urlscan.io logo urlscan.io
SecurityTrails logo

ceama.in Open in urlscan Pro
162.241.85.90  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ceama.in/a/afcu/auth/login-email.php
Effective URL: https://ceama.in/a/afcu/login.php
Submission: On June 21 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 16 IPs in 5 countries across 15 domains to perform 25 HTTP transactions. The main IP is 162.241.85.90, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is ceama.in.
TLS certificate: Issued by R3 on June 6th 2023. Valid for: 3 months.
This is the only time ceama.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: America First Credit Union (Banking)

Domain & IP information

IP Address AS Autonomous System
2 11 162.241.85.90 46606 (UNIFIEDLA...)
2 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
1 3 52.210.27.198 16509 (AMAZON-02)
1 52.18.63.80 16509 (AMAZON-02)
1 34.240.119.0 16509 (AMAZON-02)
1 63.140.62.135 16509 (AMAZON-02)
1 1 34.250.128.234 16509 (AMAZON-02)
8 8 151.101.130.49 54113 (FASTLY)
1 2 142.250.181.226 15169 (GOOGLE)
1 69.173.144.138 26667 (RUBICONPR...)
1 2 185.80.39.216 27381 (CASALE-MEDIA)
1 2 185.83.142.19 29990 (ASN-APPNEX)
1 34.98.64.218 396982 (GOOGLE-CL...)
1 198.47.127.205 3257 (GTT-BACKB...)
1 2 185.94.180.125 35220 (SPOTX-AMS)
1 2a03:2880:f17... 32934 (FACEBOOK)
25 16
11    162.241.85.90 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-85-90.unifiedlayer.com
ceama.in
2    2a02:26f0:480:99e::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
assets.adobedtm.com
1    2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
3    52.210.27.198 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-27-198.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    52.18.63.80 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-63-80.eu-west-1.compute.amazonaws.com
canarytokens.com
1    34.240.119.0 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-240-119-0.eu-west-1.compute.amazonaws.com
americafirstcreditunion.demdex.net
1    63.140.62.135 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-135.data.adobedc.net
sstats.americafirst.com
1    34.250.128.234 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-128-234.eu-west-1.compute.amazonaws.com
cm.everesttech.net
8    151.101.130.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
2    142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net
cm.g.doubleclick.net
1    69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
2    185.80.39.216 (Canada)

ASN27381 (CASALE-MEDIA, CA)
dsum-sec.casalemedia.com
2    185.83.142.19 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
ib.adnxs.com
1    34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com
us-u.openx.net
1    198.47.127.205 (United States)

ASN3257 (GTT-BACKBONE GTT, US)
image2.pubmatic.com
2    185.94.180.125 (Amsterdam, Netherlands)

ASN35220 (SPOTX-AMS, US)
sync.search.spotxchange.com
1    2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
Apex Domain
Subdomains		 Transfer
11 ceama.in
ceama.in
485 KB
9 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 1106
sync-tm.everesttech.net — Cisco Umbrella Rank: 778
2 KB
4 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 218
americafirstcreditunion.demdex.net — Cisco Umbrella Rank: 411639
7 KB
2 spotxchange.com
sync.search.spotxchange.com — Cisco Umbrella Rank: 785
1 KB
2 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 249
2 KB
2 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 621
1 KB
2 doubleclick.net
cm.g.doubleclick.net — Cisco Umbrella Rank: 244
814 B
2 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 398
83 KB
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 101
707 B
1 pubmatic.com
image2.pubmatic.com — Cisco Umbrella Rank: 1020
450 B
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 492
273 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 381
239 B
1 americafirst.com
sstats.americafirst.com — Cisco Umbrella Rank: 390325
456 B
1 canarytokens.com
canarytokens.com — Cisco Umbrella Rank: 679985
238 B
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 60
21 KB
25 15
Domain Requested by
11 ceama.in 2 redirects ceama.in
8 sync-tm.everesttech.net 8 redirects
3 dpm.demdex.net 1 redirects ceama.in
2 sync.search.spotxchange.com 1 redirects
2 ib.adnxs.com 1 redirects
2 dsum-sec.casalemedia.com 1 redirects
2 cm.g.doubleclick.net 1 redirects ceama.in
2 assets.adobedtm.com ceama.in
1 www.facebook.com
1 image2.pubmatic.com
1 us-u.openx.net
1 pixel.rubiconproject.com ceama.in
1 cm.everesttech.net 1 redirects
1 sstats.americafirst.com assets.adobedtm.com
1 americafirstcreditunion.demdex.net assets.adobedtm.com
1 canarytokens.com ceama.in
1 www.google-analytics.com ceama.in
25 17

This site contains links to these domains. Also see Links.

Domain
www.americafirst.com
portal.hud.gov
www.ncua.gov
Subject Issuer Validity Valid
ceama.in
R3		 2023-06-06 -
2023-09-04		 3 months crt.sh
assets.adobedtm.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-19 -
2023-08-19		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-05-29 -
2023-08-21		 3 months crt.sh
canarytokens.org
R3		 2023-05-21 -
2023-08-19		 3 months crt.sh
*.demdex.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-26 -
2023-10-27		 a year crt.sh
sstats.americafirst.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-21 -
2023-11-20		 a year crt.sh

This page contains 2 frames:

Primary Page: https://ceama.in/a/afcu/login.php
Frame ID: 01B96C01379E113940610C65A92F8F95
Requests: 20 HTTP requests in this frame

Frame: https://americafirstcreditunion.demdex.net/dest5.html?d_nsid=0
Frame ID: 324C751252787B526F1DF674121C6436
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

America First Credit Union

Page URL History Show full URLs

  1. https://ceama.in/a/afcu/auth/login-email.php HTTP 302
    https://ceama.in/a/afcu/index.php HTTP 302
    https://ceama.in/a/afcu/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Page Statistics

25
Requests

60 %
HTTPS

18 %
IPv6

15
Domains

17
Subdomains

16
IPs

5
Countries

600 kB
Transfer

1962 kB
Size

18
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ceama.in/a/afcu/auth/login-email.php HTTP 302
    https://ceama.in/a/afcu/index.php HTTP 302
    https://ceama.in/a/afcu/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11
  • https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A7873BC75245AD770A490D4D%40AdobeOrg&d_nsid=0&ts=1687322591421 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A7873BC75245AD770A490D4D%40AdobeOrg&d_nsid=0&ts=1687322591421
Request Chain 19
  • https://cm.everesttech.net/cm/dd?d_uuid=21112051262206316940318754579528650831 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZJJ-3wAAAKauFANe
Request Chain 20
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkpKLTN3QUFBS2F1RkFOZQ== HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push=&google_sc=&google_hm=WkpKLTN3QUFBS2F1RkFOZQ==&google_tc=
Request Chain 21
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZJJ-3wAAAKauFANe&expires=90
Request Chain 22
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJJ-3wAAAKauFANe HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJJ-3wAAAKauFANe&C=1
Request Chain 23
  • https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://ib.adnxs.com/setuid?entity=158&code=ZJJ-3wAAAKauFANe HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZJJ-3wAAAKauFANe
Request Chain 24
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJJ-3wAAAKauFANe
Request Chain 25
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZJJ-3wAAAKauFANe
Request Chain 26
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZJJ-3wAAAKauFANe&img=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZJJ-3wAAAKauFANe&img=1&__user_check__=1&sync_id=2113de96-0fee-11ee-a1c6-169e7f670206
Request Chain 27
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
  • https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZJJ-3wAAAKauFANe&t=2592000&o=0

25 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
ceama.in/a/afcu/
Redirect Chain
  • https://ceama.in/a/afcu/auth/login-email.php
  • https://ceama.in/a/afcu/index.php
  • https://ceama.in/a/afcu/login.php
55 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.90 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-90.unifiedlayer.com
Software
Apache /
Resource Hash
dc857a0d80b8193ee5986ffb757b6b31888194ba8f8821b33fa84ff9d7c68b69

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 21 Jun 2023 04:43:10 GMT
server
Apache
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 21 Jun 2023 04:43:10 GMT
location
login.php
server
Apache
ruxitagentjs_ICA27QVfghjqrux_10241220422021336.js
ceama.in/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://ceama.in/ruxitagentjs_ICA27QVfghjqrux_10241220422021336.js
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.90 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-90.unifiedlayer.com
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/a/afcu/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
content-encoding
gzip
last-modified
Wed, 10 Aug 2022 23:13:18 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
accept-ranges
bytes
content-length
355
launch-b0a09017373d.min.js
assets.adobedtm.com/1fd1994c08c8/ef4083d7ef24/ 		224 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/1fd1994c08c8/ef4083d7ef24/launch-b0a09017373d.min.js
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
cb03335620193146bd1fa491388ad5f7ee6fc86c54e0d854aac647f48e25da87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
content-encoding
gzip
last-modified
Mon, 01 Mar 2021 21:00:48 GMT
server
AkamaiNetStorage
etag
"c7075b0fa700c4806db450e8979452e6:1614632448.042729"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://ceama.in
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
71776
expires
Wed, 21 Jun 2023 05:43:11 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 21 Jun 2023 03:04:41 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
5910
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Wed, 21 Jun 2023 05:04:41 GMT
AppMeasurement.min.js
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 		33 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
content-encoding
gzip
last-modified
Wed, 12 Aug 2020 22:09:52 GMT
server
AkamaiNetStorage
etag
"f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://ceama.in
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
12184
expires
Wed, 21 Jun 2023 05:43:11 GMT
app.4d13320b.css
ceama.in/a/afcu/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ceama.in/a/afcu/css/app.4d13320b.css
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.90 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-90.unifiedlayer.com
Software
Apache /
Resource Hash
a506fa8faed85a2bd30d9b68e5641f761f68910d4a157109ee42f136326db0fe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/a/afcu/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
content-encoding
gzip
last-modified
Thu, 30 Jun 2022 22:55:26 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
1057
chunk-vendors.f18ab36e.css
ceama.in/a/afcu/css/ 		703 KB
110 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ceama.in/a/afcu/css/chunk-vendors.f18ab36e.css
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.90 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-90.unifiedlayer.com
Software
Apache /
Resource Hash
74030ae7c35e81b3527afff1c008a82891b29fec189acc3aaa4f60da4c6ef201

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/a/afcu/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
content-encoding
gzip
last-modified
Thu, 30 Jun 2022 22:55:26 GMT
server
Apache
accept-ranges
bytes
vary
Accept-Encoding
content-type
text/css
app.e9972c65.js
ceama.in/a/afcu/js/ 		263 KB
104 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ceama.in/a/afcu/js/app.e9972c65.js
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.90 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-90.unifiedlayer.com
Software
Apache /
Resource Hash
83b99dcb01b802cf0f3ef285a36604ce50e6dbc454fd4e87b966ccf8a3e692cf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/a/afcu/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
content-encoding
gzip
last-modified
Thu, 30 Jun 2022 22:55:28 GMT
server
Apache
accept-ranges
bytes
vary
Accept-Encoding
content-type
application/javascript
chunk-vendors.4c927ace.js
ceama.in/a/afcu/js/ 		601 KB
241 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ceama.in/a/afcu/js/chunk-vendors.4c927ace.js
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.90 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-90.unifiedlayer.com
Software
Apache /
Resource Hash
cf51abddf12109ed3a26fd189c84d907d697b0dac7f449bb0c5aff11afe70d26

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/a/afcu/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
content-encoding
gzip
last-modified
Thu, 30 Jun 2022 22:55:26 GMT
server
Apache
accept-ranges
bytes
vary
Accept-Encoding
content-type
application/javascript
logo-desktop-inverse.a3a99f3a.png
ceama.in/a/afcu/img/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ceama.in/a/afcu/img/logo-desktop-inverse.a3a99f3a.png
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.90 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-90.unifiedlayer.com
Software
Apache /
Resource Hash
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/a/afcu/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
last-modified
Thu, 30 Jun 2022 22:55:26 GMT
server
Apache
accept-ranges
bytes
content-length
8898
content-type
image/png
chunk-vendors.4c927ace.js
ceama.in/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://ceama.in/js/chunk-vendors.4c927ace.js
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.90 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-90.unifiedlayer.com
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/a/afcu/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
content-encoding
gzip
last-modified
Wed, 10 Aug 2022 23:13:18 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
accept-ranges
bytes
content-length
355
app.e9972c65.js
ceama.in/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://ceama.in/js/app.e9972c65.js
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.90 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-90.unifiedlayer.com
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/a/afcu/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 04:43:11 GMT
content-encoding
gzip
last-modified
Wed, 10 Aug 2022 23:13:18 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
accept-ranges
bytes
content-length
355
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A7873BC75245AD770A490D4D%40AdobeOrg&d_nsid=0&ts=1687322591421
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A7873BC75245AD770A490D4D%40AdobeOrg&d_nsid=0&ts=1687322591421
2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A7873BC75245AD770A490D4D%40AdobeOrg&d_nsid=0&ts=1687322591421
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
HTTP/1.1
Server
52.210.27.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-27-198.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
728bacffdef1cb4c4efb4b4bcc13521bffd8466cab7e663445d8a3628092f4a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v049-097705df2.edge-irl1.demdex.com 1 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
WwCjFsu3Q3Y=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://ceama.in
Content-Type
application/json;charset=utf-8
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
906
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v049-097705df2.edge-irl1.demdex.com 0 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
sKL31I4sRQE=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://ceama.in
Location
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=A7873BC75245AD770A490D4D%40AdobeOrg&d_nsid=0&ts=1687322591421
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
d2e56x9ul6ndlib7seb3wevxl.jpg
canarytokens.com/ 		43 B
238 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://canarytokens.com/d2e56x9ul6ndlib7seb3wevxl.jpg?l=https://ceama.in/a/afcu/login.php&r=
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.18.63.80 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-18-63-80.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Wed, 21 Jun 2023 04:43:12 GMT
Content-Encoding
gzip
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
image/gif
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
83b34f00b6612015c941c3865d2c047ae5ce567f13530491ac4ed773b13b1bd3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
986dae282bc4d35f7234bbf7c3eafd4b4bb990b89143be1f5c8a8aa4a04ee2b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
dest5.html
americafirstcreditunion.demdex.net/ Frame 324C 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://americafirstcreditunion.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/1fd1994c08c8/ef4083d7ef24/launch-b0a09017373d.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.240.119.0 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-240-119-0.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ceama.in/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
text/html;charset=UTF-8
DCS
dcs-prod-irl1-1-v049-0d2a39f11.edge-irl1.demdex.com 0 ms
Expires
Thu, 01 Jan 1970 00:00:00 UTC
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
PkWy+/iARgI=
content-encoding
gzip
date
Wed, 21 Jun 2023 04:43:11 GMT
last-modified
Wed, 14 Jun 2023 09:39:23 GMT
transfer-encoding
chunked
vary
accept-encoding
id
sstats.americafirst.com/ 		48 B
456 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sstats.americafirst.com/id?d_visid_ver=5.2.0&d_fieldgroup=A&mcorgid=A7873BC75245AD770A490D4D%40AdobeOrg&mid=17114131225403402261072095663564348099&ts=1687322591676
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/1fd1994c08c8/ef4083d7ef24/launch-b0a09017373d.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.140.62.135 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-63-140-62-135.data.adobedc.net
Software
jag /
Resource Hash
87e2e7b4773ee91bd716ed1d7f3e9b61add613007f4e5ea9c859f07e8b5ee586
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ceama.in/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Wed, 21 Jun 2023 04:43:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
server
jag
vary
Origin
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
https://ceama.in
p3p
CP="This is not a P3P policy"
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
content-length
48
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=ZJJ-3wAAAKauFANe
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=21112051262206316940318754579528650831
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZJJ-3wAAAKauFANe
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZJJ-3wAAAKauFANe
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
HTTP/1.1
Server
52.210.27.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-27-198.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ceama.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v049-0b92fe1f6.edge-irl1.demdex.com 2 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
XSqN/3ehRME=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZJJ-3wAAAKauFANe
Date
Wed, 21 Jun 2023 04:43:11 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
pixel
cm.g.doubleclick.net/ Frame 324C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkpKLTN3QUFBS2F1RkFOZQ==
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push=&google_sc=&google_hm=WkpKLTN3QUFBS2F1RkFOZQ==&google_tc=
170 B
243 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push=&google_sc=&google_hm=WkpKLTN3QUFBS2F1RkFOZQ==&google_tc=
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
H2
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://americafirstcreditunion.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Jun 2023 04:43:12 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 21 Jun 2023 04:43:12 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push=&google_sc=&google_hm=WkpKLTN3QUFBS2F1RkFOZQ==&google_tc=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 324C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
  • https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZJJ-3wAAAKauFANe&expires=90
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZJJ-3wAAAKauFANe&expires=90
Requested by
Host: ceama.in
URL: https://ceama.in/a/afcu/login.php
Protocol
HTTP/1.1
Server
69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://americafirstcreditunion.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
704c1e4d3fcc922a3031d436b584678b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by
cache-fra-eddf8230063-FRA
pragma
no-cache
date
Wed, 21 Jun 2023 04:43:12 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687322592.025749,VS0,VE0
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZJJ-3wAAAKauFANe&expires=90
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
rum
dsum-sec.casalemedia.com/ Frame 324C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJJ-3wAAAKauFANe
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJJ-3wAAAKauFANe&C=1
43 B
766 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJJ-3wAAAKauFANe&C=1
Protocol
HTTP/1.1
Server
185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://americafirstcreditunion.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 21 Jun 2023 04:43:12 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

Pragma
no-cache
Date
Wed, 21 Jun 2023 04:43:12 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
/rum?cm_dsp_id=88&external_user_id=ZJJ-3wAAAKauFANe&C=1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
0
Expires
0
bounce
ib.adnxs.com/ Frame 324C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
  • https://ib.adnxs.com/setuid?entity=158&code=ZJJ-3wAAAKauFANe
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZJJ-3wAAAKauFANe
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZJJ-3wAAAKauFANe
Protocol
HTTP/1.1
Server
185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://americafirstcreditunion.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 21 Jun 2023 04:43:12 GMT
AN-X-Request-Uuid
df4c6e45-f52d-4761-8bfb-0f2291a0edb4
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
image/gif
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
217.114.218.28; 217.114.218.28; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 21 Jun 2023 04:43:12 GMT
AN-X-Request-Uuid
256f9e70-245d-46ac-98ac-3966e2abc6d0
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZJJ-3wAAAKauFANe
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
217.114.218.28; 217.114.218.28; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 324C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJJ-3wAAAKauFANe
43 B
273 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJJ-3wAAAKauFANe
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://americafirstcreditunion.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 21 Jun 2023 04:43:12 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by
cache-fra-eddf8230063-FRA
pragma
no-cache
date
Wed, 21 Jun 2023 04:43:12 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687322592.344969,VS0,VE0
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJJ-3wAAAKauFANe
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
Pug
image2.pubmatic.com/AdServer/ Frame 324C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZJJ-3wAAAKauFANe
1 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZJJ-3wAAAKauFANe
Protocol
H2
Server
198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://americafirstcreditunion.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Wed, 21 Jun 2023 04:43:11 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

x-served-by
cache-fra-eddf8230063-FRA
pragma
no-cache
date
Wed, 21 Jun 2023 04:43:12 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687322592.436153,VS0,VE0
x-cache
HIT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZJJ-3wAAAKauFANe
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
partner
sync.search.spotxchange.com/ Frame 324C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZJJ-3wAAAKauFANe&img=1
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZJJ-3wAAAKauFANe&img=1&__user_check__=1&sync_id=2113de96-0fee-11ee-a1c6-169e7f670206
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZJJ-3wAAAKauFANe&img=1&__user_check__=1&sync_id=2113de96-0fee-11ee-a1c6-169e7f670206
Protocol
HTTP/1.1
Server
185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://americafirstcreditunion.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Wed, 21 Jun 2023 04:43:12 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
96
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Wed, 21 Jun 2023 04:43:12 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Location
/partner?adv_id=6409&uid=ZJJ-3wAAAKauFANe&img=1&__user_check__=1&sync_id=2113de96-0fee-11ee-a1c6-169e7f670206
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
38
Connection
keep-alive
Content-Length
0
b.php
www.facebook.com/fr/ Frame 324C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
  • https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZJJ-3wAAAKauFANe&t=2592000&o=0
43 B
707 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZJJ-3wAAAKauFANe&t=2592000&o=0
Protocol
H2
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://americafirstcreditunion.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 21:43:12 PDT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; preload
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
pragma
public
x-fb-debug
slUtnrKJMX5l9hTH8SIsnacBlLnPuVsKGHNEghCIDkWoVhlAZI1X7iZXRFP2EgaIISGX5STsoz+0UN9rEzpxKA==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
report-to
{"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type
image/gif
origin-agent-cluster
?0
cache-control
public, max-age=0
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Tue, 20 Jun 2023 21:43:12 PDT

Redirect headers

x-served-by
cache-fra-eddf8230063-FRA
pragma
no-cache
date
Wed, 21 Jun 2023 04:43:12 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687322593.637174,VS0,VE0
x-cache
HIT
location
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZJJ-3wAAAKauFANe&t=2592000&o=0
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: America First Credit Union (Banking)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend object| CAML object| _satellite boolean| __satelliteLoaded string| GoogleAnalyticsObject function| ga object| adobe function| Visitor object| s_c_il number| s_c_in function| mboxCreate function| mboxDefine function| mboxUpdate string| r object| m string| u string| a function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| eventMapping object| transactionTypes function| doesObjectExist function| appendEvent function| isOfTransationType object| google_tag_data object| gaplugins object| gaGlobal object| gaData

18 Cookies

Domain/Path Name / Value
ceama.in/ Name: PHPSESSID
Value: 8c9ccaa207635796249c4363b66c74af
.ceama.in/ Name: _ga
Value: GA1.2.658706609.1687322592
.ceama.in/ Name: _gid
Value: GA1.2.13889952.1687322592
.demdex.net/ Name: demdex
Value: 21112051262206316940318754579528650831
.ceama.in/ Name: AMCVS_A7873BC75245AD770A490D4D%40AdobeOrg
Value: 1
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZJJ-3wAAAKauFANe
.dpm.demdex.net/ Name: dpm
Value: 21112051262206316940318754579528650831
.ceama.in/ Name: AMCV_A7873BC75245AD770A490D4D%40AdobeOrg
Value: -1124106680%7CMCIDTS%7C19530%7CMCMID%7C17114131225403402261072095663564348099%7CMCAAMLH-1687927391%7C6%7CMCAAMB-1687927391%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1687329792s%7CNONE%7CMCSYNCSOP%7C411-19537%7CMCAID%7CNONE%7CvVersion%7C5.2.0
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.casalemedia.com/ Name: CMID
Value: ZJJ-4FOgRVZTfvnwdUSsTwAA
.casalemedia.com/ Name: CMPS
Value: 3261
.casalemedia.com/ Name: CMPRO
Value: 3261
.adnxs.com/ Name: uuid2
Value: 8123251270713439616
.adnxs.com/ Name: anj
Value: dTM7k!M4.FErk#WF']wIg2E?]x8bE.!]tbPl1MwL(!R7qUY%j'UegBAYWJX1DbBnqCePstx!S2?<QG=%9sk?bIRwi:w9Ld1t)T9D17Mco/y@Yw#u#Xk*vFZL
.pubmatic.com/ Name: KRTBCOOKIE_218
Value: 4056-ZJJ-3wAAAKauFANe&KRTB&22978-ZJJ-3wAAAKauFANe&KRTB&23194-ZJJ-3wAAAKauFANe&KRTB&23209-ZJJ-3wAAAKauFANe
.pubmatic.com/ Name: PugT
Value: 1687322591
.demdex.net/ Name: dextp
Value: 144230-1-1687322591920|144231-1-1687322592021|144232-1-1687322592128|144233-1-1687322592230|144234-1-1687322592331|144235-1-1687322592431|144236-1-1687322592532|144237-1-1687322592633
.spotxchange.com/ Name: audience
Value: 2113de43-0fee-11ee-a1c6-169e7f670206

6 Console Messages

Source Level URL
Text
network error URL: https://ceama.in/ruxitagentjs_ICA27QVfghjqrux_10241220422021336.js
Message:
Failed to load resource: the server responded with a status of 404 ()
security warning URL: https://ceama.in/a/afcu/login.php
Message:
Mixed Content: The page at 'https://ceama.in/a/afcu/login.php' was loaded over HTTPS, but requested an insecure element 'http://canarytokens.com/d2e56x9ul6ndlib7seb3wevxl.jpg?l=https://ceama.in/a/afcu/login.php&r='. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network error URL: https://ceama.in/js/chunk-vendors.4c927ace.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://ceama.in/js/app.e9972c65.js
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript warning URL: https://ceama.in/a/afcu/login.php
Message:
The resource https://ceama.in/a/afcu/js/app.e9972c65.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://ceama.in/a/afcu/login.php
Message:
The resource https://ceama.in/a/afcu/js/chunk-vendors.4c927ace.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

americafirstcreditunion.demdex.net
assets.adobedtm.com
canarytokens.com
ceama.in
cm.everesttech.net
cm.g.doubleclick.net
dpm.demdex.net
dsum-sec.casalemedia.com
ib.adnxs.com
image2.pubmatic.com
pixel.rubiconproject.com
sstats.americafirst.com
sync-tm.everesttech.net
sync.search.spotxchange.com
us-u.openx.net
www.facebook.com
www.google-analytics.com
142.250.181.226
151.101.130.49
162.241.85.90
185.80.39.216
185.83.142.19
185.94.180.125
198.47.127.205
2a00:1450:4001:828::200e
2a02:26f0:480:99e::1e80
2a03:2880:f176:84:face:b00c:0:25de
34.240.119.0
34.250.128.234
34.98.64.218
52.18.63.80
52.210.27.198
63.140.62.135
69.173.144.138
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
728bacffdef1cb4c4efb4b4bcc13521bffd8466cab7e663445d8a3628092f4a0
74030ae7c35e81b3527afff1c008a82891b29fec189acc3aaa4f60da4c6ef201
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
83b34f00b6612015c941c3865d2c047ae5ce567f13530491ac4ed773b13b1bd3
83b99dcb01b802cf0f3ef285a36604ce50e6dbc454fd4e87b966ccf8a3e692cf
87e2e7b4773ee91bd716ed1d7f3e9b61add613007f4e5ea9c859f07e8b5ee586
986dae282bc4d35f7234bbf7c3eafd4b4bb990b89143be1f5c8a8aa4a04ee2b4
a506fa8faed85a2bd30d9b68e5641f761f68910d4a157109ee42f136326db0fe
a6690102b24638424202c679e3c3fafe83bdaa641e40dca06968bcad77f70821
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c9a0078a7b8e70e1437317247095c89510a6c40bdb3bb37a26318133e2c1ab54
cb03335620193146bd1fa491388ad5f7ee6fc86c54e0d854aac647f48e25da87
cf51abddf12109ed3a26fd189c84d907d697b0dac7f449bb0c5aff11afe70d26
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
dc857a0d80b8193ee5986ffb757b6b31888194ba8f8821b33fa84ff9d7c68b69
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df808b2ea829eac97e99d46d91fa6a005269d58a9dfd57ff40f7084e6f027f7b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629