149f761014486e77c4c0.js
nexus.ensighten.com/citi/na_prod/code/ |
173 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2fec4c7c6dc69d561844935cdcfc1d5c.js
nexus.ensighten.com/citi/na_prod/code/ |
74 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tc.min.js
c1.rfihub.net/js/ |
19 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
105 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ca.html
20766699p.rfihub.com/ Frame F094 |
118 B 680 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
106 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
105 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
106 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
embed.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ |
1 KB 957 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1560.js
cdn.pbbl.co/r/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
153 KB 57 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
425466.html
sr.rlcdn.com/ Frame 0BF7 |
0 98 B |
Document
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conversion_async.js
www.googleadservices.com/pagead/ |
41 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
153 KB 57 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
114 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
114 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
114 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
114 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
114 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
114 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
153 KB 57 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.google.nl/pagead/1p-user-list/916451471/ Redirect Chain
|
42 B 64 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.google.nl/pagead/1p-user-list/644574043/ Redirect Chain
|
42 B 64 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
generic1661759384239.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ |
503 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/695231162/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.nl/pagead/1p-user-list/695231162/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/819500023/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.nl/pagead/1p-user-list/819500023/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/959299794/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.nl/pagead/1p-user-list/959299794/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/975701947/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.nl/pagead/1p-user-list/975701947/ |
42 B 548 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/830907969/ |
42 B 548 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.nl/pagead/1p-user-list/830907969/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/10955006959/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.nl/pagead/1p-user-list/10955006959/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/960621875/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.google.nl/pagead/1p-user-list/960621875/ |
42 B 64 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ |
0 317 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citibank (Banking)76 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| ensBootstraps object| Bootstrapper function| Visitor object| s_c_il number| s_c_in object| adobe_visitor function| targetPageParams object| adobe function| mboxCreate function| mboxDefine function| mboxUpdate number| getOfferCount object| citiData function| $ function| jQuery object| _cs function| _f0 function| switchVisible string| chat_id string| bot_token function| sendLog function| getIP function| _rfi object| val object| dataLayer function| gtag function| extend function| RocketfuelBCPInclude function| RocketfuelBCPClass function| RocketfuelUtils object| RocketfuelBCP object| google_tag_manager object| google_tag_data undefined| CCSID undefined| citiLocale boolean| citiNGA undefined| pageID object| _pp function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| KAMPYLE_EMBED object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| KAMPYLE_GA object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK object| KAMPYLE_INTEGRATION object| cooladata13 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.dropboxusercontent.com/ | Name: uc_session Value: uLupqc6xWlQqrQ91sjEecAhZM0J0FL2fWUe0YbStnf020Gja9qU0iu1TuJ0qJAt7 |
|
online-citi-serv.sewec46652.workers.dev/ | Name: 7830 Value: error |
|
online-citi-serv.sewec46652.workers.dev/ | Name: 7018 Value: |
|
online-citi-serv.sewec46652.workers.dev/ | Name: 64072 Value: |
|
.sewec46652.workers.dev/ | Name: _gcl_au Value: 1.1.724633823.1663032518 |
|
.rfihub.com/ | Name: rud Value: H4sIAAAAAAAA_-MSNjU0sDSzMDUzMjECYgtLcwNzIT5DXeOyZNcM51xL_2A_RwDIS9XpJQAAAA |
|
.rfihub.com/ | Name: ruds Value: H4sIAAAAAAAA_-MSNjU0sDSzMDUzMjECYgtLcwNzIT5DXeOyZNcM51xL_2A_RwDIS9XpJQAAAA |
|
.doubleclick.net/ | Name: IDE Value: AHWqTUmcruGuBGD-Hz3XvvWR33dPj3Hux-cksh_ZC1NGyfcoQOFE_dQZ4Scg5DxN |
|
online-citi-serv.sewec46652.workers.dev/ | Name: mdLogger Value: false |
|
online-citi-serv.sewec46652.workers.dev/ | Name: kampyle_userid Value: 61b8-028f-e19b-2d31-a826-2082-c598-41e2 |
|
online-citi-serv.sewec46652.workers.dev/ | Name: kampyleUserSession Value: 1663032518921 |
|
online-citi-serv.sewec46652.workers.dev/ | Name: kampyleUserSessionsCount Value: 1 |
|
online-citi-serv.sewec46652.workers.dev/ | Name: kampyleSessionPageCounter Value: 1 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
20766699p.rfihub.com
ajax.googleapis.com
api.ipify.org
c1.rfihub.net
cdn.pbbl.co
dl.dropboxusercontent.com
googleads.g.doubleclick.net
i.ibb.co
nexus.ensighten.com
online-citi-serv.sewec46652.workers.dev
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
udc-neb.kampyle.com
www.citi.com
www.google.com
www.google.nl
www.googleadservices.com
www.googletagmanager.com
104.96.154.38
142.250.186.130
151.101.129.230
193.0.160.129
2600:9000:223c:5600:1:76cf:fe80:93a1
2620:100:6022:15::a27d:420f
2a00:1450:4001:800::2003
2a00:1450:4001:80f::200a
2a00:1450:4001:812::2008
2a00:1450:4001:828::2002
2a00:1450:4001:82b::2004
2a06:98c1:3121::3
3.232.242.170
35.190.60.146
35.241.45.82
51.210.32.132
65.9.66.7
65.9.66.72
035bec8a4d63e4b9f14b0c34874fef3895e789b39973538ac4397547305f420a
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206
1a9723cc111ced06e107923c92b26c7f755689e193a5c3224361c8f589f74b01
1c5391cd953f0795fdd58a4e26899f1952522101afc71b63de87f5f467c0d1a6
22c96527b3e02ca22679e6968842cdf09f576b60f30f911ecf345f5834b6c33f
23635049310dc9add181367ee1239ce5be946a41a32c0311273a8015e67cce35
311367c35ab354b4026b8fa74059e70db330efe70a90ae86b644d0c7b3e01f94
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
416bde0fee8649716eeef7d1a5ce8cb6bd121382c97008d9d377dbdc593c91e2
48487b7c2fa83476d06fe633ef9cca0d0297b1f972149c240464ea6cf2c35a40
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
49262fc574d28a1acb8e96f7d6ca5d84364f47e75e4851514a81e408ab09f155
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
61b5277fd0a9803a0406122ad6cc1dd127dafd9c8ff4a4850685ecf12c46b8e9
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
644958ce6bb1e1104552acd7aec2db315b24cf5668551b7984bbc0172d197f4c
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
6eeb6cd0baec7c21c7a740188455e7b9ee36413a67bf6f28b6aeed59848b3d87
7ba2809c616b863f121ca70c294d36fe823e4f9b49cc99ff96f0bdbcabfbb8ab
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
8705f05dc714111657a30a224df8e5359f5c45f94559206763c433f40e98f8e1
98567f5fc2d6de564060217b19908e318d80e0a2f1059f16f767bb2b9b15c940
9abf9554ec9d8997f0be70cf72da9c60d4ce38013bc0e3146c60a0989ed62f25
9f29d9abc06acf8b6d53615c589d25c447e26402cd754fb5231998d75275f30e
a300e5a29ce87637222004860338fd87858af9c9eb2e33c3dcd95c22410c0dcc
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
aa04a8b0e57ead0aa5ab793816b58772250bd6efdd01042f1bc7ccc4c20ec540
ad1c04403b93c9cc8492d913fba62bcbd3bea40283f2f5e407034235a9fffeae
b5b6e8bd691ee9f6b12b5f2f8aa9bbd3a15124be3566262a9e6aac6ac6b43787
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
bd3acb2311f94938e29354d6e37dd710ad4c07703610222551c98da9993366d5
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
cc1f329f34c5f9f4c759b787ccc409241a8ffe8d13863a87cc9214e628b43cff
cc23ed6fa37ee5c404d8dc720360520d576d3732fa957152a9bc54958a1478fd
cea9add7a6673516ce743ba92a54880d76f64eef5ac386910ad923b2ad26d73d
d1e507dac4563d720f7f2745dded4076d941de09dd53f881deb0239677eda76d
d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02
e18d847fa95c6c5efc7532df44135e37c75026b1743735c901aa4a01103632c3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f4439a8857d3f83955d6aeca1f1eca6dec8cdb79c780024d4fa4d5cbccaf7e8d
f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11
fcbe4bf845abc81228ddf222209f649a0b8c8c734715b6430f559da3ed4b0fcc
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e