![](/screenshots/9a68fc82-a519-4d04-b4c4-b66d33eb779c.png)
mail.113-30-189-4.cprapid.com
Open in
urlscan Pro
113.30.189.4
Malicious Activity!
Public Scan
Submission: On July 04 via automatic, source openphish — Scanned from NL
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 3rd 2022. Valid for: 3 months.
This is the only time mail.113-30-189-4.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citibank (Banking)Domain & IP information
ASN41436 (CLOUDWEBMANAGE-EU, US)
mail.113-30-189-4.cprapid.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-74-200.eu-west-1.compute.amazonaws.com
dpm.demdex.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
nexus.ensighten.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-251-27-103.eu-west-1.compute.amazonaws.com
citi.demdex.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-176-210.eu-west-3.compute.amazonaws.com
metrics1.citi.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-107-150.eu-west-1.compute.amazonaws.com
cm.everesttech.net |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN16625 (AKAMAI-AS, US)
PTR: a96-16-135-39.deploy.static.akamaitechnologies.com
tags.bkrtx.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-242-9.eu-west-1.compute.amazonaws.com
citicorpcreditservic.tt.omtrdc.net |
ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-116.fra60.r.cloudfront.net
cdn.pbbl.co |
ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
sr.rlcdn.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com
stags.bluekai.com |
ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net
www.googleadservices.com |
ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com
udc-neb.kampyle.com |
ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
cprapid.com
mail.113-30-189-4.cprapid.com |
2 MB |
12 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 89 |
501 KB |
9 |
ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 2618 |
94 KB |
8 |
google.de
www.google.de — Cisco Umbrella Rank: 5448 |
1 KB |
8 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 8 |
2 KB |
8 |
doubleclick.net
1 redirects
googleads.g.doubleclick.net — Cisco Umbrella Rank: 54 |
9 KB |
4 |
demdex.net
1 redirects
dpm.demdex.net — Cisco Umbrella Rank: 192 citi.demdex.net — Cisco Umbrella Rank: 38934 |
6 KB |
2 |
googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 126 |
30 KB |
2 |
medallia.com
resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 24017 |
89 KB |
1 |
kampyle.com
udc-neb.kampyle.com — Cisco Umbrella Rank: 2178 |
317 B |
1 |
bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 494 |
256 B |
1 |
rlcdn.com
sr.rlcdn.com — Cisco Umbrella Rank: 13239 |
98 B |
1 |
pbbl.co
cdn.pbbl.co — Cisco Umbrella Rank: 10094 |
|
1 |
rfihub.com
20766699p.rfihub.com — Cisco Umbrella Rank: 36637 |
685 B |
1 |
omtrdc.net
citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 27538 |
834 B |
1 |
bkrtx.com
tags.bkrtx.com — Cisco Umbrella Rank: 3370 |
16 KB |
1 |
rfihub.net
c1.rfihub.net — Cisco Umbrella Rank: 5238 |
6 KB |
1 |
everesttech.net
1 redirects
cm.everesttech.net — Cisco Umbrella Rank: 850 |
517 B |
1 |
citi.com
metrics1.citi.com — Cisco Umbrella Rank: 23204 |
521 B |
76 | 19 |
Domain | Requested by | |
---|---|---|
17 | mail.113-30-189-4.cprapid.com |
mail.113-30-189-4.cprapid.com
|
12 | www.googletagmanager.com |
mail.113-30-189-4.cprapid.com
www.googletagmanager.com |
9 | nexus.ensighten.com |
mail.113-30-189-4.cprapid.com
|
8 | www.google.de | |
8 | www.google.com | 1 redirects |
8 | googleads.g.doubleclick.net |
1 redirects
www.googleadservices.com
|
3 | dpm.demdex.net |
1 redirects
mail.113-30-189-4.cprapid.com
|
2 | www.googleadservices.com |
www.googletagmanager.com
|
2 | resources.digital-cloud-citi.medallia.com |
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com |
1 | udc-neb.kampyle.com | |
1 | stags.bluekai.com |
tags.bkrtx.com
|
1 | sr.rlcdn.com |
nexus.ensighten.com
|
1 | cdn.pbbl.co |
nexus.ensighten.com
|
1 | 20766699p.rfihub.com |
c1.rfihub.net
|
1 | citicorpcreditservic.tt.omtrdc.net |
mail.113-30-189-4.cprapid.com
|
1 | tags.bkrtx.com |
nexus.ensighten.com
|
1 | c1.rfihub.net |
nexus.ensighten.com
|
1 | cm.everesttech.net | 1 redirects |
1 | metrics1.citi.com |
mail.113-30-189-4.cprapid.com
|
1 | citi.demdex.net |
mail.113-30-189-4.cprapid.com
|
76 | 20 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
citisupportdesk.com cPanel, Inc. Certification Authority |
2022-07-03 - 2022-10-01 |
3 months | crt.sh |
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-09-14 - 2022-10-12 |
a year | crt.sh |
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1 |
2021-10-19 - 2022-11-19 |
a year | crt.sh |
metrics1.citi.com DigiCert SHA2 Extended Validation Server CA |
2020-07-02 - 2022-08-30 |
2 years | crt.sh |
*.rfihub.net Amazon |
2021-12-29 - 2023-01-27 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-06-06 - 2022-08-29 |
3 months | crt.sh |
*.bkrtx.com DigiCert SHA2 Secure Server CA |
2022-02-07 - 2023-02-06 |
a year | crt.sh |
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1 |
2021-10-11 - 2022-10-12 |
a year | crt.sh |
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA |
2022-05-24 - 2023-05-24 |
a year | crt.sh |
*.digital-cloud-citi.medallia.com SSL.com RSA SSL subCA |
2021-11-15 - 2022-10-20 |
a year | crt.sh |
*.pbbl.co Amazon |
2021-11-04 - 2022-12-02 |
a year | crt.sh |
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA |
2022-02-03 - 2023-02-25 |
a year | crt.sh |
odc-pixel-prod-01.oracle.com DigiCert SHA2 Secure Server CA |
2022-02-26 - 2023-03-01 |
a year | crt.sh |
www.googleadservices.com GTS CA 1C3 |
2022-06-06 - 2022-08-29 |
3 months | crt.sh |
*.kampyle.com SSL.com RSA SSL subCA |
2022-02-28 - 2023-03-31 |
a year | crt.sh |
*.googleadservices.com GTS CA 1C3 |
2022-06-06 - 2022-08-29 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2022-06-06 - 2022-08-29 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2022-06-06 - 2022-08-29 |
3 months | crt.sh |
www.google.de GTS CA 1C3 |
2022-06-06 - 2022-08-29 |
3 months | crt.sh |
This page contains 5 frames:
Primary Page:
https://mail.113-30-189-4.cprapid.com/login/ses/index
Frame ID: 0413D98CDFCEE9FFC82D3EA9DEFCB7BF
Requests: 72 HTTP requests in this frame
Frame:
https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 1ACDE2C3E80DB130CA29FE3D2AAC8D3A
Requests: 1 HTTP requests in this frame
Frame:
https://20766699p.rfihub.com/ca.html?ver=9&ra=1874&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fmail.113-30-189-4.cprapid.com%2Flogin%2Fses%2Findex&pf=&ra=255748984518134
Frame ID: 0F6C7A837D1CDE6F19893AD66AAE2B48
Requests: 1 HTTP requests in this frame
Frame:
https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 3E25786F968B6AD59F324D0DD009C216
Requests: 1 HTTP requests in this frame
Frame:
https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fmail.113-30-189-4.cprapid.com%2Flogin%2Fses%2Findex&phint=__bk_v%3D3.1.10&limit=10&r=92663075
Frame ID: 06F47E8150D639BBA27ADA360286987D
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/9a68fc82-a519-4d04-b4c4-b66d33eb779c.png)
Page Title
Sign On to Your Citi Account - CitibankDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/ensighten.png)
Detected patterns
- //nexus\.ensighten\.com/
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1656897367762 HTTP 302
- https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1656897367762
- https://cm.everesttech.net/cm/dd?d_uuid=75036076679622341822524517110238903607 HTTP 302
- https://dpm.demdex.net/ibs:dpid=411&dpuuid=YsI-WAAAAB9g7QOV
- https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1656897369215&cv=9&fst=1656897369215&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oa6t0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmail.113-30-189-4.cprapid.com%2Flogin%2Fses%2Findex&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1 HTTP 302
- https://www.google.com/pagead/1p-user-list/695231162/?random=1656897369215&cv=9&fst=1656896400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oa6t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmail.113-30-189-4.cprapid.com%2Flogin%2Fses%2Findex&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=1491135060&resp=GooglemKTybQhCsO HTTP 302
- https://www.google.de/pagead/1p-user-list/695231162/?random=1656897369215&cv=9&fst=1656896400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oa6t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmail.113-30-189-4.cprapid.com%2Flogin%2Fses%2Findex&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=1491135060&resp=GooglemKTybQhCsO&ipr=y
76 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index
mail.113-30-189-4.cprapid.com/login/ses/ |
371 KB 371 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Bootstrap.js
mail.113-30-189-4.cprapid.com/login/ses/js/ |
280 KB 280 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Light.woff
mail.113-30-189-4.cprapid.com/login/ses/css/ |
74 KB 74 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Bold.woff
mail.113-30-189-4.cprapid.com/login/ses/css/ |
70 KB 70 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Regular.woff
mail.113-30-189-4.cprapid.com/login/ses/css/ |
77 KB 77 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
mail.113-30-189-4.cprapid.com/login/ses/css/ |
1 MB 1 MB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
citipridelogo.jpg
mail.113-30-189-4.cprapid.com/login/ses/css/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
050-location@2x.svg
mail.113-30-189-4.cprapid.com/login/ses/css/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_globe_med-grey@2x.svg
mail.113-30-189-4.cprapid.com/login/ses/css/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
320_Citi-PLT@3x.png
mail.113-30-189-4.cprapid.com/login/ses/css/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1440_Citi-PLT@3x.png
mail.113-30-189-4.cprapid.com/login/ses/css/ |
27 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rd
dpm.demdex.net/id/ Redirect Chain
|
363 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e.gif
nexus.ensighten.com/error/ |
0 107 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serverComponent.php
nexus.ensighten.com/citi/na_prod/ |
1 KB 739 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fdf45a7c15c1cee06bb71e10dac4e26e.js
nexus.ensighten.com/citi/na_prod/code/ |
989 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
056fe804a45840fa1a41b33cc15114dc.js
nexus.ensighten.com/citi/na_prod/code/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
557566dc60916e3de69e006bef252459.js
nexus.ensighten.com/citi/na_prod/code/ |
2 KB 961 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dd2e4b625ebab8391ed3f4779bd70b02.js
nexus.ensighten.com/citi/na_prod/code/ |
158 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
51aba9f62787efbaa13e53a8d1ae3892.js
nexus.ensighten.com/citi/na_prod/code/ |
1 KB 847 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
506d0184fdb9cb628051e08d1e517b6e.js
nexus.ensighten.com/citi/na_prod/code/ |
175 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ea3d4340d0fcbc94d3792ab3c1606902.js
nexus.ensighten.com/citi/na_prod/code/ |
75 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest5.html
citi.demdex.net/ Frame 1ACD |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id
metrics1.citi.com/ |
48 B 521 B |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=411&dpuuid=YsI-WAAAAB9g7QOV
dpm.demdex.net/ Redirect Chain
|
42 B 942 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LSO_4959.jpg
mail.113-30-189-4.cprapid.com/login/ses/css/ |
171 KB 171 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Citi-Branding-Sprite.png
mail.113-30-189-4.cprapid.com/login/ses/img/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Appstore-Googleplay-JDPower-Sprite.png
mail.113-30-189-4.cprapid.com/login/ses/css/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
social-media_facebook@3x.png
mail.113-30-189-4.cprapid.com/login/ses/css/ |
445 B 752 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
social-media_twitter@3x.png
mail.113-30-189-4.cprapid.com/login/ses/css/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
social-media_youtube@3x.png
mail.113-30-189-4.cprapid.com/login/ses/css/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tc.min.js
c1.rfihub.net/js/ |
19 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
102 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bk-coretag.js
tags.bkrtx.com/js/ |
51 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
json
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ |
142 B 834 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ca.html
20766699p.rfihub.com/ Frame 0F6C |
118 B 685 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
102 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
102 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
102 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
embed.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1560.js
cdn.pbbl.co/r/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
110 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
425466.html
sr.rlcdn.com/ Frame 3E25 |
0 98 B |
Document
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
63068
stags.bluekai.com/site/ Frame 06F4 |
71 B 256 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conversion_async.js
www.googleadservices.com/pagead/ |
40 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
110 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
110 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
110 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
110 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
110 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
110 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
110 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
generic1654793721838.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ |
519 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ |
0 317 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
conversion_async.js
www.googleadservices.com/pagead/ |
40 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.google.de/pagead/1p-user-list/695231162/ Redirect Chain
|
42 B 64 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/830907969/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.de/pagead/1p-user-list/830907969/ |
42 B 548 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/959299794/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.de/pagead/1p-user-list/959299794/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/819500023/ |
42 B 548 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.de/pagead/1p-user-list/819500023/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/916451471/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.de/pagead/1p-user-list/916451471/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/960621875/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.de/pagead/1p-user-list/960621875/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/975701947/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.de/pagead/1p-user-list/975701947/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/644574043/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.de/pagead/1p-user-list/644574043/ |
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citibank (Banking)86 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| ensBootstraps object| Bootstrapper function| Visitor object| s_c_il number| s_c_in object| adobe_visitor function| targetPageParams object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate number| getOfferCount object| citiData function| _rfi object| dataLayer function| gtag function| bk_async object| val function| extend function| RocketfuelBCPInclude function| RocketfuelBCPClass function| RocketfuelUtils object| RocketfuelBCP object| tags object| BKTAG function| bk_addUserCtx function| bk_addPageCtx function| bk_addEmailHash function| bk_addPhoneHash function| bk_doJSTag function| bk_doJSTag2 function| bk_doCarsJSTag function| bk_doPartnerAltTag function| bk_doCallbackTag function| bk_doCallbackTagWithTimeOut boolean| bk_use_multiple_iframes boolean| bk_allow_multiple_calls object| google_tag_manager object| google_tag_data undefined| CCSID undefined| citiLocale boolean| citiNGA undefined| pageID object| _pp object| KAMPYLE_EMBED object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| KAMPYLE_GA object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK undefined| KAMPYLE_POLYFILLS object| KAMPYLE_INTEGRATION object| cooladata function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO23 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.cprapid.com/ | Name: check Value: true |
|
.demdex.net/ | Name: demdex Value: 75036076679622341822524517110238903607 |
|
.cprapid.com/ | Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1 |
|
mail.113-30-189-4.cprapid.com/ | Name: 7830 Value: error |
|
mail.113-30-189-4.cprapid.com/ | Name: 7018 Value: |
|
mail.113-30-189-4.cprapid.com/ | Name: 64072 Value: |
|
.citi.com/ | Name: s_ecid Value: MCMID%7C70260918623280488693074684031442699412 |
|
.everesttech.net/ | Name: everest_g_v2 Value: g_surferid~YsI-WAAAAB9g7QOV |
|
.cprapid.com/ | Name: _gcl_au Value: 1.1.674036481.1656897368 |
|
.dpm.demdex.net/ | Name: dpm Value: 75036076679622341822524517110238903607 |
|
.cprapid.com/ | Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C19178%7CMCMID%7C70260918623280488693074684031442699412%7CMCAAMLH-1657502167%7C6%7CMCAAMB-1657502167%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1656904567s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19185%7CvVersion%7C3.1.2 |
|
.rfihub.com/ | Name: ruds Value: H4sIAAAAAAAAAOMSNjU0MTG1sDA1MjCzNDI1NzI2MxDiM9TN8PY3yc43zvFKNzcBABFCiNAlAAAA |
|
.rfihub.com/ | Name: rud Value: H4sIAAAAAAAAAOMSNjU0MTG1sDA1MjCzNDI1NzI2MxDiM9TN8PY3yc43zvFKNzcBABFCiNAlAAAA |
|
.citicorpcreditservic.tt.omtrdc.net/ | Name: citicorpcreditservic!mboxSession Value: bb75c83c22104d888294009ae3d63f02 |
|
.citicorpcreditservic.tt.omtrdc.net/ | Name: citicorpcreditservic!mboxPC Value: bb75c83c22104d888294009ae3d63f02.37_0 |
|
.cprapid.com/ | Name: mbox Value: session#bb75c83c22104d888294009ae3d63f02#1656899229|PC#bb75c83c22104d888294009ae3d63f02.37_0#1720142169 |
|
.cprapid.com/ | Name: mboxEdgeCluster Value: 37 |
|
mail.113-30-189-4.cprapid.com/ | Name: mdLogger Value: false |
|
mail.113-30-189-4.cprapid.com/ | Name: kampyle_userid Value: 8458-d49d-d6a4-5bc9-7ea2-0e06-50aa-c659 |
|
mail.113-30-189-4.cprapid.com/ | Name: kampyleUserSession Value: 1656897369076 |
|
mail.113-30-189-4.cprapid.com/ | Name: kampyleUserSessionsCount Value: 1 |
|
mail.113-30-189-4.cprapid.com/ | Name: kampyleSessionPageCounter Value: 1 |
|
.doubleclick.net/ | Name: IDE Value: AHWqTUnopAfpW844cAzoiHKgvkor63x6svfrlsaJ0XC2lqUkYbI-m0BsYlZ0lmKu |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
20766699p.rfihub.com
c1.rfihub.net
cdn.pbbl.co
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
dpm.demdex.net
googleads.g.doubleclick.net
mail.113-30-189-4.cprapid.com
metrics1.citi.com
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
stags.bluekai.com
tags.bkrtx.com
udc-neb.kampyle.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
104.111.215.191
113.30.189.4
142.250.185.130
15.236.176.210
151.101.66.133
18.195.42.228
18.66.122.116
193.0.160.129
2600:9000:223c:2a00:1:76cf:fe80:93a1
2a00:1450:4001:80b::2008
2a00:1450:4001:812::2002
2a00:1450:4001:828::2003
2a00:1450:4001:82f::2004
3.251.27.103
34.253.74.200
35.190.60.146
35.241.45.82
52.31.107.150
52.49.242.9
96.16.135.39
00e67a6bb1601297c954a9c6438eb956f4ca87253683fb348d1bda64cee7d1ca
03cea432e12b5ed3d0ca90fe1e417d463e889564903016dd0405fb06de3bfb94
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
0a2ab6d1effcb4fff6e96e4da9c4a4cd68e8115be4346b63210cc638d561fd66
0be7acda01dbfd2f947403352d57561b22372110c92532f475626fcbd646a489
1065a68c032f19be67d494b350138c234561b7290e4726358a3a506e398b97f6
188df01a46b7ddc5b39b19929a3c18d033e93d574f763094e982b3934c04ee0d
2452fbe178408da63758e802d72d57db6e42c9e7ea4a518ba5a4b523f27f0352
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
46254eadc250fa82413fd5a6ebf16d1181e9e3ea1c88ecd02b7b801843dec913
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
52aeb0df53a7b903a768dd8bc04ef67bf7ac858225d1a0de64f3aa6496357101
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
5d117b56a9c28e9d29115b65f12183b30323ede7ce97f1b577fbedcb44c9a977
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
7845dfd2b8d9ac16be78cba853d5a6c900a4991d3e8ab442c2c53368825326b6
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7e3bc11a02a53213acf73335194eccc9637923f9c1cd04f489f0f90aff151f61
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
8b83c9b6e55a86832e4c41159ac6bd5f86fc2fc4fd8c1f7c7487210662e25662
9394b9642de3210980e6263618e9fa3ef1b26c5b02c5f4054d9a335232e4945c
94afd2ba91f4f021deadd1a13ec7be2b084fc564ecdd1e86dacec007906a3d9b
9f45255bb8c8a9a3d4e5a78e4f327af2985ba92cb1595550b6270b12b5a9fcbc
9fc3782419f592da91481b9b2f022afbf59eb7f704354ef23b4a30a7da695dcd
a16c8f4fbe4758e2f70fd63abf5b793f80776b30b0f241d380a5372b287770b7
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
adaaab88b497e06eef667057f70e856e2b23df6c629379601973f064af28ca1c
adee524d25764d9511c4c0c0edd492d1e1a32263a6dc29945b82a07dce904252
b02749977c0003ffd4ae7ce506830c87acf5796b584bf371952dfa20b7b79c93
b0ff4a483d50aa936aca3fd42bbeaf10d0ab3ea75399ef45254f0a7478fb5625
b505057873d23738d082052f5bcfc1f093264763301dabf682f4fa8dc54ccc33
b526e4d51312500d1f4846bb6e2428768bd4655535a7893bd4f3ce7c125d4a86
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bec566767b193d876b28d78060eafe555d850fbd049ea1593034f775953037e5
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c494f0cbdcb48b6c6c6fa9cb13253713026f1df8e92a2f46bacdaa99605fdf30
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
cb8c1c65d5660e0935979b2ca91809624e4d8d1c7871392ec1d1f0dc678c54f8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e81d41804ba08b6e2b4fdf43d8dbac0da1780b73406f5ce1b8b45f98573703a1
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ec9c06bd243ba2b20fa8a4a9c44d5b275797e899ae17c576fd4adc06c7c6f883
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
fc25829bce82c868525b486d0d71d32e1480605fe5bc1496a942b70175e45d82
fef70c128ff5fd7e9adf5d4c379cf15e773c5a6d57c13cac780521ad4844eb7e