www.bidencare-healthquote.com
Open in
urlscan Pro
18.67.76.73
Malicious Activity!
Public Scan
Effective URL: https://www.bidencare-healthquote.com/vbidenhq7/step1.html
Submission: On May 05 via manual from US — Scanned from US
Summary
TLS certificate: Issued by Amazon on January 16th 2022. Valid for: a year.
This is the only time www.bidencare-healthquote.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 4 votes Show Verdicts
Domain & IP information
ASN40676 (AS40676, US)
PTR: agendms-odyeys.reactorfit.com
104.216.53.145 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-217-43-239.us-east-2.compute.amazonaws.com
yhguor.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-183-231-145.us-west-1.compute.amazonaws.com
ffitsamllub.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-67-76-73.iad89.r.cloudfront.net
www.bidencare-healthquote.com |
ASN15169 (GOOGLE, US)
PTR: 137.102.96.34.bc.googleusercontent.com
dev.visualwebsiteoptimizer.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-67-79-74.iad89.r.cloudfront.net
d5phz18u4wuww.cloudfront.net |
ASN15169 (GOOGLE, US)
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-160-222-255.compute-1.amazonaws.com
api.trustedform.com |
ASN16509 (AMAZON-02, US)
cdn.trustedform.com |
ASN15169 (GOOGLE, US)
PTR: 224.67.96.34.bc.googleusercontent.com
cdn.siftscience.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-67-66-57.iad89.r.cloudfront.net
d1tprjo2w7krrh.cloudfront.net |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 42.232.102.34.bc.googleusercontent.com
hexagon-analytics.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-230-206-204.compute-1.amazonaws.com
create.leadid.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-67-79-36.iad89.r.cloudfront.net
d2m2wsoho8qq12.cloudfront.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-207-54-198.compute-1.amazonaws.com
deviceid.trueleadid.com |
Domain | Requested by | |
---|---|---|
46 | www.bidencare-healthquote.com |
1 redirects
www.bidencare-healthquote.com
ajax.googleapis.com cdn.trustedform.com |
6 | create.leadid.com |
d1tprjo2w7krrh.cloudfront.net
deviceid.trueleadid.com |
6 | api.trustedform.com |
1 redirects
api.trustedform.com
cdn.trustedform.com |
6 | dev.visualwebsiteoptimizer.com |
www.bidencare-healthquote.com
dev.visualwebsiteoptimizer.com d5phz18u4wuww.cloudfront.net |
3 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
3 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | cdn.trustedform.com |
www.bidencare-healthquote.com
api.trustedform.com |
2 | ajax.googleapis.com |
www.bidencare-healthquote.com
|
1 | deviceid.trueleadid.com |
d2m2wsoho8qq12.cloudfront.net
|
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | d2m2wsoho8qq12.cloudfront.net |
d1tprjo2w7krrh.cloudfront.net
|
1 | hexagon-analytics.com |
www.bidencare-healthquote.com
|
1 | d1tprjo2w7krrh.cloudfront.net |
www.bidencare-healthquote.com
|
1 | cdn.siftscience.com |
www.bidencare-healthquote.com
|
1 | www.googletagmanager.com |
www.bidencare-healthquote.com
|
1 | fonts.googleapis.com |
www.bidencare-healthquote.com
|
1 | d5phz18u4wuww.cloudfront.net |
www.bidencare-healthquote.com
|
1 | netdna.bootstrapcdn.com |
www.bidencare-healthquote.com
|
1 | ffitsamllub.com | 1 redirects |
1 | yhguor.com | 1 redirects |
82 | 20 |
This site contains links to these domains. Also see Links.
Domain |
---|
privacyportal-cdn.cookiepro.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
bidencare-healthquote.com Amazon |
2022-01-16 - 2023-02-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-04-18 - 2022-07-11 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-01-29 - 2023-01-29 |
a year | crt.sh |
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2 |
2020-06-19 - 2022-07-06 |
2 years | crt.sh |
*.cloudfront.net Amazon |
2022-02-01 - 2023-01-31 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-04-18 - 2022-07-11 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
*.siftscience.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-01-07 - 2023-01-20 |
a year | crt.sh |
*.hexagon-analytics.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-10-19 - 2022-11-04 |
a year | crt.sh |
create.leadid.com Amazon |
2021-10-22 - 2022-11-19 |
a year | crt.sh |
*.trustedform.com Amazon |
2021-10-12 - 2022-11-09 |
a year | crt.sh |
cdn.trustedform.com Amazon |
2022-04-14 - 2023-05-13 |
a year | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
deviceid.trueleadid.com Amazon |
2022-01-07 - 2023-02-05 |
a year | crt.sh |
This page contains 4 frames:
Primary Page:
https://www.bidencare-healthquote.com/vbidenhq7/step1.html
Frame ID: CECA06D8E4C5DAE10AB8A32F275DF46E
Requests: 79 HTTP requests in this frame
Frame:
https://www.bidencare-healthquote.com/consumer/pixels.php?page=1
Frame ID: 7B534D8017B9D5951E6FDCEF346A822A
Requests: 1 HTTP requests in this frame
Frame:
https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=8531EC1E-28C9-BA8C-596F-00A7005950A7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=5A020F49-2BA7-3B7D-AEC8-196822FC1647&lac=F6A97670-85B6-6871-F5AC-BBA6473267E7
Frame ID: FF3786A6A332302CFAEB6FE44F208D57
Requests: 1 HTTP requests in this frame
Frame:
https://deviceid.trueleadid.com/iframe.html?token=8531EC1E-28C9-BA8C-596F-00A7005950A7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=5A020F49-2BA7-3B7D-AEC8-196822FC1647&lac=F6A97670-85B6-6871-F5AC-BBA6473267E7
Frame ID: 3EA7CE5759B4B25A90EEBAC73F7358D7
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
bidencare-healthquote.com | Health | Get a free quotePage URL History Show full URLs
-
http://104.216.53.145/qs=r-abacaejfebgeacafeccjafeccjafeccjacadjaccaccacbdiadfbhacbekkiacb
HTTP 302
https://yhguor.com/?E=nbTYRpgn6DV9fWbXXEm9SYYeZ9uj%2bKn%2b&s1=43118_1_11&s2=0_1_43118_43118_1_3... HTTP 302
https://ffitsamllub.com/?E=nbTYRpgn6DV9fWbXXEm9SYYeZ9uj%2bKn%2b&s1=43118_1_11&s2=0_1_43118_43118_1_3... HTTP 302
https://www.bidencare-healthquote.com/go/aHK/bcemailcpl2--4338_43118_1_11/427590072 HTTP 302
https://www.bidencare-healthquote.com/vbidenhq7/step1.html Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
AngularJS (JavaScript Frameworks) Expand
Detected patterns
- /([\d.]+(?:-?rc[.\d]*)*)/angular(?:\.min)?\.js
- \bangular.{0,32}\.js
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- <!-- (?:End )?Google Tag Manager -->
- googletagmanager\.com/gtm\.js
Sift (Analytics) Expand
Detected patterns
- cdn\.sift(?:science)?\.com/s\.js
VWO (Analytics) Expand
Detected patterns
- dev\.visualwebsiteoptimizer\.com/?([\d.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Data Request
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://104.216.53.145/qs=r-abacaejfebgeacafeccjafeccjafeccjacadjaccaccacbdiadfbhacbekkiacb
HTTP 302
https://yhguor.com/?E=nbTYRpgn6DV9fWbXXEm9SYYeZ9uj%2bKn%2b&s1=43118_1_11&s2=0_1_43118_43118_1_3843053_28_2406_103997_1_10_1027&s3=28 HTTP 302
https://ffitsamllub.com/?E=nbTYRpgn6DV9fWbXXEm9SYYeZ9uj%2bKn%2b&s1=43118_1_11&s2=0_1_43118_43118_1_3843053_28_2406_103997_1_10_1027&s3=28&ckmguid=14a7bd24-552f-404a-af2d-e4c1559b8dd3 HTTP 302
https://www.bidencare-healthquote.com/go/aHK/bcemailcpl2--4338_43118_1_11/427590072 HTTP 302
https://www.bidencare-healthquote.com/vbidenhq7/step1.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 33- https://api.trustedform.com/trustedform.js?provide_referrer=false&field=xxTrustedFormCertUrl&l=16517915109860.6172235073083296&invert_field_sensitivity=false HTTP 301
- https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&l=16517915109860.6172235073083296&invert_field_sensitivity=false
82 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
step1.html
www.bidencare-healthquote.com/vbidenhq7/ Redirect Chain
|
21 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
www.bidencare-healthquote.com/shared/css/ |
98 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
www.bidencare-healthquote.com/shared/css/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
www.bidencare-healthquote.com/vbidenhq7/css/ |
34 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js.php
www.bidencare-healthquote.com/consumer/ |
38 KB 38 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
site-logo.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
41 KB 42 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blue-phone-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
locationpin-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aetna-logo-white.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
molina-logo-white.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bluecross-blueshield-logo-white.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cigna-logo-white.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
family.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
97 KB 98 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
seal-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
megaphone-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shield-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clock-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
white-phone-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular.min.js
ajax.googleapis.com/ajax/libs/angularjs/1.0.8/ |
80 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
netdna.bootstrapcdn.com/bootstrap/3.1.1/js/ |
28 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js_visitor_settings.php
dev.visualwebsiteoptimizer.com/deploy/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
track-573dbaa3a36312bdee7d425b79f55556.js
dev.visualwebsiteoptimizer.com/7.0/ |
12 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opa-914ce10bf781a1434a6ef90784bdf8d6.js
dev.visualwebsiteoptimizer.com/analysis/4.0/ |
104 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
v.gif
dev.visualwebsiteoptimizer.com/ |
35 B 52 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vis_opt.js
d5phz18u4wuww.cloudfront.net/ |
168 KB 56 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
vis_opt-573dbaa3a36312bdee7d425b79f55556.js
dev.visualwebsiteoptimizer.com/7.0/ |
221 KB 63 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
602 B 642 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
worker-70faafffa0475802f5ee03ca5ff74179.js
dev.visualwebsiteoptimizer.com/analysis/ |
47 KB 13 KB |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
283 KB 72 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2sDfZG1Wl4Lcnbu6iQ.ttf
fonts.gstatic.com/s/oxygen/v14/ |
45 KB 27 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2sDcZG1Wl4LcnbuCNWgDbw.ttf
fonts.gstatic.com/s/oxygen/v14/ |
46 KB 46 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
glyphicons-halflings-regular.woff
www.bidencare-healthquote.com/shared/fonts/ |
23 KB 23 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.js
cdn.trustedform.com/ Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
contact_form.html
www.bidencare-healthquote.com/consumer/templates/ |
5 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
resume_form.html
www.bidencare-healthquote.com/consumer/templates/ |
511 B 819 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
init.php
www.bidencare-healthquote.com/consumer/ |
785 B 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pixels.php
www.bidencare-healthquote.com/consumer/ Frame 7B53 |
0 338 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s.js
cdn.siftscience.com/ |
61 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5a020f49-2ba7-3b7d-aec8-196822fc1647.js
d1tprjo2w7krrh.cloudfront.net/campaign/ |
123 KB 124 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ajax.php
www.bidencare-healthquote.com/consumer/ |
92 B 431 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
provision_number.php
www.bidencare-healthquote.com/consumer/ |
90 B 430 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ajax.php
www.bidencare-healthquote.com/consumer/ |
92 B 432 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ajax.php
www.bidencare-healthquote.com/consumer/ |
48 B 389 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ajax.php
www.bidencare-healthquote.com/consumer/ |
48 B 388 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ajax.php
www.bidencare-healthquote.com/consumer/ |
130 B 470 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ajax.php
www.bidencare-healthquote.com/consumer/ |
41 KB 42 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
2sDcZG1Wl4LcnbuCJW8Dbw.ttf
fonts.gstatic.com/s/oxygen/v14/ |
41 KB 24 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
760438.gif
hexagon-analytics.com/images/ |
43 B 272 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
GenerateToken
create.leadid.com/2.11.9/ |
36 B 657 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
www.google-analytics.com/j/ |
2 B 22 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
certs
api.trustedform.com/ |
475 B 686 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
collect
www.google-analytics.com/ |
35 B 55 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
trustedform-1.8.25.js
cdn.trustedform.com/ |
97 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iframe.html
d2m2wsoho8qq12.cloudfront.net/ Frame FF37 |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
SaveDom
create.leadid.com/2.11.9/ |
0 621 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
InitFormData
create.leadid.com/2.11.9/ |
0 622 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 449 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
snapshot
api.trustedform.com/certs/ddc3b10eca6622476388d9280124dd713767bd07/ |
0 159 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
site-logo.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
41 KB 42 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blue-phone-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
locationpin-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aetna-logo-white.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
molina-logo-white.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bluecross-blueshield-logo-white.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cigna-logo-white.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
family.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
97 KB 98 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
seal-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
megaphone-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shield-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clock-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
white-phone-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-icon.png
www.bidencare-healthquote.com/vbidenhq7/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
fingerprints
api.trustedform.com/certs/ddc3b10eca6622476388d9280124dd713767bd07/ |
0 159 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 10 KB |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iframe.html
deviceid.trueleadid.com/ Frame 3EA7 |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
InitFormData
create.leadid.com/2.11.9/ |
0 621 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SaveDeviceId.js
create.leadid.com/2.11.9/ Frame 3EA7 |
0 626 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
events
api.trustedform.com/certs/ddc3b10eca6622476388d9280124dd713767bd07/ |
0 159 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
Snap
create.leadid.com/2.11.9/ |
0 622 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
events
api.trustedform.com/certs/ddc3b10eca6622476388d9280124dd713767bd07/ |
0 159 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
task.url
Submitted on
May 5th 2022, 11:00:27 pm
UTC —
From United States
Threats:
Misc
Comment: This URL is a Known Malicious 3xx redirect stack.
Malicious
page.url
Submitted on
May 5th 2022, 10:59:50 pm
UTC —
From United States
Threats:
Misc
Comment: Known Spam - This URL was sent to a spam trap.
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
78 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails number| _vis_opt_account_id string| _vis_opt_protocol number| _vwo_acc_id object| _vwo_exp_ids object| _vwo_exp boolean| _vis_opt_settings_loaded string| _vwo_cookieDomain string| _vwo_uuid string| _vwo_lib_cb string| _vwo_mt string| _vwo_tm object| vwo_iehack_queue object| VWO object| _vwo_pa string| _vwo_opa_cb string| _vwo_worker_cb string| _vis_opt_file_name function| vwo_$ string| _vwo_server_url object| _vis_opt_queue object| _vis_opt_check_segment object| _vwo_evq function| _vwo_ev object| _vwo_t object| _vwo_api_section_callback object| _vis_opt_comb_name function| _vwo_s object| _vwo_campaignData function| _vis_opt_top_initialize function| _vis_opt_bottom_initialize function| _vis_opt_goal_conversion function| _vis_opt_revenue_conversion function| _vis_opt_pause function| _vis_opt_readCookie function| _vis_opt_createCookie function| _vis_opt_element_loaded function| _vis_opt_GA_track function| _vis_opt_register_conversion function| _vis_opt_get_campaign_xPath boolean| DISABLE_NATIVE_CONSTANTS object| _vwo_editorOperationTracker function| _vwo_handleMutations number| _vis_opt_experiment_id object| __nls number| ___vwo function| $ function| jQuery object| dataLayer object| angular object| jQuery112408635708501470492 object| DlAngular object| _sift object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| __siftFlashCB undefined| Sift object| PluginDetect object| trustedForm function| trustedFormStartRecording function| trustedFormStopRecording object| LeadiDconfig object| LeadiD object| gaplugins object| gaGlobal object| gaData string| label string| id boolean| sensitiveData object| defaultStyleFrame object| regeneratorRuntime18 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ffitsamllub.com/ | Name: sq Value: qD63SEhUu4ZAek1A3QKc1VsHd+rZqhPkQWrSKRtTgkUGUU9YBxv0Pg== |
|
.ffitsamllub.com/ | Name: tfl Value: wcdH/mBgom/LfZhn0rcvr1sHd+rZqhPkQWrSKRtTgkUGUU9YBxv0Pg== |
|
.ffitsamllub.com/ | Name: c6937 Value: qD63SEhUu4aRXMAyiUEdu+EgAZcN+Bvw5mYgMAlIgNkZLrtLDvqcng== |
|
www.bidencare-healthquote.com/ | Name: PHPSESSID Value: u6ilp87ah5hqmdbpp3c9kedm54 |
|
.bidencare-healthquote.com/ | Name: _vwo_uuid_v2 Value: DF43A6BF89A5F8A85DCD9AC9C298741EE|dfd1d8fb1c582e3811b3fb6dd36affd4 |
|
.bidencare-healthquote.com/ | Name: _vis_opt_s Value: 1%7C |
|
.bidencare-healthquote.com/ | Name: _vis_opt_test_cookie Value: 1 |
|
.bidencare-healthquote.com/ | Name: _vwo_uuid Value: DF43A6BF89A5F8A85DCD9AC9C298741EE |
|
.bidencare-healthquote.com/ | Name: _vwo_sn Value: 0%3A1 |
|
.bidencare-healthquote.com/ | Name: _vwo_ds Value: 3%3Aa_0%2Ct_0%3A0%241651791509%3A43.39272027%3A%3A%3A4_0%2C3_0%3A0 |
|
www.bidencare-healthquote.com/ | Name: cookie_webtracking_ids Value: [835761993] |
|
.bidencare-healthquote.com/ | Name: _gcl_au Value: 1.1.2139661489.1651791511 |
|
.bidencare-healthquote.com/ | Name: __ssid Value: fb71e58b8f3995a271589cb40ee9adc |
|
.bidencare-healthquote.com/ | Name: _ga Value: GA1.2.997551989.1651791512 |
|
.bidencare-healthquote.com/ | Name: _gid Value: GA1.2.2059734494.1651791512 |
|
.bidencare-healthquote.com/ | Name: _gat_UA-57087543-1 Value: 1 |
|
www.bidencare-healthquote.com/ | Name: leadid_token-F6A97670-85B6-6871-F5AC-BBA6473267E7-5A020F49-2BA7-3B7D-AEC8-196822FC1647 Value: 8531EC1E-28C9-BA8C-596F-00A7005950A7 |
|
.deviceid.trueleadid.com/ | Name: uuid Value: bb670c317d574c5497ae59d027750572 |
9 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.trustedform.com
cdn.siftscience.com
cdn.trustedform.com
create.leadid.com
d1tprjo2w7krrh.cloudfront.net
d2m2wsoho8qq12.cloudfront.net
d5phz18u4wuww.cloudfront.net
dev.visualwebsiteoptimizer.com
deviceid.trueleadid.com
ffitsamllub.com
fonts.googleapis.com
fonts.gstatic.com
hexagon-analytics.com
netdna.bootstrapcdn.com
stats.g.doubleclick.net
www.bidencare-healthquote.com
www.google-analytics.com
www.googletagmanager.com
yhguor.com
104.216.53.145
18.217.43.239
18.67.66.57
18.67.76.73
18.67.79.36
18.67.79.74
2600:9000:2305:2a00:1c:7f1a:6680:93a1
2606:4700::6812:bcf
2607:f8b0:4004:c08::9b
2607:f8b0:4006:809::2008
2607:f8b0:4006:80e::200a
2607:f8b0:4006:816::200e
2607:f8b0:4006:822::200a
2607:f8b0:4006:824::2003
34.102.232.42
34.230.206.204
34.96.102.137
34.96.67.224
52.207.54.198
54.160.222.255
54.183.231.145
04d3a1bcd970602231cda0d5d1148a327ac0f7a1d7891e67bad69515670b8ee8
08cffab1dd52321cd190fa23e37cd1483e8a9e19b366fe0e9436a304ab476798
0a03ac561980e2d5531e325dfe4f63feac2fa9098ded722e1b179880ead429c2
184a058b7ca2338279426eb61796d74c73a475f66df6e5a9372bbebc272c5c24
191fd973e2ab409c982b1552ae36e44b138a8460ae4dc42f09fd36577c68341f
236d2f0ba3d1d267091134acba9ba10626b6431e00470c3f2ee871a262641e67
25f51bd59c9d9795c83842535085176a1b50fc064c41e943b57bcd0ca1d7173f
2c6b610bf3713b347553fa42a8837e1eaa96360b34868d4b6b9e754f5f297653
339da6c6232c3a7425fed67de71da47b84f42ae5de71b21f5b6b408b2d89888d
373dd52bd00e424d03131de0d8c5bb1f8dd861a63d2a91c586df18c72efba5a3
3bd093a54ad07df8441c169318a6ae73a788a09a544c858b4af33168685568e8
3dbca5f65a3cb8c1bddb622045599953d3e6872095192e61e2cda88cf2cb0287
3f26c78f51cf30fe9cdc58a7d98734bb994ec1cab1fc0048a921f52a411db1f1
408ba0bf843cde6b3865ad53a937a6c485f6b61932ebe8b6927024389aed7901
539370a53062290c27381455bca190bdc3393e4cf05c1c209d9918c04b3b8113
56dcd86156e747d898125230c5c070a36c792e4f42005a505a5e41499d9b6bef
602ea48b7fd2a48e702e43825b0d6f6495f78cb4cc1fa24cb8c95f61e014215a
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
684f9565707b1d2e08e2f9faf7389a3de4d9c1ae4382dd60c9ddfb156d6f7180
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
746c92a8ac391f6dcb4376b840667d2f6a8115a569f4532e3654b3412dee6ba7
7921df86278b7fa9be0cbd78d9990071763ec4e9e88aaff2c3d466723090b8ae
7f2ce819f6ba0dd34c9f665cc59a03b13729044f97958e58f863be86313a4823
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87bf1dd520931d9a51da408c1b22166e37721f31c059ae4abe37c1a1dd1755cf
884eb054803f97b0884658a68a2686889e59cddfed567d3586092c14fa41accc
898d05a17f2cfc5120ddcdba47a885c378c0b466f30f0700e502757e24b403a1
8c97d5372cbfc8f19ceab85ee4c19aba96df539e3432d26da8767dffbd577632
8eb12af7c555ddc2f90cece6a14fc31f2ca15518f172f734bc350285fe4f7f3d
9982e354e83e99d2fdf876d3036c764bbe75f63cafc445db948d5f73d884996f
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a35c35da5ff2378704c81fed1202bf2b9f5a9b009f2d02701ae732b6bd102ca8
a961a33c4b3fc9dd1a5d8aa4e44caeaa59bc7b9b0ee7f98e88bd7a28d3391e72
acf0df26a872352f365b066f3b43cc37e07c632dfcdb9314e513384da7da1931
b16d222a77e5c722a3979a9e1cad4230cf9fa5250eb1ee3ba3cdaf443ed44978
c6cf89fdb3a994360d55e6a136dd6a8adce5c861c9979b748e1c61d1bd052087
c7001640deea5a9cbc9508ef42f935864fd792aad09d121d1f59f3d72b5ea4fb
d90cb3287b69cff11b13c2a5562908b4a5b918b540dcb1aec09344f522f18f99
dac35f8e3501ded167fe5871ca6b2d7cad8c25d2eef8fb2f035b124f3b52f800
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df2bb2ad81b74c63d480349e1a07bd8bed70bc8b263bdca39f05e0e83fece7c8
e28ec298a331f5700efdfc81ca49823437441b27df26da43f7041dda25629f9d
e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e52e261e4b9efd8857be1662735860bccefe61e8b07e7085f75c6670f61e4644
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
e938376d155bd00943e40c6200847b98cb6819c3cfdfe573a0742f1c36b70cbb
e96ee4202dd697f4757a0c1502f5b3ae79c0d59d0823d80a80ac3ed97132d861
e9e7ccb740757c0813f07ab311cdffa86b053570d2487547aed8ddca9c5061c2
eed633a8002069e13f06351bfe014d0132941a0882144ccee95cdacfa403b954
f5829f0844e9efd85de9167456acc6de6dfdc85289ec384f1491e7085fedfcf1
f5ac7f2830726b19b349fcfe18f3b46054287e1e8159dda49ac83be0f77bf2ad
f68c098349cbf9fd3876d9291f5dca588b7a12f7a528de9735d4299efefefb16
f96b49a2d0ed6f04fb6730f196ff0800572d8f05c2142bf69ead656514d9e075
fa113234429ffa67a417e6670d60ae6054eeaef1062aee83ca8ad1f5cb4ce987
fc969dc1c6ff531abcf368089dcbaf5775133b0626ff56b52301a059fc0f9e1e