paulantonyinsagency.com
Open in
urlscan Pro
34.69.219.172
Malicious Activity!
Public Scan
Submission: On November 06 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on November 6th 2023. Valid for: 3 months.
This is the only time paulantonyinsagency.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: State Farm (Insurance)Domain & IP information
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 172.219.69.34.bc.googleusercontent.com
paulantonyinsagency.com |
ASN15133 (EDGECAST, US)
static1.st8fm.com | |
static2.st8fm.com | |
ac1.st8fm.com | |
www.statefarm.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-106-227-229.deploy.static.akamaitechnologies.com
cdn-pci.optimizely.com |
ASN15169 (GOOGLE, US)
PTR: 133.70.198.104.bc.googleusercontent.com
mx-api.prod.mirus.io | |
peachy.prod.mirus.io |
ASN16509 (AMAZON-02, US)
PTR: ec2-44-229-106-46.us-west-2.compute.amazonaws.com
dpm.demdex.net |
ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-151.data.adobedc.net
smetrics.statefarm.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-231-55.compute-1.amazonaws.com
cm.everesttech.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-35-155-254-147.us-west-2.compute.amazonaws.com
statefarmmutualautomobileinsurancecompany.demdex.net |
ASN16625 (AKAMAI-AS, US)
PTR: a104-106-226-153.deploy.static.akamaitechnologies.com
a8367280580.cdn-pci.optimizely.com |
ASN16509 (AMAZON-02, US)
PTR: server-3-160-22-73.cmh68.r.cloudfront.net
deel-id-persistence.deel.c1.statefarm |
ASN14618 (AMAZON-AES, US)
PTR: ec2-184-73-159-12.compute-1.amazonaws.com
logx.optimizely.com |
ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
idsync.rlcdn.com |
ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f2.1e100.net
cm.g.doubleclick.net |
ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org | |
insight.adsrvr.org |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-65-202.compute-1.amazonaws.com
cms.analytics.yahoo.com | |
ups.analytics.yahoo.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-202-119-60.compute-1.amazonaws.com
usermatch.krxd.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-44-218-206-236.compute-1.amazonaws.com
beacon.krxd.net |
ASN32934 (FACEBOOK, US)
connect.facebook.net |
ASN16509 (AMAZON-02, US)
PTR: server-54-230-160-114.ewr53.r.cloudfront.net
js.adsrvr.org |
ASN29990 (ASN-APPNEX, US)
PTR: 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-55-235-232.deploy.static.akamaitechnologies.com
hb.yahoo.net |
ASN32934 (FACEBOOK, US)
www.facebook.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
35 |
st8fm.com
static1.st8fm.com — Cisco Umbrella Rank: 31700 static2.st8fm.com — Cisco Umbrella Rank: 119528 ac1.st8fm.com — Cisco Umbrella Rank: 92412 |
656 KB |
11 |
adsrvr.org
2 redirects
match.adsrvr.org — Cisco Umbrella Rank: 353 js.adsrvr.org — Cisco Umbrella Rank: 1610 insight.adsrvr.org — Cisco Umbrella Rank: 584 |
9 KB |
8 |
demdex.net
1 redirects
dpm.demdex.net — Cisco Umbrella Rank: 228 statefarmmutualautomobileinsurancecompany.demdex.net — Cisco Umbrella Rank: 10918 |
10 KB |
6 |
yahoo.com
6 redirects
cms.analytics.yahoo.com — Cisco Umbrella Rank: 1460 ups.analytics.yahoo.com — Cisco Umbrella Rank: 327 |
1 KB |
6 |
ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 3744 |
74 KB |
5 |
optimizely.com
cdn-pci.optimizely.com — Cisco Umbrella Rank: 10543 tapi.optimizely.com — Cisco Umbrella Rank: 14005 a8367280580.cdn-pci.optimizely.com — Cisco Umbrella Rank: 69723 logx.optimizely.com — Cisco Umbrella Rank: 1496 |
145 KB |
4 |
adnxs.com
4 redirects
ib.adnxs.com — Cisco Umbrella Rank: 246 |
3 KB |
4 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223 |
36 KB |
3 |
pinterest.com
ct.pinterest.com — Cisco Umbrella Rank: 849 |
1 KB |
3 |
doubleclick.net
3 redirects
cm.g.doubleclick.net — Cisco Umbrella Rank: 245 |
977 B |
3 |
mirus.io
mx-api.prod.mirus.io — Cisco Umbrella Rank: 669861 peachy.prod.mirus.io — Cisco Umbrella Rank: 314815 |
20 KB |
3 |
statefarm.com
www.statefarm.com — Cisco Umbrella Rank: 21529 smetrics.statefarm.com — Cisco Umbrella Rank: 29231 |
3 KB |
2 |
yahoo.net
hb.yahoo.net — Cisco Umbrella Rank: 938 |
1 KB |
2 |
pinimg.com
s.pinimg.com — Cisco Umbrella Rank: 847 |
21 KB |
2 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174 |
92 KB |
2 |
krxd.net
1 redirects
usermatch.krxd.net — Cisco Umbrella Rank: 1979 beacon.krxd.net — Cisco Umbrella Rank: 758 |
529 B |
2 |
rlcdn.com
2 redirects
idsync.rlcdn.com — Cisco Umbrella Rank: 415 |
829 B |
2 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 364 fonts.googleapis.com — Cisco Umbrella Rank: 31 |
31 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1137 |
35 KB |
1 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 110 |
185 B |
1 |
rubiconproject.com
1 redirects
pixel.rubiconproject.com — Cisco Umbrella Rank: 376 |
914 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 35 |
94 KB |
1 |
c1.statefarm
deel-id-persistence.deel.c1.statefarm — Cisco Umbrella Rank: 79381 |
3 KB |
1 |
everesttech.net
1 redirects
cm.everesttech.net — Cisco Umbrella Rank: 1275 |
517 B |
1 |
paulantonyinsagency.com
paulantonyinsagency.com |
12 KB |
92 | 25 |
Domain | Requested by | |
---|---|---|
31 | static1.st8fm.com |
paulantonyinsagency.com
static1.st8fm.com ajax.googleapis.com |
7 | dpm.demdex.net |
1 redirects
paulantonyinsagency.com
|
6 | match.adsrvr.org |
2 redirects
js.adsrvr.org
|
6 | nexus.ensighten.com |
paulantonyinsagency.com
nexus.ensighten.com |
5 | ups.analytics.yahoo.com | 5 redirects |
4 | ib.adnxs.com | 4 redirects |
4 | cdnjs.cloudflare.com |
paulantonyinsagency.com
|
3 | ct.pinterest.com |
static1.st8fm.com
s.pinimg.com |
3 | js.adsrvr.org |
www.googletagmanager.com
insight.adsrvr.org |
3 | cm.g.doubleclick.net | 3 redirects |
3 | static2.st8fm.com |
paulantonyinsagency.com
|
2 | hb.yahoo.net |
js.adsrvr.org
|
2 | insight.adsrvr.org |
js.adsrvr.org
|
2 | s.pinimg.com |
paulantonyinsagency.com
s.pinimg.com |
2 | connect.facebook.net |
paulantonyinsagency.com
connect.facebook.net |
2 | peachy.prod.mirus.io |
static1.st8fm.com
|
2 | idsync.rlcdn.com | 2 redirects |
2 | smetrics.statefarm.com |
nexus.ensighten.com
paulantonyinsagency.com |
2 | cdn-pci.optimizely.com |
paulantonyinsagency.com
cdn-pci.optimizely.com |
2 | maxcdn.bootstrapcdn.com |
paulantonyinsagency.com
|
1 | www.facebook.com | |
1 | pixel.rubiconproject.com | 1 redirects |
1 | www.googletagmanager.com |
nexus.ensighten.com
|
1 | beacon.krxd.net | |
1 | usermatch.krxd.net | 1 redirects |
1 | cms.analytics.yahoo.com | 1 redirects |
1 | logx.optimizely.com |
static1.st8fm.com
|
1 | deel-id-persistence.deel.c1.statefarm |
nexus.ensighten.com
|
1 | a8367280580.cdn-pci.optimizely.com |
cdn-pci.optimizely.com
|
1 | statefarmmutualautomobileinsurancecompany.demdex.net |
nexus.ensighten.com
|
1 | cm.everesttech.net | 1 redirects |
1 | tapi.optimizely.com |
cdn-pci.optimizely.com
|
1 | fonts.googleapis.com |
static1.st8fm.com
|
1 | mx-api.prod.mirus.io |
paulantonyinsagency.com
|
1 | www.statefarm.com |
paulantonyinsagency.com
|
1 | ac1.st8fm.com |
paulantonyinsagency.com
|
1 | ajax.googleapis.com |
paulantonyinsagency.com
|
1 | paulantonyinsagency.com | |
92 | 38 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.statefarm.com |
proofing.statefarm.com |
apps.statefarm.com |
financials.statefarm.com |
get-id-card.delitess.c1.statefarm |
Subject Issuer | Validity | Valid | |
---|---|---|---|
paulantonyinsagency.com R3 |
2023-11-06 - 2024-02-04 |
3 months | crt.sh |
nexus.ensighten.com Amazon RSA 2048 M02 |
2023-09-29 - 2024-10-27 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
statefarm.com Entrust Certification Authority - L1K |
2023-08-22 - 2024-08-22 |
a year | crt.sh |
cdn-pci.optimizely.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-01-30 - 2024-01-31 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-16 - 2024-01-08 |
3 months | crt.sh |
mx-api.prod.mirus.io R3 |
2023-10-22 - 2024-01-20 |
3 months | crt.sh |
*.optimizely.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-09-01 - 2024-09-04 |
a year | crt.sh |
smetrics.statefarm.com Entrust Certification Authority - L1K |
2023-01-20 - 2024-02-19 |
a year | crt.sh |
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-09-26 - 2024-10-26 |
a year | crt.sh |
*.cdn-pci.optimizely.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-01-30 - 2024-01-31 |
a year | crt.sh |
deel-id-persistence.deel.c1.statefarm Amazon RSA 2048 M02 |
2023-08-01 - 2024-08-29 |
a year | crt.sh |
logx.optimizely.com Amazon RSA 2048 M01 |
2023-06-24 - 2024-07-22 |
a year | crt.sh |
peachy.prod.mirus.io R3 |
2023-10-11 - 2024-01-09 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-10-16 - 2024-01-08 |
3 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2023-08-16 - 2023-11-14 |
3 months | crt.sh |
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-07-31 - 2024-08-07 |
a year | crt.sh |
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020 |
2023-04-12 - 2024-05-13 |
a year | crt.sh |
hb.yahoo.net R3 |
2023-10-09 - 2024-01-07 |
3 months | crt.sh |
This page contains 13 frames:
Primary Page:
https://paulantonyinsagency.com/
Frame ID: 33D2027AF7E4DE3962A549C3FF0B5791
Requests: 73 HTTP requests in this frame
Frame:
https://statefarmmutualautomobileinsurancecompany.demdex.net/dest5.html?d_nsid=0
Frame ID: 81B1EBDB1598C924745C8CA8FAC4572A
Requests: 6 HTTP requests in this frame
Frame:
https://a8367280580.cdn-pci.optimizely.com/client_storage/a8367280580.html
Frame ID: C4A58B13679A17E1B49B0F351573F032
Requests: 1 HTTP requests in this frame
Frame:
https://deel-id-persistence.deel.c1.statefarm/
Frame ID: 0DB2772A0D8C91104A7A752ECFEAEA13
Requests: 1 HTTP requests in this frame
Frame:
https://insight.adsrvr.org/track/up?adv=3davbp4&ref=https%3A%2F%2Fpaulantonyinsagency.com%2F&upid=t8xbszz&upv=1.1.0
Frame ID: 835D135B6D0635F5276478AC1B070B70
Requests: 2 HTTP requests in this frame
Frame:
https://insight.adsrvr.org/track/up?adv=ijc4snf&ref=https%3A%2F%2Fpaulantonyinsagency.com%2F&upid=9nilek2&upv=1.1.0
Frame ID: 293A67903BB26E367AADBFF4927191DF
Requests: 2 HTTP requests in this frame
Frame:
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Frame ID: 74912EB5205DD1886A2250F68D74655E
Requests: 1 HTTP requests in this frame
Frame:
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5495564365759693283&ttd_tdid=03ecb26b-6a9c-4781-a509-585041a3d28e
Frame ID: 244B092D3C2956374CD520217416B0D5
Requests: 1 HTTP requests in this frame
Frame:
https://hb.yahoo.net/cksync?cs=63&axid_e=eS02c2RINi5CRTJ1RVVUYjc5ZnJKWS5qeDZjOWlZbEZnOH5B&gdpr=0&ovsid=03ecb26b-6a9c-4781-a509-585041a3d28e&dpid=55953
Frame ID: 8239E02C79A9509456568E250212A50F
Requests: 1 HTTP requests in this frame
Frame:
https://hb.yahoo.net/cksync?cs=63&axid_e=eS02c2RINi5CRTJ1RVVUYjc5ZnJKWS5qeDZjOWlZbEZnOH5B&gdpr=0&ovsid=03ecb26b-6a9c-4781-a509-585041a3d28e&dpid=55953
Frame ID: EC3EF2A60828E7046F0991C841D27163
Requests: 1 HTTP requests in this frame
Frame:
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=03ecb26b-6a9c-4781-a509-585041a3d28e&google_gid=CAESELm60sMo7-cLl5MBy5ZQs2A&google_cver=1
Frame ID: D79DD22E26BC15391107B6A9BDE11456
Requests: 1 HTTP requests in this frame
Frame:
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=3434552784604093996&ttd_tdid=03ecb26b-6a9c-4781-a509-585041a3d28e
Frame ID: DB3F3CBDB58D01868BB2C9C803EFE7F7
Requests: 1 HTTP requests in this frame
Frame:
https://ct.pinterest.com/ct.html
Frame ID: 8E4BDAC13FED39AC803DD70B0D94A4E2
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Paul Antony - State Farm Insurance Agent in White Bear Lake, MNDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Handlebars (JavaScript Frameworks) Expand
Detected patterns
- handlebars(?:\.runtime)?(?:-v([\d.]+?))?(?:\.min)?\.js
Ensighten (Tag Managers) Expand
Detected patterns
- //nexus\.ensighten\.com/
Facebook (Widgets) Expand
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtm\.js
Optimizely (Analytics) Expand
Detected patterns
- optimizely\.com.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery Migrate (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
13 Outgoing links
These are links going to different origins than the main page.
Title: Skip to Main Content
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Trouble logging in?
Search URL Search Domain Scan URL
Title: Create an account
Search URL Search Domain Scan URL
Title: Pay a bill
Search URL Search Domain Scan URL
Title: Get ID card
Search URL Search Domain Scan URL
Title: autopay
Search URL Search Domain Scan URL
Title: paperless billing
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: or continue a quote
Search URL Search Domain Scan URL
Title: Get Directions
Search URL Search Domain Scan URL
Title: File a Claim
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 24- https://dpm.demdex.net/id?d_visid_ver=3.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=AAD53BC75245B4BA0A490D4D%40AdobeOrg&d_nsid=0&ts=1699311960389 HTTP 302
- https://dpm.demdex.net/id/rd?d_visid_ver=3.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=AAD53BC75245B4BA0A490D4D%40AdobeOrg&d_nsid=0&ts=1699311960389
- https://cm.everesttech.net/cm/dd?d_uuid=53015796298337667582391823790419574145 HTTP 302
- https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZUlxWQAAADYmRQN-
- https://idsync.rlcdn.com/365868.gif?partner_uid=53015796298337667582391823790419574145 HTTP 307
- https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomNTMwMTU3OTYyOTgzMzc2Njc1ODIzOTE4MjM3OTA0MTk1NzQxNDUQABoNCNripaoGEgUI6AcQAEIASgA HTTP 307
- https://dpm.demdex.net/ibs:dpid=477&dpuuid=52870de3a4544d4c670bd458b182113022993e718ccdbc7e34bfc28bbdb1af99b0da87c991749652
- https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NTMwMTU3OTYyOTgzMzc2Njc1ODIzOTE4MjM3OTA0MTk1NzQxNDU= HTTP 302
- https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NTMwMTU3OTYyOTgzMzc2Njc1ODIzOTE4MjM3OTA0MTk1NzQxNDU=&google_tc= HTTP 302
- https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENq4fOU-yyioQua4J-sZUuU&google_cver=1?gdpr=0&gdpr_consent=
- https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=paulantonyinsagency.com&ttd_tpi=1 HTTP 302
- https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=paulantonyinsagency.com&ttd_tpi=1 HTTP 302
- https://dpm.demdex.net/ibs:dpid=903&dpuuid=03ecb26b-6a9c-4781-a509-585041a3d28e
- https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=53015796298337667582391823790419574145&gdpr=0&gdpr_consent= HTTP 302
- https://ups.analytics.yahoo.com/ups/58782/cms?partner_id=ADOBE&_hosted_id=53015796298337667582391823790419574145&gdpr=0&gdpr_consent= HTTP 302
- https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-Kb6WmARE2pGy6wLg4q5C_dxNujclu7zZUU0-~A
- https://usermatch.krxd.net/um/v2?partner=adobe&id=53015796298337667582391823790419574145 HTTP 302
- https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=53015796298337667582391823790419574145
- https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=03ecb26b-6a9c-4781-a509-585041a3d28e&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
- https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
- https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=03ecb26b-6a9c-4781-a509-585041a3d28e HTTP 307
- https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D03ecb26b-6a9c-4781-a509-585041a3d28e HTTP 302
- https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5495564365759693283&ttd_tdid=03ecb26b-6a9c-4781-a509-585041a3d28e
- https://ups.analytics.yahoo.com/ups/55953/sync?uid=03ecb26b-6a9c-4781-a509-585041a3d28e&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true HTTP 302
- https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=55953&ovsid=03ecb26b-6a9c-4781-a509-585041a3d28e&gdpr=0&redir=true HTTP 302
- https://hb.yahoo.net/cksync?cs=63&axid_e=eS02c2RINi5CRTJ1RVVUYjc5ZnJKWS5qeDZjOWlZbEZnOH5B&gdpr=0&ovsid=03ecb26b-6a9c-4781-a509-585041a3d28e&dpid=55953
- https://ups.analytics.yahoo.com/ups/55953/sync?uid=03ecb26b-6a9c-4781-a509-585041a3d28e&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true HTTP 302
- https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=55953&ovsid=03ecb26b-6a9c-4781-a509-585041a3d28e&gdpr=0&redir=true HTTP 302
- https://hb.yahoo.net/cksync?cs=63&axid_e=eS02c2RINi5CRTJ1RVVUYjc5ZnJKWS5qeDZjOWlZbEZnOH5B&gdpr=0&ovsid=03ecb26b-6a9c-4781-a509-585041a3d28e&dpid=55953
- https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=MDNlY2IyNmItNmE5Yy00NzgxLWE1MDktNTg1MDQxYTNkMjhl&gdpr=0&gdpr_consent=&ttd_tdid=03ecb26b-6a9c-4781-a509-585041a3d28e HTTP 302
- https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=03ecb26b-6a9c-4781-a509-585041a3d28e&google_gid=CAESELm60sMo7-cLl5MBy5ZQs2A&google_cver=1
- https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=03ecb26b-6a9c-4781-a509-585041a3d28e HTTP 307
- https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D03ecb26b-6a9c-4781-a509-585041a3d28e HTTP 302
- https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=3434552784604093996&ttd_tdid=03ecb26b-6a9c-4781-a509-585041a3d28e
92 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
paulantonyinsagency.com/ |
44 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Bootstrap.js
nexus.ensighten.com/statefarm/mirus/ |
76 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.6/css/ |
147 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
normalize.css
static1.st8fm.com/en_US/dxl-1x/prod/css/lib/ |
16 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1x.core.css
static1.st8fm.com/en_US/dxl-1x/prod/css/ |
617 KB 69 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8421581994.js
cdn-pci.optimizely.com/js/ |
684 KB 141 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
StateFarmCommon.js
static1.st8fm.com/en_US/b2c_dvts/common/js/lib/ |
1 KB 870 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
handlebars.js
cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.0.6/ |
160 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1x.core.js
static1.st8fm.com/en_US/dxl-1x/prod/js/ |
340 KB 103 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1x.client.js
static1.st8fm.com/en_US/dxl-1x/prod/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-migrate.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.0.0/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.lazy.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.lazy/1.7.6/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.lazy.plugins.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.lazy/1.7.6/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
util.min.js
static1.st8fm.com/en_US/dxl/js/min/ |
29 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
validators.min.js
static1.st8fm.com/en_US/dxl/js/min/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsite.min.css
static2.st8fm.com/en_US/applications/agent/sf.gd.aoi.agentlocatormicrosite.agent-6.2.0-RC-174/styles/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
formalColorFull.jpg
ac1.st8fm.com/associate-photos/K/KL50B1YS000/ |
13 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stand-alone-quote.min.js
static1.st8fm.com/en_US/dxl/js/min/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
StateFarmisThere_en_desktop.png
static1.st8fm.com/en_US/applications/agent_microsite/6.0.0/resources/Media/Campaign/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookie
www.statefarm.com/agent/ |
0 827 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mobile-1.2.0.min.js
static2.st8fm.com/en_US/applications/agent/sf.gd.aoi.agentlocatormicrosite.agent-6.2.0-RC-174/scripts/ |
111 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsite.min.js
static2.st8fm.com/en_US/applications/agent/sf.gd.aoi.agentlocatormicrosite.agent-6.2.0-RC-174/scripts/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
peachy-client
mx-api.prod.mirus.io/ |
65 KB 20 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rd
dpm.demdex.net/id/ Redirect Chain
|
1 KB 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serverComponent.php
nexus.ensighten.com/statefarm/mirus/ |
502 B 832 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
oeu1699311960674r0.36431457747128837
tapi.optimizely.com/api/targeting/8421581994/8453960666/ |
31 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geo4.js
cdn-pci.optimizely.com/js/ |
310 B 749 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
StateFarmCommon.js
static1.st8fm.com/en_US/b2c_dvts/common/js/lib/ |
297 KB 168 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id
smetrics.statefarm.com/ |
48 B 470 B |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=411&dpuuid=ZUlxWQAAADYmRQN-
dpm.demdex.net/ Redirect Chain
|
42 B 942 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ErrorPage.json
static1.st8fm.com/en_US/errors/1/ |
4 KB 865 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest5.html
statefarmmutualautomobileinsurancecompany.demdex.net/ Frame 81B1 |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a8367280580.html
a8367280580.cdn-pci.optimizely.com/client_storage/ Frame C4A5 |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f6ca2e99febe9709bb945b3b460ccc9d.js
nexus.ensighten.com/statefarm/mirus/code/ |
166 KB 46 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
329fbdab9636170eedfc1422b36a9201.js
nexus.ensighten.com/statefarm/mirus/code/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
490ca4ccefe20cf502ab771ba0b689e4.js
nexus.ensighten.com/statefarm/mirus/code/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chevron.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/core/ |
5 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MecherleSans-Regular.woff2
static1.st8fm.com/en_US/dxl-1x/prod/css/fonts/Mecherle/woff/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MecherleSans-Medium.woff2
static1.st8fm.com/en_US/dxl-1x/prod/css/fonts/Mecherle/woff/ |
31 KB 32 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MecherleSans-SemiBold.woff2
static1.st8fm.com/en_US/dxl-1x/prod/css/fonts/Mecherle/woff/ |
31 KB 32 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MecherleSans-Bold.woff2
static1.st8fm.com/en_US/dxl-1x/prod/css/fonts/Mecherle/woff/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MecherleLegal-Regular.woff2
static1.st8fm.com/en_US/dxl-1x/prod/css/fonts/Mecherle/woff/ |
32 KB 32 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
deel-id-persistence.deel.c1.statefarm/ Frame 0DB2 |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
e.gif
nexus.ensighten.com/error/ |
0 217 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navigation-footer-limited.html
static1.st8fm.com/en_US/dxl-1x/prod/renders/footer/ |
580 B 448 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navigation-header-unauth-limited.html
static1.st8fm.com/en_US/dxl-1x/prod/renders/header/ |
10 KB 3 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MecherleSans-RegularItalic.woff2
static1.st8fm.com/en_US/dxl-1x/prod/css/fonts/Mecherle/woff/ |
33 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chat_32.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/icons/ |
565 B 387 B |
XHR
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phone_32.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/icons/ |
405 B 357 B |
XHR
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
email_32.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/icons/ |
251 B 284 B |
XHR
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
payment_32.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/icons/ |
702 B 481 B |
XHR
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id_card_32.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/icons/ |
468 B 341 B |
XHR
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
events
logx.optimizely.com/v1/ |
0 559 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hashtable.js
static1.st8fm.com/en_US/applications/login-interceptor/device-print/js/ |
13 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
devicePrint.js
static1.st8fm.com/en_US/applications/login-interceptor/device-print/js/ |
36 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
state-farm-logo-4.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/header/ |
9 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
state-farm-logo-5.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/header/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
payment_24.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/header/ |
711 B 475 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id_card_24.svg
static1.st8fm.com/en_US/dxl-1x/prod/css/images/header/ |
561 B 382 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s31329003453885
smetrics.statefarm.com/b/ss/sfglobalprod/10/JS-2.1.0/ |
1 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
40f478f2-8732-4e29-803d-536167741577
https://paulantonyinsagency.com/ |
2 KB 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=477&dpuuid=52870de3a4544d4c670bd458b182113022993e718ccdbc7e34bfc28bbdb1af99b0da87c991749652
dpm.demdex.net/ Frame 81B1 Redirect Chain
|
42 B 942 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
pageviews
peachy.prod.mirus.io/record/3.0/projects/null/events/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
pageviews
peachy.prod.mirus.io/record/3.0/projects/null/events/ |
80 B 330 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=771&dpuuid=CAESENq4fOU-yyioQua4J-sZUuU&google_cver=1
dpm.demdex.net/ Frame 81B1 Redirect Chain
|
42 B 942 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
89 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=903&dpuuid=03ecb26b-6a9c-4781-a509-585041a3d28e
dpm.demdex.net/ Frame 81B1 Redirect Chain
|
42 B 942 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=30646
dpm.demdex.net/ Frame 81B1 Redirect Chain
|
42 B 948 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
usermatch.gif
beacon.krxd.net/ Frame 81B1 Redirect Chain
|
0 338 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
462 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
202 KB 54 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core.js
s.pinimg.com/ct/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
up_loader.1.1.0.js
js.adsrvr.org/ |
5 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
up
insight.adsrvr.org/track/ Frame 835D |
889 B 971 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
up
insight.adsrvr.org/track/ Frame 293A |
874 B 945 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.0f30f8d0.js
s.pinimg.com/ct/lib/ |
65 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1673276772914128
connect.facebook.net/signals/config/ |
158 KB 38 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
universal_pixel.1.1.0.js
js.adsrvr.org/ Frame 293A |
488 B 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
universal_pixel.1.1.0.js
js.adsrvr.org/ Frame 835D |
488 B 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ct.pinterest.com/user/ |
304 B 411 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ct.pinterest.com/v3/ |
35 B 399 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rubicon
match.adsrvr.org/track/cmf/ Frame 7491 Redirect Chain
|
70 B 492 B |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
appnexus
match.adsrvr.org/track/cmf/ Frame 244B Redirect Chain
|
70 B 492 B |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cksync
hb.yahoo.net/ Frame 8239 Redirect Chain
|
53 B 658 B |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cksync
hb.yahoo.net/ Frame EC3E Redirect Chain
|
53 B 658 B |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google
match.adsrvr.org/track/cmf/ Frame D79D Redirect Chain
|
70 B 492 B |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
appnexus
match.adsrvr.org/track/cmf/ Frame DB3F Redirect Chain
|
70 B 492 B |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ct.html
ct.pinterest.com/ Frame 8E4B |
565 B 405 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
1936962093151750
connect.facebook.net/signals/config/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
0 185 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- connect.facebook.net
- URL
- https://connect.facebook.net/signals/config/1936962093151750?v=2.9.138&r=stable&domain=paulantonyinsagency.com
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: State Farm (Insurance)216 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 function| UIEvent object| documentPictureInPicture object| ensBootstraps object| Bootstrapper function| Visitor object| s_c_il number| s_c_in object| visitor undefined| _ object| optimizely function| getCookieOptAA number| startTime number| duration function| $ function| jQuery object| Handlebars function| _slicedToArray function| _nonIterableRest function| _iterableToArrayLimit function| _arrayWithHoles function| _typeof function| _toConsumableArray function| _nonIterableSpread function| _iterableToArray function| _arrayWithoutHoles function| _createForOfIteratorHelper function| _unsupportedIterableToArray function| _arrayLikeToArray object| oneX function| gm_authFailure object| datepickers object| days object| months object| sides object| events function| datepicker function| applyListeners function| createInstance function| freshCopy function| sanitizeOptions function| defaults function| establishPosition function| renderCalendar function| createControls function| createMonth function| createOverlay function| selectDay function| setCalendarInputValue function| changeMonthYear function| calculatePosition function| dateCheck function| stripTime function| hideCal function| showCal function| toggleOverlay function| overlayYearEntry function| oneHandler function| show function| hide function| setDate function| setMin function| setMax function| changeMinOrMax function| remove function| Kibo function| MarkerClusterer function| Cluster function| ClusterIcon object| bootstrap object| language object| footer_ul undefined| language_url function| isExtraSmall function| isSmall function| isMedium function| isLarge function| isExtraLarge function| showHiddenContent function| hasModulesLocationLoaded object| onelocation function| ErrorMessage_callback function| showError function| hideError object| dxa_modules object| modules object| dxl_modules function| dropDownFn function| escClickFn function| addAriaExpanded function| removeAriaExpanded function| addAriaHidden function| removeAriaHidden object| dataLayer function| getLaunchObject function| setLaunchObject function| modalFunction object| skipContentController object| emailAgentController object| officeSpecificInformation object| messageBanner object| utilityFunctions object| quoteSection object| banner object| maps object| abbrFocus function| _classCallCheck function| _defineProperties function| _createClass function| _toPropertyKey function| _toPrimitive function| setImmediate function| clearImmediate undefined| keenGlobals function| Keen function| KeenTracking function| default function| errorLogging string| sName string| h string| p string| t function| AppMeasurement_Module_ActivityMap function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_Media function| AppMeasurement function| s_gi function| s_pgicq boolean| _frstRun undefined| _scTempPrevURL object| _scHtml object| _langButtons undefined| _i string| s_account function| DIL number| s_objectID number| s_giq object| s string| s_urlPathEmber boolean| s_emberIndicator boolean| screenChange string| s_testsplitpath string| str string| newstr string| _scLang function| intentEvent string| v string| val string| Ev string| k string| s_campaignSet undefined| prop31 object| s_i_sfglobalprod function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| randrange function| detectIE function| getRandomPort object| ProxyCollector function| BlackberryLocationCollector function| detectFields string| SEP string| PAIR string| DEV function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector object| TimestampCollector object| UIEventCollector function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetection function| convertTimestampToGMT function| getTimestampInMillis function| debug function| forceIE89Synchronicity function| peachyEvent object| GTMdataLayer function| daGTMAdd object| google_tag_manager object| google_tag_data function| fbq function| _fbq function| pintrk function| ttd_dom_ready function| TTDUniversalPixelApi42 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
paulantonyinsagency.com/ | Name: __cheesecrd_version Value: master |
|
.paulantonyinsagency.com/ | Name: optimizelyEndUserId Value: oeu1699311960674r0.36431457747128837 |
|
.demdex.net/ | Name: demdex Value: 53015796298337667582391823790419574145 |
|
.paulantonyinsagency.com/ | Name: AMCVS_AAD53BC75245B4BA0A490D4D%40AdobeOrg Value: 1 |
|
.statefarm.com/ | Name: s_ecid Value: MCMID%7C47778303268344004423093351563133236829 |
|
.paulantonyinsagency.com/ | Name: s_gad Value: 1 |
|
.everesttech.net/ | Name: everest_g_v2 Value: g_surferid~ZUlxWQAAADYmRQN- |
|
.dpm.demdex.net/ | Name: dpm Value: 53015796298337667582391823790419574145 |
|
.paulantonyinsagency.com/ | Name: AMCV_AAD53BC75245B4BA0A490D4D%40AdobeOrg Value: 690614123%7CMCIDTS%7C19668%7CMCMID%7C47778303268344004423093351563133236829%7CMCAAMLH-1699916760%7C9%7CMCAAMB-1699916760%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1699319160s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19675%7CvVersion%7C3.1.0 |
|
.paulantonyinsagency.com/ | Name: s_pre_pn Value: sf%3Aus%3Aagent-micro-v%3Akl50b1ys000 |
|
.paulantonyinsagency.com/ | Name: s_pre_v6 Value: paulantonyinsagency.com |
|
.paulantonyinsagency.com/ | Name: s_dl Value: 1 |
|
.paulantonyinsagency.com/ | Name: s_cm Value: typed%2Fbookmarkedundefinedtyped%2Fbookmarked |
|
.paulantonyinsagency.com/ | Name: s_ev32 Value: %5B%5B%27direct%2520load%27%2C%271699311961983%27%5D%5D |
|
.paulantonyinsagency.com/ | Name: s_cc Value: true |
|
.paulantonyinsagency.com/ | Name: AAMC_statefarmmutualautomobileinsurancecompany_0 Value: REGION%7C9 |
|
.paulantonyinsagency.com/ | Name: aam_uuid Value: 53015796298337667582391823790419574145 |
|
.rlcdn.com/ | Name: rlas3 Value: mxbF2lcvC1a/57WoDX90wzFseh4CrXnS4Bg8G2apuAE= |
|
.paulantonyinsagency.com/ | Name: s_session Value: s_prev_url%3Dhttps%3A%2F%2Fpaulantonyinsagency.com%2F%7CentryProperty%3Dhttps%3A%2F%2Fpaulantonyinsagency.com%2F%7Cs_prev_channel%3Dsf%3Aundefined%3Aagent-micro-v%7Cs_prev_ch%3Dagent-micro-v%7Cs_prev_pn%3Dkl50b1ys000%7Cs_prev_pageName%3Dsf%3Aundefined%3Aagent-micro-v%3Akl50b1ys000%7Cmc%3Ddirect%20load%7Caowsv%3DNaN%7C |
|
paulantonyinsagency.com/ | Name: keen Value: {%22initialReferrer%22:null} |
|
.rlcdn.com/ | Name: pxrc Value: CNripaoGEgUI6AcQABIGCPHrARAA |
|
.doubleclick.net/ | Name: IDE Value: AHWqTUmY1h39eCt7KQviPEnocakLRJ7-JlnuOyoJNVDoH_KbdZHLa4l9465ZDLPeSRg |
|
.adsrvr.org/ | Name: TDID Value: 03ecb26b-6a9c-4781-a509-585041a3d28e |
|
.demdex.net/ | Name: dextp Value: 60-1-1699311962212|771-1-1699311962415|903-1-1699311962532|30646-1-1699311962638|66757-1-1699311962749 |
|
deel-id-persistence.deel.c1.statefarm/ | Name: agentEntryProperty Value: https://paulantonyinsagency.com/ |
|
deel-id-persistence.deel.c1.statefarm/ | Name: agentReferrer Value: undefined |
|
deel-id-persistence.deel.c1.statefarm/ | Name: agentCMPIDevent Value: undefined |
|
deel-id-persistence.deel.c1.statefarm/ | Name: fromAgentSite Value: paulantonyinsagency.com |
|
deel-id-persistence.deel.c1.statefarm/ | Name: agentOfficeCode Value: 237353 |
|
.yahoo.com/ | Name: A3 Value: d=AQABBFpxSWUCEEciTkdSUQQ7_gesH9K7m1QFEgEBAQHCSmVTZdxS0iMA_eMAAA&S=AQAAAi9X0UUpTmhphHYOEwiI4dM |
|
.krxd.net/ | Name: _kuid_ Value: P5ogHVy0 |
|
.paulantonyinsagency.com/ | Name: _gcl_au Value: 1.1.729814389.1699311964 |
|
.analytics.yahoo.com/ | Name: IDSYNC Value: "19cu~2ewn:1769~2ewn:19e0~2ewn" |
|
.pinterest.com/ | Name: ar_debug Value: 1 |
|
.paulantonyinsagency.com/ | Name: _pin_unauth Value: dWlkPU1qSTVNMlUzTVdNdE56Z3pPUzAwTXpVNExXRXhZMlV0TnpBME1qQmhOVGd4TkRGbQ |
|
.rubiconproject.com/ | Name: khaos Value: LONIGVEP-1O-FFR0 |
|
.rubiconproject.com/ | Name: audit Value: 1|Gg/trucCePjxbcIFEY9EKCU9NH/NSgGxgXbpwr7En2jhj9K5Ghav9Rb10b2pexVuwdj6EnItwY8wHTRO1/p4iHX0qfg68IpFQAPcN3ARK86Hy3EfRjpqZoMmrFE+5s9mJVlGb8t+wnPrwTkQIAISQ2ZjK1lPTCVBd2uNsKpExX7REvsM2ra73MRmS8gGs6ylTlon0IrnE1p4+byUJuUHKNl4Am3SUH3rwETMVR8lnVPictVKI3nW/ZSmfFa9k+2RfCCm1vF3Tgn8ih/oL8+08tuVaVkDFDbShAUs62yL6R/QD5U7tEfUTQ== |
|
.adnxs.com/ | Name: uuid2 Value: 5495564365759693283 |
|
.adsrvr.org/ | Name: TDCPM Value: CAESEgoDYWFtEgsIwpyRsN_JrzwQBRIZCgpyaWdodG1lZGlhEgsI-uS4vt_JrzwQBRIVCgZnb29nbGUSCwjIopTA38mvPBAFEhcKCGFwcG5leHVzEgsI7tjfwd_JrzwQBRgFIAMoAzILCIrBu-v1ya88EAVCDyINCAESCQoFdGllcjEQAVoHM2RhdmJwNGAB |
|
.hb.yahoo.net/ | Name: data-ttd Value: 03ecb26b-6a9c-4781-a509-585041a3d28e~~63 |
|
.hb.yahoo.net/ | Name: visitor-id Value: 3423135646634298000V10 |
|
.paulantonyinsagency.com/ | Name: _fbp Value: fb.1.1699311965650.1375123899 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a8367280580.cdn-pci.optimizely.com
ac1.st8fm.com
ajax.googleapis.com
beacon.krxd.net
cdn-pci.optimizely.com
cdnjs.cloudflare.com
cm.everesttech.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
connect.facebook.net
ct.pinterest.com
deel-id-persistence.deel.c1.statefarm
dpm.demdex.net
fonts.googleapis.com
hb.yahoo.net
ib.adnxs.com
idsync.rlcdn.com
insight.adsrvr.org
js.adsrvr.org
logx.optimizely.com
match.adsrvr.org
maxcdn.bootstrapcdn.com
mx-api.prod.mirus.io
nexus.ensighten.com
paulantonyinsagency.com
peachy.prod.mirus.io
pixel.rubiconproject.com
s.pinimg.com
smetrics.statefarm.com
statefarmmutualautomobileinsurancecompany.demdex.net
static1.st8fm.com
static2.st8fm.com
tapi.optimizely.com
ups.analytics.yahoo.com
usermatch.krxd.net
www.facebook.com
www.googletagmanager.com
www.statefarm.com
connect.facebook.net
104.106.226.153
104.106.227.229
104.198.70.133
142.251.40.162
151.101.64.84
152.195.54.7
184.73.159.12
23.55.235.232
2600:141b:9000:2a5::19f0
2600:9000:2511:5a00:2:8f43:5780:93a1
2606:4700::6811:190e
2606:4700::6812:acf
2607:f8b0:4006:80b::2008
2607:f8b0:4006:80d::200a
2607:f8b0:4006:80e::200a
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
2a04:4e42:77::84
3.160.22.73
34.200.65.202
34.202.119.60
34.69.219.172
35.155.254.147
35.190.60.146
35.71.131.137
44.218.206.236
44.229.106.46
52.203.231.55
54.230.160.114
63.140.38.151
68.67.178.10
8.43.72.97
02e9c70478b4ed0444cfa8a953983e0a0388b731ec7b07662bd667d56816bf2c
059d251c85f38179f09d400e18e3029c8149f399afe7f6b8751759fcc5bec914
0a2fbd594bfe9e0cea876bd42655e9234e6284bb75a6efc72f074072a12eafac
0bc192aee347215f0a0764e0ffb8d1f9962807fcd1fdf64607e60073212b10e3
0ce44ad25a0225d7c513554356a135752fced4df25717c7d1fe614599e91d91e
11a4be6b95d97e7e9f80d4cacb0d13f2404cf05c0499308da1f833a42accf291
1317d4275e30dc08856be654c0535788817866a5d89ef27a01898d7ae1ee3600
1427cdaf115f6cb0ce2e1d3e57d06247991e8250275979094cdfac0764165294
1b4422b59a25e372e89d3fcb4cde270f39ab2e552bab8858f16a31db312d9ede
1be3277a591ff69db0e1b271baf771bdd69eab538b5541ca12b13836f7077180
1eec5d0bc72fba33ce753f6009a277e07041fb92d221ae5839bbc5e8fff1d0bb
1f98a4c138afc4ae03b27be67c3b28d7eceba1a39d24172435cc42bf8d69bbc3
1fe711aec93171cacefa8198f5b235bf84fde20b14a8c873a66b044373037128
240422c986046f61655378669aca9bc6e6369c8f7c2897c0c73f7313eac34fed
25dd3d1ae4d08c8e163294efa84c6941d41f4f3a0c0dc2f7d8fc699095494ccd
26494360e0db8345fef2c3e22a47055116f9cfb46f94d308684dd1036cfdeefc
2711979a44964541af0fe45e846e88690273e13c7e03feb78462bc91a18bbf68
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
3d17b798b45775e93e25293bba964ac616e1d2a8325173ed87ad9560233c117c
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3f16963445f94c8f8da1da1de343a0d31c52334b74698a39e2e0bb461d32763d
404f113bf23ea6872abebe52620ce1a9f9b47bec46cf3938dd50d91ebee9f23e
484ef4268f1d679c1ae88c06fc2388d39afc441465732617e5e2cdc2e3d418e2
4a3db30996d4feb1de7cb1aa05d033ce57226b3d673b71d9bbb7c6edccfa5627
4c3408b93dfe900e553ff474b9a1a4d0982871d52490136420ad6006cc5bcdc0
4fade6783d8e12a9413168db48f89037690b11b30fb07f48596f8ef39d752c0d
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
52dab22dd893cdb9dc9d2bafe35e9733ebef85efa1410f339d6acc0478281cc5
56cb81b020021098e18c791a1c89c16860425a190326fe8dc676d39bf992e5aa
59789b85b1a8b5dec038e5921b2b8f1a597a935d9798bfbfaa8892dad89f919c
64d82f5d2dfd91262b776894417faaedf2159d900d80de148affcb57beee794d
6599e9c2bf5bb6c8f1a30d0f2efbae685c4fe0722101cc4b35c493e2419df8a2
6b79c2cee1e5d9ece0147e076bf08b9eae8b61e1d9cd7c5715dcbc54816decaa
6d087870e33e6695fff4aa3f279df450bb476dedaf165b38d166567134f72d48
6e17fa3cc4118440d1111d00c3aca6e3183e736de354210eafe140eb92dba8d7
70c55cc464ab17e2e9dc071dfdc065882b4e5f33532baeecbed99bbfe068fcc6
746164f668cd2513526e7b3bc8bc14c980c03fb967b4015f898164a89da8e70a
7a2ffbc33855476429b6d831e2affa95bad9ac98656631421c899c7100da0159
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7ef31430e79a7df5a6ce473892ae2aac133402a29a989611f5d5016d1f7cc1e4
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
88e2639b29c1d092cd03d6771d44efe87a08b258ea38ec607c96bfbc2e36364c
891eec21df42d40440bc9c3dee3aa2dda8ada02102865925b7edc7e4802f46f6
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
8a5d94461dfc45efc41660ba3a79c6c1972c068ee0a8db506789a943be035644
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
980c9d8469c5132d294a0b1b877fbd353decdf9ae788c659bbbd07eb0e793136
9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470
9e16cbb2632f0d7d915f5c96a7571fe13164c782af645eb11852cd8d9ef1d718
a225e8717ef25aa3e2014ffcb8c8fdb986e846fafe510d4671ebbcee0b6e5244
a4ccf24e7583234274dbb21ccd8f2c33afd77fb6620b9da74eed08f7db8d18da
aebf611c1438dc7ec748e9a6364c734066b34bf2a1c7e2fc6511ed784635b50e
af3b33bb6b8b4ae08f0ffa60d9b975e0b50ac4710a8c53c26d52946a6401e484
b3bea6904c6130332fdc7ca63b0b971b63b60752654b956ebf0e4b7753ecb09d
b434e7b06d1e76c8ecf4b8fb260010f4b414c03da3ce0ee7fcc2391478bde1be
befea78b20324739582ae2458e7b3677fd4ac77acbf60aaeb476e4fcd84e58b1
c459691f5389de616773286683cd2870125551ed4020d3f29bdc161d35cc976f
c46ea001dc81eea0f86c7a32507f648f78a6e4f40b14db44ebd1fe0111a10c26
c7012dbe6534ccd46097b8756ffbbcc4d030429939edb882fbb29d48298ed30f
ca351cb08c40c92cc44f8bc7adf7dae0a56cc4f71a0d3f9fa462719a3c914a7f
ca4079b45eb719dafb86f764c262fae2518608b533d4714aa5f897d961001cf1
cb598957119c60141717676dceb24704495e5cac111a62cea6c34f5d89007949
d3ecb14e3a68aa5523afe335478459f1fdf77926da2dc7df11f37033e0ceb885
d835ef5a85deb9cccbe7c01f71fa555d72c25b49f07368645fba6022d79273a5
d98509f5351c7f8a41a5aa749a3ca3e1fe31984a4e8dddbe436508e69b77434e
ddcdedb1aaf1b36d8a30168011a50586995ac8e3102b12cbcdcb33e2cc50fd4d
de10644653057a725f07b153c651cd920b75e5ca4b4e395b7a271c7620ce45d7
e121c2f8e5ffa52a72b7a4c6dcd76e6ee6e48414991ffa1e58ad0cea7af92105
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4f85d5ee1f37c2c6dd63ae8ce72f4655da5efe2bb74787e181441d28ada9e07
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
e8cb4f6486e9fd1ee9050b84f67b2b6d907a0496e5146b0a86c7bc6cd3925f48
eef4b80043a4aeba715efb34d50df6f3c9246747bd2444aa9befe8687221f51c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef62646b0b21053bd22e4069e956d629cd4a64b4e35aeaaca0b522123b242c29
f2a07e6c5d1fccd3227bdd711311a1b7bd6c059f5be1e342c7ffc3cd7fd443ce
f83b1a3ea61ad62e47fad82de5495a2547e2f12e591ad8108050538c566ae1e3
fbde8d40a87bb97fa69ad62589eda40193b64ce29840502238fc4263ee46ed1b