back-inter-refund.com
Open in
urlscan Pro
173.236.158.59
Malicious Activity!
Public Scan
URL:
http://back-inter-refund.com/TD/
Submission: On May 10 via automatic, source phishtank
Submission: On May 10 via automatic, source phishtank
Summary
This website contacted 6 IPs
in 1 countries
across 5 domains to perform 82 HTTP transactions.
The main IP is 173.236.158.59, located in
Brea, United States and
belongs to DREAMHOST-AS - New Dream Network, LLC, US.
The main domain is back-inter-refund.com.
This is the only time back-inter-refund.com was scanned on urlscan.io!
This is the only time back-inter-refund.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: TD Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 49 | 173.236.158.59 173.236.158.59 | 26347 (DREAMHOST-AS) (DREAMHOST-AS - New Dream Network) | |
| 2 | 172.227.147.149 172.227.147.149 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 2 | 204.13.194.237 204.13.194.237 | 29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus) | |
| 1 | 204.13.194.242 204.13.194.242 | 29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus) | |
| 1 29 | 192.225.158.1 192.225.158.1 | 30286 (THM) (THM - ThreatMetrix Inc.) | |
| 1 2 | 172.82.228.16 172.82.228.16 | 15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.) | |
| 82 | 6 |
49
173.236.158.59
(Brea, United States)
ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US)
PTR: apache2-udder.byrch.dreamhost.com
ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US)
PTR: apache2-udder.byrch.dreamhost.com
| back-inter-refund.com |
2
172.227.147.149
(Cambridge, United States)
ASN20940 (AKAMAI-ASN1, US)
PTR: a172-227-147-149.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a172-227-147-149.deploy.static.akamaitechnologies.com
| www.tdcanadatrust.com |
2
204.13.194.237
(New York, United States)
ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
| ads.tdcanadatrust.com |
1
204.13.194.242
(New York, United States)
ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
| oasc17.247realmedia.com |
29
192.225.158.1
(San Jose, United States)
ASN30286 (THM - ThreatMetrix Inc., US)
PTR: a-sac.h.online-metrix.net
ASN30286 (THM - ThreatMetrix Inc., US)
PTR: a-sac.h.online-metrix.net
| h.online-metrix.net |
2
172.82.228.16
(Lehi, United States)
ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.d1.sc.omtrdc.net
ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.d1.sc.omtrdc.net
| metrics.td.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 49 |
back-inter-refund.com
back-inter-refund.com |
273 KB |
| 29 |
online-metrix.net
1 redirects
h.online-metrix.net |
50 KB |
| 4 |
tdcanadatrust.com
1 redirects
www.tdcanadatrust.com ads.tdcanadatrust.com |
10 KB |
| 2 |
td.com
1 redirects
metrics.td.com |
2 KB |
| 1 |
247realmedia.com
oasc17.247realmedia.com |
549 B |
| 82 | 5 |
| Domain | Requested by | |
|---|---|---|
| 49 | back-inter-refund.com |
back-inter-refund.com
|
| 29 | h.online-metrix.net |
1 redirects
back-inter-refund.com
h.online-metrix.net |
| 2 | metrics.td.com | 1 redirects |
| 2 | ads.tdcanadatrust.com |
1 redirects
back-inter-refund.com
|
| 2 | www.tdcanadatrust.com |
back-inter-refund.com
|
| 1 | oasc17.247realmedia.com |
back-inter-refund.com
|
| 82 | 6 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.tdcanadatrust.com |
| banquenet.td.com |
| www.tdwaterhouse.ca |
| www.td.com |
| easyweb.td.com |
| ads.tdcanadatrust.com |
| td.intelliresponse.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| h.online-metrix.net Thawte TLS RSA CA G1 |
2018-03-22 - 2020-03-21 |
2 years | crt.sh |
This page contains 4 frames:
Primary Page:
http://back-inter-refund.com/TD/
Frame ID: 85A6002FF36DD46374F8C899D777F23D
Requests: 40 HTTP requests in this frame
Frame:
http://back-inter-refund.com/TD/index_files/HP.htm
Frame ID: 47D11E239C6826AC7C8DFF5E0245FC11
Requests: 15 HTTP requests in this frame
Frame:
https://h.online-metrix.net/fp/check.js?org_id=i8n5h0pw&session_id=73df7d77-546b-476d-b8d7-eed2e6b94e9f&pageid=1
Frame ID: DAA9D50C883C7BC8B7B07DCC3D0012B9
Requests: 26 HTTP requests in this frame
Frame:
https://h.online-metrix.net/fp/top_fp.html;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596?org_id=i8n5h0pw&session_id=73df7d77-546b-476d-b8d7-eed2e6b94e9f&nonce=1229381d121aa24c&pageid=1
Frame ID: E3B9B4F87D507D70313BD96916DC491F
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Modernizr
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
- env /^Modernizr$/i
SiteCatalyst
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^s_(?:account|objectID|code|INST)$/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
21 Outgoing links
These are links going to different origins than the main page.
URL: https://www.tdcanadatrust.com/products-services/banking/index-banking.jsp
Title: TD Home
Title: TD Home
Search URL Search Domain Scan URL
URL: https://www.tdcanadatrust.com/products-services/banking/apply-index.jsp
Title: Apply
Title: Apply
Search URL Search Domain Scan URL
URL: https://banquenet.td.com/waw/idp/login.htm
Title: Français
Title: Français
Search URL Search Domain Scan URL
URL: https://www.tdcanadatrust.com/customer-service/contact-us/email/contact.jsp
Title: Contact Us
Title: Contact Us
Search URL Search Domain Scan URL
URL: https://www.tdwaterhouse.ca/markets-research/markets/index.jsp
Title: Markets & Research
Title: Markets & Research
Search URL Search Domain Scan URL
URL: https://www.tdcanadatrust.com/planning/life-events/planning_future.jsp
Title: Life Planning
Title: Life Planning
Search URL Search Domain Scan URL
URL: http://www.tdcanadatrust.com/products-services/banking/electronic-banking/access-card-security/guarantee.jsp
Title: Learn more >
Title: Learn more >
Search URL Search Domain Scan URL
URL: http://www.td.com/privacy-and-security/privacy-and-security/how-you-can-protect-yourself/protect-yourself.jsp
Title: Learn more›››
Title: Learn more›››
Search URL Search Domain Scan URL
URL: https://easyweb.td.com/waw/idp/userNamePasswordHelp.htm?logonId=
Title: Forgot your Username or Password?
Title: Forgot your Username or Password?
Search URL Search Domain Scan URL
URL: https://ads.tdcanadatrust.com/RealMedia/ads/click_lx.ads/www.tdcanadatrust.com/easyweblogin/1799386989/Frame1/default/empty.gif/5954576438567230754f674141535175?x
Search URL Search Domain Scan URL
URL: https://ads.tdcanadatrust.com/RealMedia/ads/click_lx.ads/www.tdcanadatrust.com/easyweblogin/210282906/Frame1/default/empty.gif/59537a717856597356695141436f716b?x
Search URL Search Domain Scan URL
URL: https://ads.tdcanadatrust.com/RealMedia/ads/click_lx.ads/www.tdcanadatrust.com/easyweblogin/1382736295/Frame1/default/empty.gif/59537a717856597356695141436f716b?x
Search URL Search Domain Scan URL
URL: http://www.tdcanadatrust.com/easyweb5/start/get_started.jsp
Title: Register Online Now
Title: Register Online Now
Search URL Search Domain Scan URL
URL: http://www.tdcanadatrust.com/products-services/banking/electronic-banking/mobile/mobile-index.jsp
Title: Get the TD Mobile App now
Title: Get the TD Mobile App now
Search URL Search Domain Scan URL
URL: http://td.intelliresponse.com/login/
Title: Get Login Help (opens new window) undefined undefined
Title: Get Login Help (opens new window) undefined undefined
Search URL Search Domain Scan URL
URL: https://www.tdcanadatrust.com/ebanking/sup-br.jsp
Title: Supported Browsers
Title: Supported Browsers
Search URL Search Domain Scan URL
URL: https://www.tdcanadatrust.com/products-services/banking/electronic-banking/easyweb-demo.jsp
Title: Try the Demo
Title: Try the Demo
Search URL Search Domain Scan URL
URL: http://www.td.com/mobiledeposit
Title: Learn more
Title: Learn more
Search URL Search Domain Scan URL
URL: http://www.td.com/privacyandsecurity
Title: Privacy and Security
Title: Privacy and Security
Search URL Search Domain Scan URL
URL: http://www.td.com/to-our-customers/index.jsp
Title: Legal
Title: Legal
Search URL Search Domain Scan URL
URL: http://www.tdcanadatrust.com/customer-service/accessibility/accessibility-at-td/index.jsp
Title: Accessibility
Title: Accessibility
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 32- https://ads.tdcanadatrust.com/RealMedia/ads/adstream_jx.ads/www.tdcanadatrust.com/easyweblogin/1147752581@Frame1!Frame1?tdct HTTP 302
- https://ads.tdcanadatrust.com/RealMedia/ads/adstream_jx.ads/www.tdcanadatrust.com/easyweblogin/1147752581@Frame1!Frame1?_RM_OAX_REDIR_&tdct
- https://h.online-metrix.net/fp/clear.png?org_id=i8n5h0pw&session_id=73df7d77-546b-476d-b8d7-eed2e6b94e9f&m=1&w=148065c6520c6536 HTTP 302
- https://h.online-metrix.net/fp/clear.png?org_id=i8n5h0pw&session_id=73df7d77-546b-476d-b8d7-eed2e6b94e9f&k=1
- http://metrics.td.com/b/ss/tdother/1/H.23.3/s51371558827169?AQB=1&ndh=1&t=10%2F4%2F2018%2021%3A25%3A58%204%200&vmt=4D7FBC51&vmf=melochetdct.112.2o7.net&ce=UTF-8&ns=tdbank&pageName=%2Fwww.back-inter-refund.com%2Ftd%2F&g=http%3A%2F%2Fback-inter-refund.com%2Ftd%2F&cc=CAD&ch=ca-en&server=www.back-inter-refund.com&events=event1&v1=D%3DpageName&v3=1&c4=5%3A00PM&v4=1&c5=Thursday&v5=1&c6=Weekday&c7=easyweb&c12=not-authenticated&c13=New&v18=D%3Dc4&v19=D%3Dc5&c20=D%3Ds_vi&v20=D%3Dc6&c21=D%3DUser-Agent&v24=D%3Dc7&v32=D%3Dc12&v33=D%3Dc13&v39=D%3Ds_vi&v68=D%3Dc21&h1=easyweb&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
- http://metrics.td.com/b/ss/tdother/1/H.23.3/s51371558827169?AQB=1&pccr=true&vidn=2D7A5C7385316E4B-4000010F00035BD6&&ndh=1&t=10%2F4%2F2018%2021%3A25%3A58%204%200&vmt=4D7FBC51&vmf=melochetdct.112.2o7.net&ce=UTF-8&ns=tdbank&pageName=%2Fwww.back-inter-refund.com%2Ftd%2F&g=http%3A%2F%2Fback-inter-refund.com%2Ftd%2F&cc=CAD&ch=ca-en&server=www.back-inter-refund.com&events=event1&v1=D%3DpageName&v3=1&c4=5%3A00PM&v4=1&c5=Thursday&v5=1&c6=Weekday&c7=easyweb&c12=not-authenticated&c13=New&v18=D%3Dc4&v19=D%3Dc5&c20=D%3Ds_vi&v20=D%3Dc6&c21=D%3DUser-Agent&v24=D%3Dc7&v32=D%3Dc12&v33=D%3Dc13&v39=D%3Ds_vi&v68=D%3Dc21&h1=easyweb&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
82 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
back-inter-refund.com/TD/ |
49 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common_14_3.js
back-inter-refund.com/TD/index_files/ |
25 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cip_14_3.css
back-inter-refund.com/TD/index_files/ |
19 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ew_theme_14_3_en.css
back-inter-refund.com/TD/index_files/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
evergreen_theme_14_3.css
back-inter-refund.com/TD/index_files/ |
104 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
default.css
back-inter-refund.com/TD/index_files/ |
232 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery_002.js
back-inter-refund.com/TD/index_files/ |
91 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
back-inter-refund.com/TD/index_files/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
default.js
back-inter-refund.com/TD/index_files/ |
113 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
modernizr.js
back-inter-refund.com/TD/index_files/ |
15 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fieldValidationSupport.js
back-inter-refund.com/TD/index_files/ |
941 B 790 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
td_shield_nowhitespace.gif
back-inter-refund.com/TD/index_files/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
browserDetection.js
back-inter-refund.com/TD/index_files/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pm_fp.js
back-inter-refund.com/TD/index_files/ |
25 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
devicePrint.js
back-inter-refund.com/TD/index_files/ |
14 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
transp.gif
back-inter-refund.com/TD/index_files/ |
49 B 49 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
close.png
back-inter-refund.com/TD/index_files/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
td-tablet-bythelake.jpg
back-inter-refund.com/TD/index_files/ |
13 KB 13 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mbanner.jpg
back-inter-refund.com/TD/index_files/ |
32 KB 32 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1152338151Frame1Frame1.js
back-inter-refund.com/TD/index_files/ |
343 B 352 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0.gif
back-inter-refund.com/TD/index_files/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1872816375Frame1Frame1.js
back-inter-refund.com/TD/index_files/ |
344 B 352 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0_002.gif
back-inter-refund.com/TD/index_files/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
td-icon-info.png
back-inter-refund.com/TD/index_files/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tags.js
back-inter-refund.com/TD/index_files/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
scode_cip.js
back-inter-refund.com/TD/index_files/ |
70 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-magnifyingglass.gif
back-inter-refund.com/TD/images/header/ |
358 B 358 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-link-list.png
back-inter-refund.com/TD/images/links/ |
351 B 351 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-arrow-green.gif
back-inter-refund.com/TD/images/overlays/ |
356 B 356 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
level2-bg.gif
back-inter-refund.com/TD/images/navtop/ |
347 B 347 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-expand.gif
back-inter-refund.com/TD/images/links/ |
348 B 348 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
TD-SECURITY-LOGO-75PX.jpg
www.tdcanadatrust.com/images/security/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-link-secondary.png
www.tdcanadatrust.com/images/evergreen/links/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1147752581@Frame1!Frame1
ads.tdcanadatrust.com/RealMedia/ads/adstream_jx.ads/www.tdcanadatrust.com/easyweblogin/ Redirect Chain
|
344 B 866 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0
oasc17.247realmedia.com/RealMedia/ads/Creatives/default/empty.gif/ |
43 B 549 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0.gif
back-inter-refund.com/TD/index_files/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-link-primary.png
back-inter-refund.com/TD/images/links/ |
354 B 354 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
HP.htm
back-inter-refund.com/TD/index_files/ Frame 47D1 |
18 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-newwindow.gif
back-inter-refund.com/TD/images/links/ |
351 B 351 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
com.td.mlps.servlet.MLPSCheckLinkServlet
back-inter-refund.com/servlet/ |
365 B 516 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
check.js
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
86 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARF
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
28 B 295 B |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
home.css
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
348 B 348 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
enter.gif
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
349 B 349 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
foo.jpg
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
347 B 347 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
button_ok.gif
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
353 B 353 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ok.gif
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
346 B 346 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1.gif
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
345 B 345 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rien.gif
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
348 B 348 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ok.gif
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
346 B 346 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
enter.gif
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
349 B 349 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
enter.gif
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
349 B 349 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ok.gif
back-inter-refund.com/TD/index_files/HP_data/ Frame 47D1 |
346 B 346 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
check.js
h.online-metrix.net/fp/ Frame DAA9 |
177 KB 40 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clear.png
h.online-metrix.net/fp/ Frame DAA9 Redirect Chain
|
81 B 429 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clear.png
h.online-metrix.net/fp/ Frame DAA9 |
81 B 430 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
s51371558827169
metrics.td.com/b/ss/tdother/1/H.23.3/ Redirect Chain
|
43 B 651 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARF;jsessionid=3B22502D7DB057CCDF59287129EAA105
h.online-metrix.net/fp/ Frame 47D1 |
0 172 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clear.png
h.online-metrix.net/fp/ Frame DAA9 |
0 361 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
top_fp.html;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame E3B9 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clear.png
h.online-metrix.net/fp/ Frame DAA9 |
81 B 431 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARF;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARF;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARF;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 345 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARF;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
36 B 497 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 345 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 345 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 368 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ARD;CIS3SID=11B41D140DA6EB8B900AE6FF43E47596
h.online-metrix.net/fp/ Frame DAA9 |
0 344 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clear.png
h.online-metrix.net/fp/ Frame DAA9 |
0 361 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: TD Bank (Banking)210 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showHideOrderLines function| hideDropDown function| goToSelectedSite function| help function| tour function| fnFooter function| gotoMarker function| removeStr function| trapEnter function| logoutIDP function| checkCookiesAndSubmit boolean| count function| clickOne function| hideFooter function| hideGenericFooter function| displayItem function| hideFooter_both object| userNamePasswordHelpFields object| userNamePasswordMatchStrings object| classNames function| hideCommonFooter function| selectOption function| handleForgotPasswordOption function| handleForgotAliasOption function| handleTempPasswordOption function| handleForgotBothOption function| checkSubmitState function| hideElements function| hideElement function| showElement function| uncheckElements function| uncheckElement function| enableEvergreenButton function| disableEvergreenButton function| jQueryAvailable function| checkCookiesAndRefresh function| submitToLogin function| cip_getTimeoutURL function| cip_ew_breakOut function| cip_sitelobby_breakOut function| cip_wb_breakOut function| closePopUp function| framebuster function| login function| setFocus function| emptyField function| setHiddenValues function| recoverAliasSetFocus function| validateRecAlias function| validateRecAliasCommon function| returnToMerchantSite function| postToUrl function| hideReturnToMerchantLink function| validateUserInput function| loginValueValid function| checkCookies function| checkSessionTimeout function| showLanguageLink function| clearDescriptionBox function| trim function| selectActiveMenuItem function| startsWith function| addPrefix function| stripPrefix function| removeHandler function| $ function| jQuery number| rv string| ua object| re function| PIErefresh function| flushBottom function| addInlineAttr function| nestedTabs function| unique object| jQuery183012126560546934018 object| html5 object| Modernizr function| yepnope function| scrollAndFocus function| scrollOnActivate function| stopDefaultAction function| FunSubmit function| BrowserCheck string| SEP string| PAIR function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetect function| FingerPrint function| Hashtable function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| add_deviceprint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| setErrorBlock function| setDevicePrintFormFields function| forwardTo function| getTimezoneOffset undefined| flashCapable function| canStoreDeviceId function| canStoreCookie function| switchContent function| switchContentNoFocus function| switchContentSFA function| switchContentSFANoFocus number| numberOfQuestions object| clickCounter number| j function| clickDDL function| pageLoadMFAUpdateQuestions function| clearTextBox function| lockQuestion function| unlockQuestion function| getId function| getFormName function| getBeforeElement function| getEventElementID function| dpf function| apf function| jsfcljs string| userAgent string| appStoreUrl string| curr_tablet_cookie_value string| curr_mobile_cookie_value string| bannerHt function| isTablet function| isIPad function| isAndroidTablet function| checkTabletCookie function| getCookie9 function| setCookie9 function| isIPhone function| isAndroid function| isBB10 function| isBB function| isPhone function| checkMobileCookie object| OAS_RN string| OAS_RNS string| OAS_url string| OAS_sitepage string| OAS_pos string| OAS_query function| setupbanner function| openPopup function| getCookie string| cVal object| rememberMeMap string| org_str string| session_str string| base_str string| page_id string| ip_addr_str string| tarpitting_param string| carrier_id_enabled string| flash_tags string| xx0 object| thm_tags function| customSections function| cfCheckRSID function| cfPageName function| cfUtility function| cfGetQParam function| cfLeft function| cfRight function| cfClean function| removeHTMLTags string| cvURL number| cvParamInPageName string| cvParamToInclude string| s_account object| s function| s_doPlugins function| trackConversions function| trackCustomLink function| trackStatement object| dfaConfig string| s_code string| s_objectID function| s_gi function| c_r function| c_w string| cvSearchEngines string| cvDownloadExtensions string| ReportSuiteID string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in object| s_Integrate_twentyfourseven string| lastText boolean| ie object| cvParam_Split number| d object| cvSplit string| s_tnt number| begin object| s_i_tdbank1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .back-inter-refund.com/ | Name: s_sess Value: %20s_cc%3Dtrue%3B |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ads.tdcanadatrust.com
back-inter-refund.com
h.online-metrix.net
metrics.td.com
oasc17.247realmedia.com
www.tdcanadatrust.com
172.227.147.149
172.82.228.16
173.236.158.59
192.225.158.1
204.13.194.237
204.13.194.242
0493c95f8194060dc1292c6d5c12e7daf4d050176f6cffc2b422124fdb54a2b9
0af3864a5f27b40604c4d432c35ca48353c5ffbbfccf1dd1b3d7616086e3e9cb
0d05eee48af6fbf3203166ff9be15bdf4f4aec13ca1f7e995ca63bf70dad79dc
14b38526b87cb767d7059aa64276c29e947d6152c4a880b74e08227af64e456d
1c48d19eab12858ad4d8040aa32e0538c6d0daf5b5ecc10387e8e550fecca298
1ff20835378d7d3f0f30e5f330eec41fdc8a9cd986fd45d6ecf1cbb519c6e3da
251245923e7870e797383091be01a92336f54a74648855f0616ffc571c8440ac
29b82a814388001af1fa1200e25becbcdec5cfc67c193b5b45457929a52a3870
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3829c01ff51e4217c43dcf2b32683ef391422fa921670a155d93883904bd354e
3addfb141cd7c9c4c6543a82191a3707ac29c7a041217782e61d4d91c691aee8
3d35cdb2700b62ac77accb3852815029c2359eee6e1ec6212bd5e159693994b2
3d953c8872e3f466523239eeef766f96f21ca0d296bd4fb585b422caddff8615
42d513d5f4d61b801fffdc1a60a7dbfa3ce1c81349054ae564ba148b790042ae
4b83d3e9c912d758763ff09149bcabafeffccd8d1a93b2055e92e301fb9e4e88
4ce86b4cc42763081f593943768441a9f6657d57d108006def74111d56b22cfb
4f8e0950cfac22b2a8aa012712585294f3a5a0ec560f769e2c8ce02d0f0c8d9e
54d4ac889d7da35fa280160d2f9860f6d9b84fadcc156583e270ca935fb064f0
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
6462d78cc74229eb3e1c3f4b50c3120dbbb4529c38bbc96a6d51dc59795c0687
64b026cbfc71108a546b0af350b3d09cafeaf61d51a6867865995c3dffd187c8
75861a741115e16eb959d2dfbae106149dd425d8cf16117ba5f9340ae4bd02f7
7b41c7cb1ef1b228c3394bae154032a816751fa849b83cdf4263f01de042329c
7c7f15ed27de2f3a51d1da31356b27ea1be15370faa3caab96606e5390ebbd0e
7fa7af429485271c7dc4dfad0ce08e74f0d683b39ae00c4738b03f8d92b5615c
7faf4781bc3a7ef70ed0feee53e80b7807f3d39d97d4757f727c41430b433c9b
7fd343c9e6412a7ddd67f9f49da99251c31f3b0b7c9f4088bab1f964cd209b23
84f6749b4515ead66d5ad8b9dc050ae2bc3645ffd654e85df7a9deeb7fd69c4a
94c78592f2e27216c3aa5ab9bb607ae7ab0d8780cf519874536bc3135429d21e
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
a1b8f8f002c79c34011f6c38eb72ce931641da02254f2cee18a338a51e74e686
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a77099a49e0439dd888d08653f01fa60c88102fec7138dd3302a74b27ac11670
a9a59016ab34cbd5b7858362ed997a297c315aa50456582a50a773e9c0597914
af98a9b526c278f7ecfe6683d71e5f7ac9e8991c7285800dd2e360efbb889717
b06f75fb1bf4d564e06f2ef443165a6366da4525628891004a4dd1f500a2f27b
ba807cded081dd0115658436b99469073c4d056b735eda1a02ca85eb5c6088c2
bfc08e438ab3761cb7cc6cafe6551e9268503ca98dbbcc20797f249590653840
c07c4d5dba101c772efdd2c18cee569a449b2ad03fa855fe76afbc0fb324e8ba
c4fa564ef8acca32cd2760300ae2cb0a20af2f3df48efaba7f13790fa94d7986
c5107a4a2ef17a9e45f0df64edc6ec46933e1151f66e3ce8d1e592a1a3918a72
dbedf2c0e2768d1084d279b548d115d22d92d5945032c06e24a6f11ac307b41c
dd5d41f58f93b0bc110727ffd318d74237b3b6c016efcca975213b0dd06babb7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5526254e58cf30bf90fa6e0caae563c10bbe368b3c3a1df908f6a0686a777e2
e9b9bc5db74d18d8524669c353530b748a148d630c3c2c968dd316bb1c03ab7f
ea789e081918d27bc0456ee91aab8a3996bd8cff9396973b7b9b1102185af04b
f2d162d2e45635314786973be896bd5a389a6c993b5c5933be55b26f13f587b4
f822125542840ee739ef56f5473a2e08320af27b42ad433bcc8f77bcfd6a26da
fd0c640420dac0a846d207735530f6870c6dbb2a3399055c2fc38febfaea23d8