nosy-elegant-helmet.glitch.me
Open in
urlscan Pro
52.2.103.240
Malicious Activity!
Public Scan
Effective URL: https://nosy-elegant-helmet.glitch.me/elementofgreatness.html?id=awjneal@eastman.com
Submission: On December 20 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Amazon on February 1st 2022. Valid for: a year.
This is the only time nosy-elegant-helmet.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net | |
adservice.google.de |
ASN15169 (GOOGLE, US)
tpc.googlesyndication.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-103-240.compute-1.amazonaws.com
nosy-elegant-helmet.glitch.me |
ASN20773 (GODADDY, DE)
PTR: 53.138.153.160.host.secureserver.net
loveyrmotor.com |
ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1176-20.members.linode.com
jsonip.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
appurl.io
1 redirects
appurl.io — Cisco Umbrella Rank: 565833 |
56 KB |
7 |
criteo.net
static.criteo.net — Cisco Umbrella Rank: 637 pix.eu.criteo.net Failed csm.eu.criteo.net Failed |
88 KB |
5 |
google.com
1 redirects
adservice.google.com — Cisco Umbrella Rank: 72 www.google.com — Cisco Umbrella Rank: 2 |
811 B |
5 |
doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 34 |
24 KB |
5 |
googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 101 tpc.googlesyndication.com — Cisco Umbrella Rank: 139 |
227 KB |
3 |
loveyrmotor.com
loveyrmotor.com |
55 KB |
3 |
google.de
adservice.google.de — Cisco Umbrella Rank: 8549 |
1 KB |
2 |
glitch.me
nosy-elegant-helmet.glitch.me |
71 KB |
2 |
criteo.com
rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 14173 ads.eu.criteo.com — Cisco Umbrella Rank: 7675 cat.fr.eu.criteo.com Failed |
49 KB |
2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 29 |
20 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 757 |
26 KB |
1 |
jsonip.com
jsonip.com — Cisco Umbrella Rank: 23252 |
402 B |
1 |
gstatic.com
t0.gstatic.com |
1 KB |
1 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 1214 |
1 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 211 |
|
1 |
googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 188 |
47 KB |
1 |
googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 830 |
694 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 686 |
24 KB |
64 | 18 |
Domain | Requested by | |
---|---|---|
8 | appurl.io |
1 redirects
appurl.io
|
7 | static.criteo.net |
ads.eu.criteo.com
|
5 | googleads.g.doubleclick.net |
pagead2.googlesyndication.com
appurl.io |
3 | loveyrmotor.com |
nosy-elegant-helmet.glitch.me
|
3 | adservice.google.com |
pagead2.googlesyndication.com
|
3 | adservice.google.de |
pagead2.googlesyndication.com
|
3 | pagead2.googlesyndication.com |
appurl.io
pagead2.googlesyndication.com www.googletagservices.com |
2 | nosy-elegant-helmet.glitch.me |
appurl.io
nosy-elegant-helmet.glitch.me |
2 | www.google.com |
1 redirects
googleads.g.doubleclick.net
|
2 | tpc.googlesyndication.com |
googleads.g.doubleclick.net
|
2 | www.google-analytics.com |
appurl.io
www.google-analytics.com |
2 | maxcdn.bootstrapcdn.com |
appurl.io
|
1 | jsonip.com |
nosy-elegant-helmet.glitch.me
|
1 | t0.gstatic.com |
nosy-elegant-helmet.glitch.me
|
1 | aadcdn.msftauth.net |
nosy-elegant-helmet.glitch.me
|
1 | cdnjs.cloudflare.com |
ads.eu.criteo.com
|
1 | www.googletagservices.com |
googleads.g.doubleclick.net
|
1 | ads.eu.criteo.com |
googleads.g.doubleclick.net
|
1 | rtb.fr.eu.criteo.com |
appurl.io
|
1 | partner.googleadservices.com |
pagead2.googlesyndication.com
|
1 | code.jquery.com |
appurl.io
|
0 | csm.eu.criteo.net Failed |
ads.eu.criteo.com
|
0 | pix.eu.criteo.net Failed |
ads.eu.criteo.com
|
0 | cat.fr.eu.criteo.com Failed |
ads.eu.criteo.com
|
64 | 24 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.microsoftonline.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-05-24 - 2023-05-24 |
a year | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
*.googleadservices.com GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
*.google.de GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-12-07 - 2023-03-12 |
3 months | crt.sh |
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-10-14 - 2023-01-13 |
3 months | crt.sh |
tpc.googlesyndication.com GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
glitch.com Amazon |
2022-02-01 - 2023-03-02 |
a year | crt.sh |
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-11-08 - 2023-02-04 |
3 months | crt.sh |
loveyrmotor.com Go Daddy Secure Certificate Authority - G2 |
2021-11-22 - 2022-12-24 |
a year | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2022-04-01 - 2023-04-01 |
a year | crt.sh |
jsonip.com R3 |
2022-11-12 - 2023-02-10 |
3 months | crt.sh |
This page contains 7 frames:
Primary Page:
https://nosy-elegant-helmet.glitch.me/elementofgreatness.html?id=awjneal@eastman.com
Frame ID: 5949D53666914296DF9DF2F58190997D
Requests: 27 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/html/r20221207/r20190131/zrt_lookup.html
Frame ID: 80EDA6A048EFEE1B7FCD58522C62F428
Requests: 1 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6503947100737582&output=html&h=280&slotname=1787055170&adk=646328967&adf=4134371643&pi=t.ma~as.1787055170&w=660&fwrn=4&fwrnh=100&lmt=1671524205&rafmt=1&format=660x280&url=https%3A%2F%2Fappurl.io%2Fw1MfGAJQ3q&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671542146233&bpp=4&bdt=300&idt=292&shv=r20221207&mjsv=m202212050101&ptt=9&saldr=aa&abxe=1&correlator=6303703085997&frm=20&pv=2&ga_vid=920341628.1671542146&ga_sid=1671542147&ga_hid=44323340&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=470&ady=603&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44777877%2C31071219%2C44779794%2C44780792&oid=2&pvsid=782870086741643&tmod=1595296551&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=zpCk0RsaNW&p=https%3A//appurl.io&dtd=309
Frame ID: 1B47D0527D7300F552054CFC4E70C3A6
Requests: 1 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6503947100737582&output=html&adk=1812271804&adf=3025194257&lmt=1671524205&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&plas=404x1080_l%7C404x1080_r&format=0x0&url=https%3A%2F%2Fappurl.io%2Fw1MfGAJQ3q&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1671542147239&bpp=3&bdt=1305&idt=3&shv=r20221207&mjsv=m202212050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd30cc0e7deb1cd35-226a6b4426da002e%3AT%3D1671542146%3ART%3D1671542146%3AS%3DALNI_MauYNZRDobGdEkrtPPHsCS2pFU5yA&gpic=UID%3D00000b957af7261e%3AT%3D1671542146%3ART%3D1671542146%3AS%3DALNI_MYU5iS6KImZN-emv8ZlBuf6b8IowQ&prev_fmts=660x280&nras=1&correlator=6303703085997&frm=20&pv=1&ga_vid=920341628.1671542146&ga_sid=1671542147&ga_hid=44323340&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44777877%2C31071219%2C44779794%2C44780792&oid=2&pvsid=782870086741643&tmod=1595296551&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=34
Frame ID: 102C129399F7C3608FD4286DA1CBDDE7
Requests: 1 HTTP requests in this frame
Frame:
https://appurl.io/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1671537600
Frame ID: D2E1D9BE294C4D1A692E8E7D2BC7497F
Requests: 3 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/html/r20221207/r20110914/zrt_lookup.html?fsb=1
Frame ID: 1D457837C62D7FA49FBA499FBFEB3270
Requests: 9 HTTP requests in this frame
Frame:
https://ads.eu.criteo.com/delivery/r/afr.php?z=Y6G1gwAFglgKwVLLAAM2ibB4wvzLqypyVSr4Kg&u=%7Cn0CM5DpaKuM83N%2FHz%2FdIQpyD8R3dUdaHBMBTf8ixHoY%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM9SPP5Y8DX0qWBxDFQrW50BYNHUXVKgdIWEsWwkO9UKNx5KDVOQchrLa4XIyRG88FQIWQiSWdkqZdvK5YQgche6qxihYwbEC2oQrHmtMyf9zwz-PTmwfYopv92949_AxPf5EHterC0XkSWuWxJllxju-lGNNE_botgov6jX25IdBd6yMObGPrHsFM1WEgIo-dtwUp3jKA86HJDDJ-ROUW1acMbplVCGwKBZlsoPJVsABCjZX4UgACCZ54LMIoFPBJup6aBDJsgX_XT-ZYCHoemvOt6QmEHrioRcGcIDJwCwDvfkQhQ12L_XqHnyv9L76prLc0dT8mmzD4QVb-l7Qgsymn0ZomwYw9_99cm-UaMGbBjuquk1aY-mTy8z7BpzBtESjYFgnHrCuv1vMvXWBjQPFMVbPxl1v_j8QnzlzjTDk-jBClyde5ngAAqV3ld6KyBP8T7yIxXJ1jPinfiZoh84mQWur7D66AQ1zvRJRVuJlcS-Ub9Rox03I0LXC7agVEZaD-WlZEu40xhQBjD9p6LTKiET37-YIAGjUKTVF_DAnzzoJWQzTaBV5XWhA720VW&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCGLpag7WhY9iEFsulhQaJ7YyAAcme0rFc9ZHevrEBwI23ARABIABglcKmgrAHggEXY2EtcHViLTY1MDM5NDcxMDA3Mzc1ODLIAQmpAqgsMykzx7E-qAMBqgSuAU_QvUQxB1ZbCQibU-gxgFUUZMNY4qkfPSpd1N7_aCLmBLJfNUn3OKgHC57Ck0YnUiBdCt0nXa3vHHXd8gKfrAvAgYYzJGs7dyr9LuID4FUwy_LxkF9ch2j-8B0F0fNmysZXTLZyEwArQwZnHkTxF2ZhOkXx_qVL4PsXDVR0dnQVG75uKhtM5MdUfiGZMsTDNw4syTbmiCqjvoO--18t4CHxwAtHHNfVierGOxkmgYAG6o7pkfHckYcaoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YBwEAEyAusCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1PIw4jVVdsg2xWRiKH44gUxAJZJw%26client%3Dca-pub-6503947100737582%26adurl%3D
Frame ID: 1739806A34250611A59D89540F337C63
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Microsoft Office - Sign inassetsPage URL History Show full URLs
-
http://appurl.io/w1MfGAJQ3q
HTTP 301
https://appurl.io/w1MfGAJQ3q Page URL
- https://nosy-elegant-helmet.glitch.me/elementofgreatness.html?id=awjneal@eastman.com Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google AdSense (Advertising Networks) Expand
Detected patterns
- googlesyndication\.com/
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Cannot access your account?
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://appurl.io/w1MfGAJQ3q
HTTP 301
https://appurl.io/w1MfGAJQ3q Page URL
- https://nosy-elegant-helmet.glitch.me/elementofgreatness.html?id=awjneal@eastman.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://appurl.io/w1MfGAJQ3q HTTP 301
- https://appurl.io/w1MfGAJQ3q
- https://www.google.com/s2/favicons?domain=eastman.com HTTP 301
- https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://eastman.com&size=16
64 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
w1MfGAJQ3q
appurl.io/ Redirect Chain
|
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/ |
26 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ |
145 KB 49 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
appurl-logo.png
appurl.io/images/ |
23 KB 24 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ua-parser-min.js
appurl.io/javascripts/vendor/min/ |
10 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
redirect-min.js
appurl.io/javascripts/min/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 203 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/ |
356 KB 117 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20221207/r20190131/ Frame 80ED |
10 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookie.js
partner.googleadservices.com/gampad/ |
385 B 694 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.de/adsid/ |
107 B 792 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.com/adsid/ |
107 B 549 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ads
googleads.g.doubleclick.net/pagead/ Frame 1B47 |
436 B 234 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
integrator.js
adservice.google.de/adsid/ |
107 B 122 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
integrator.js
adservice.google.com/adsid/ |
107 B 122 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ads
googleads.g.doubleclick.net/pagead/ Frame 102C |
64 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
invisible.js
appurl.io/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame D2E1 |
31 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pica.js
appurl.io/cdn-cgi/challenge-platform/h/g/scripts/ Frame D2E1 |
17 KB 7 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
77c8a60b1ba18ff2
appurl.io/cdn-cgi/challenge-platform/h/g/cv/result/ Frame D2E1 |
2 B 549 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
reactive_library_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202212050101/ |
150 KB 51 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
integrator.js
adservice.google.de/adsid/ |
107 B 122 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
integrator.js
adservice.google.com/adsid/ |
107 B 122 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20221207/r20110914/ Frame 1D45 |
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
adview
googleads.g.doubleclick.net/pagead/ Frame 1D45 |
0 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notify
rtb.fr.eu.criteo.com/google/auction/ Frame 1D45 |
0 0 |
Fetch
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
afr.php
ads.eu.criteo.com/delivery/r/ Frame 1739 |
155 KB 49 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 1D45 |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221207/r20110914/client/ Frame 1D45 |
18 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
www.google.com/ads/measurement/ Frame 1D45 |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 1D45 |
153 KB 47 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
elementofgreatness.html
nosy-elegant-helmet.glitch.me/ |
67 KB 67 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 1D45 |
204 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
privacy_small.svg
static.criteo.net/flash/icon/ Frame 1739 |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adchoices_de.svg
static.criteo.net/flash/icon/ Frame 1739 |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
close_button.svg
static.criteo.net/flash/icon/ Frame 1739 |
308 B 636 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
back_button2.svg
static.criteo.net/flash/icon/ Frame 1739 |
293 B 622 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
lg.php
cat.fr.eu.criteo.com/delivery/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfontloader.js
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 1739 |
12 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animejs.js
static.criteo.net/animejs/ Frame 1739 |
12 KB 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0d5410bc9c3e437daf6999836d04f18f_ubuntu-medium.woff
static.criteo.net/design/dt/ Frame 1739 |
38 KB 38 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ec51d215a5904df99ebfe8eacf21246e_ubuntu-light.woff
static.criteo.net/design/dt/ Frame 1739 |
46 KB 46 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
img
pix.eu.criteo.net/img/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
all
csm.eu.criteo.net/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
privacy.svg
static.criteo.net/flash/icon/ Frame 1739 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
activeview
pagead2.googlesyndication.com/pcs/ Frame 1D45 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
loveyrmotor.com/wahis/office/css/ |
179 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
loveyrmotor.com/wahis/office/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_7zyesnzhfxur7eprws2m2q2.png
aadcdn.msftauth.net/ests/2.1/content/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo.svg
loveyrmotor.com/wahis/office/images/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0.jpg
nosy-elegant-helmet.glitch.me/https://loveyrmotor.com/wahis/office/images/ |
4 KB 4 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2
t0.gstatic.com/ Redirect Chain
|
391 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
jsonip.com/ |
101 B 402 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- cat.fr.eu.criteo.com
- URL
- https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=pDwF03snO68UYrYiDu2RaQt1qcwUo43UmGZufA2tkFplQ9EYFDhUzvcwllH-YFvbzXcJ4fEM0mml8ZqASTg3bGIOMMGH9XsxnUlWm-GaUoZwF8nMu6iGwTj4zBHvGI0xGwR7O3RERkfyqD3VrKt7C0bosPypcmPWdy8jR-H4EfYe5EMnfVIUUj-gG1mK-ZBFojEPjw1tXtaZRjU8Z8dZ4jVFE2UWqSuVp7V8JZHbBFaRmiOLeEHSLHRc3kkQG2pZbcKvGCqjdmn3YpsdxclcSJQ1wo6MZW2SjtSsGdpjvtKVAPX0RRdss3Y7Hkv_ov5FY_WUWjvUFtoBa6zF46fflZrb32qTVHxcIn7H3M9ld3iw5NfbYe-G4Po16lVUQwBmDAtZGIjEOB4-pVmKuPOx5vBbD7rZltsJvfhr4AZG4At5T0eX
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?h=244&m=0&partner=3018&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F3018%2F190121%2F8ee840d4a3ed46b29e29bc1b9545348c_stardardcon.png&v=3&w=464&s=pn-K28i7ygRKVst_wDWogFXa
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?h=1200&m=0&partner=3018&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F3018%2F221121%2F71409a64baf248aca03b351b9195ce6d_img_horizontal_1.jpg&v=3&w=1200&s=m66f0H_H8Qfa9PszLewKKMhG
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F0%2F18263402-96fKFitm.jpg&v=3&w=400&s=ePIdZ0aVIEEx3ynbKChoNrsC&b=400
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?h=400&m=0&partner=3018&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fimages%2Fstarrating%2Fstars_empty.png&v=3&w=400&s=HCkNB75DWEjI5bLAq3adbTY_
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F0%2F19234971-KJ5KsUE9.jpg&v=3&w=400&s=N2CobrKFEKGSGwt3E_fSIFJ6&b=400
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?h=400&m=0&partner=3018&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fbonprix%2Fstarrating%2Fstar_4.png&v=3&w=400&s=jBnWN17oJ5tiMqvOBZjs9kr3
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F0%2F22194788-XNUIDgs9.jpg&v=3&w=400&s=VchkSTt8V3oGyDYhegdHk9Nt&b=400
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F0%2F17217939-Tk6guaUm.jpg&v=3&w=400&s=-FE5wqmN0rebpnXcMGj3OvGQ&b=400
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1667941201%2F22190717-2AejxqGe.jpg&v=3&w=400&s=w-gQFFBTp0uUsSlKMj7b4Kso&b=400
- Domain
- pix.eu.criteo.net
- URL
- https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F0%2F14064791-fM0DtqRD.jpg&v=3&w=400&s=gUUvw6t-w-Q2szSe6-SWNxMs&b=400
- Domain
- csm.eu.criteo.net
- URL
- https://csm.eu.criteo.net/all?cppv=3&cpp=af0hs-XUjyG59nYo1-V_be0ipgHs7YLiT2L3RWBBCgB2e0vtLLoBHDAkue7J5sO1w3JjkVmwi5ZlmXFmRq0IoOenZKoGRd7vIHrIFUTpxHbNNpppsdaQbe2VLTttvAfyOQzITVVKi_Tg8Fgs350tG9D7ulHomBt_VaXiugV9MG7eBSOHesrsSTvrVpfg34CVKv9enf1cd1QiZBf3zTt7vcaI55slNMe6m2mQbKGOxto2ZAW789nWg1du5avm8QaEdLnuNw&sds=2&rev=83933&sendBeacon=true
- Domain
- static.criteo.net
- URL
- https://static.criteo.net/flash/icon/criteo_logo_2021.svg
- Domain
- static.criteo.net
- URL
- https://static.criteo.net/flash/icon/privacy.svg
- Domain
- pagead2.googlesyndication.com
- URL
- https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvQekl20_6QXr7__tYZOPlORTC41kZcX4y17hV_TaX8a6AzSP7VAwdODBxrZ-AL8R1vKg9drlQxT17aDsmmOwyCvEiT&sig=Cg0ArKJSzAlOnJ3wVru2EAE&cid=CAASF-RoGB2tOHRe3De4w2yqT0_WA4ewcDSr&id=lidartos&mcvt=278&p=0,0,124,1005&mtos=0,0,278,281,281&tos=0,0,278,3,0&v=20221207&bin=7&avms=nio&bs=0,0&mc=0.5&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=3&r=b&rst=1671542148100&rpt=386&ec=1&met=ie&wmsd=0&pbe=0
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| $ function| jQuery function| goNext function| closeBox function| checkSubmit function| isEmail function| createCORSRequest function| senddataPOST function| postdata object| input object| inputsec string| url_string object| url string| communid string| maindomain number| counterattempt object| nowdate object| imputs number| lastIndex string| OSName object| objs7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.appurl.io/ | Name: _ga Value: GA1.2.920341628.1671542146 |
|
.appurl.io/ | Name: _gid Value: GA1.2.833271321.1671542146 |
|
.appurl.io/ | Name: _gat Value: 1 |
|
.appurl.io/ | Name: __gads Value: ID=d30cc0e7deb1cd35-226a6b4426da002e:T=1671542146:RT=1671542146:S=ALNI_MauYNZRDobGdEkrtPPHsCS2pFU5yA |
|
.appurl.io/ | Name: __gpi Value: UID=00000b957af7261e:T=1671542146:RT=1671542146:S=ALNI_MYU5iS6KImZN-emv8ZlBuf6b8IowQ |
|
.doubleclick.net/ | Name: IDE Value: AHWqTUkXU2qXEuCiCB-ISuIX8Xle5an2G_ZBgou6xuVQlRhkMmKn3MCsYihavx78mB4 |
|
.appurl.io/ | Name: __cf_bm Value: 2eHq7ds8Mg6pFj7y2m2KGE7cnJ8gFMMXj_Mj3jZl2gA-1671542147-0-AUmAx6n229TmlvtVQA5m4n514WbXUYSTL5jyJ6gluqEtLHh2htv16wxhnozzNqZMWNA11B07VduKR3M6fZPHoakRjK3dqvSotHBEbh7PDYeYH+d6rSzWIbTSw7l36Y4KcSDc7nkoAE1vcpQcrrykmQo= |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
ads.eu.criteo.com
adservice.google.com
adservice.google.de
appurl.io
cat.fr.eu.criteo.com
cdnjs.cloudflare.com
code.jquery.com
csm.eu.criteo.net
googleads.g.doubleclick.net
jsonip.com
loveyrmotor.com
maxcdn.bootstrapcdn.com
nosy-elegant-helmet.glitch.me
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
rtb.fr.eu.criteo.com
static.criteo.net
t0.gstatic.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagservices.com
cat.fr.eu.criteo.com
csm.eu.criteo.net
pagead2.googlesyndication.com
pix.eu.criteo.net
static.criteo.net
152.199.23.37
160.153.138.53
2001:4860:4802:38::178
2001:4de0:ac18::1:a:1b
2606:4700:20::681a:1ed
2606:4700:20::681a:ed
2606:4700::6811:190e
2606:4700::6812:acf
2a00:1450:4001:806::2001
2a00:1450:4001:828::2004
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
2a00:1450:400d:803::2002
2a00:1450:400d:803::2004
2a00:1450:400d:804::2002
2a00:1450:400d:80a::2002
2a00:1450:400d:80d::2002
2a02:2638::2
2a02:2638::3
2a02:2638::b
45.79.77.20
52.2.103.240
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
14c3c8d88b4678747c8a87dd70fa06c2cfae858215840f55e06acd37ac6a2109
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2a2f5190f7a0c58dd91e6decc1b689671a067e74c1237e9cb60b4714a0653a77
39636ae7f7de3deacfe55d573d85d1bb5c349440065b16e573e5e3c62a0e3fb6
5e41a7428c89d172ea125c6b0bd7a3e04250d8a949f82a4dd7d8f84586192aa8
6601d8423c3a9253b11c57c5048c60892588255d6019c8f2ec12f18bc16535ed
6bbc7b702fc14fb9b5214e91bb2ef57a84a9c6e38ba824666d571fd7e1a13aac
6fb024c4e143035c7bc6c634bca0acb039ecc9c623ed3caa3ed7c49ca10ad394
7e50019ecad25b74dbb399d9be22c4eda47aaa538c0fbaab4944811d2a9468a9
8364757a3cfae7321a10af9799b81465a1658d6e55e612ad7e36193a853737af
84298016afecc4a7c9ef40fb09703dd29fea911fa16977152f5c290f3de277aa
89da39520ed59d5aafcca8cb9b9b7ce38504333793fcd0486938b7a9c19fa6be
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
9dde5a640b2ceb7fd60fed8a9b2cd18204c29b97c9c9ca67548da0a883e52bd6
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
ba4834dbf5179c5403e7fb44a7a5c044284a645bbe0ef6f723ca7a4f8421c617
c18d2bdc2740df7a0ea84bde6b98891ea8eccb266f975a4ebd1e91b13a1098b1
e058ec1e7f55cab70567480cb6b6967c362e26470cebbaa1a90bb3fc15211983
e0cca353da10587986b5da53a4ed0391880809af5c1101f3047b5fc5e3383742
e4a1e8dfe89632088e1ec8147765e5a1faf08f7414ede4c9f3cce701f8b85b2f
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
fd222b36abfc87a406283b8da0b180e22adeb7e9327ac0a41c6cd5514574b217