![](/screenshots/ff4c5bbd-e576-4d0e-86fa-f527ffb414d8.png)
costaricaretireonss.com
Open in
urlscan Pro
2a06:98c1:3120::c
Malicious Activity!
Public Scan
Submission: On September 19 via automatic, source openphish — Scanned from NL
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 22nd 2022. Valid for: a year.
This is the only time costaricaretireonss.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-143.deploy.static.akamaitechnologies.com
tags-eu.tiqcdn.com |
ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-27-30.eu-central-1.compute.amazonaws.com
t13.intelliad.de |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-71-168-227.eu-central-1.compute.amazonaws.com
t23.intelliad.de |
ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net
www.googleadservices.com |
ASN32934 (FACEBOOK, US)
connect.facebook.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-103-16.eu-west-1.compute.amazonaws.com
xups.xplosion.de |
ASN16509 (AMAZON-02, US)
PTR: ec2-34-242-116-104.eu-west-1.compute.amazonaws.com
uss.xplosion.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
27 |
costaricaretireonss.com
costaricaretireonss.com |
360 KB |
11 |
tiqcdn.com
tags-eu.tiqcdn.com — Cisco Umbrella Rank: 53821 |
38 KB |
7 |
telekom.de
1 redirects
pix.telekom.de — Cisco Umbrella Rank: 90700 www.telekom.de — Cisco Umbrella Rank: 114697 |
138 KB |
6 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 113 |
779 B |
6 |
adform.net
2 redirects
track.adform.net — Cisco Umbrella Rank: 3979 s2.adform.net — Cisco Umbrella Rank: 6329 |
38 KB |
5 |
xplosion.de
ssl.xplosion.de — Cisco Umbrella Rank: 839456 xups.xplosion.de uss.xplosion.de — Cisco Umbrella Rank: 37519 |
11 KB |
5 |
wbtrk.net
cdn.wbtrk.net — Cisco Umbrella Rank: 158684 geid.wbtrk.net — Cisco Umbrella Rank: 123361 |
2 KB |
5 |
intelliad.de
t13.intelliad.de — Cisco Umbrella Rank: 181227 t23.intelliad.de — Cisco Umbrella Rank: 128727 |
10 KB |
3 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 152 |
196 KB |
2 |
wcfbc.net
1 redirects
fbc.wcfbc.net — Cisco Umbrella Rank: 45223 |
380 B |
2 |
google.nl
www.google.nl — Cisco Umbrella Rank: 9480 |
612 B |
2 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 2 |
708 B |
2 |
doubleclick.net
1 redirects
googleads.g.doubleclick.net — Cisco Umbrella Rank: 41 |
2 KB |
1 |
googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 128 |
16 KB |
1 |
wt-safetag.com
responder.wt-safetag.com — Cisco Umbrella Rank: 32909 |
230 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 62 |
46 KB |
1 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 13442 |
1 KB |
81 | 17 |
Domain | Requested by | |
---|---|---|
27 | costaricaretireonss.com |
costaricaretireonss.com
|
11 | tags-eu.tiqcdn.com |
costaricaretireonss.com
|
6 | www.facebook.com |
costaricaretireonss.com
|
5 | track.adform.net |
2 redirects
costaricaretireonss.com
track.adform.net |
4 | geid.wbtrk.net |
costaricaretireonss.com
|
4 | pix.telekom.de |
1 redirects
costaricaretireonss.com
|
3 | www.telekom.de |
tags-eu.tiqcdn.com
|
3 | ssl.xplosion.de |
tags-eu.tiqcdn.com
ssl.xplosion.de |
3 | connect.facebook.net |
costaricaretireonss.com
connect.facebook.net |
3 | t23.intelliad.de |
t13.intelliad.de
costaricaretireonss.com |
2 | fbc.wcfbc.net |
1 redirects
costaricaretireonss.com
|
2 | t13.intelliad.de |
tags-eu.tiqcdn.com
t13.intelliad.de |
2 | www.google.nl |
costaricaretireonss.com
|
2 | www.google.com |
1 redirects
costaricaretireonss.com
|
2 | googleads.g.doubleclick.net |
1 redirects
www.googleadservices.com
|
1 | uss.xplosion.de | |
1 | xups.xplosion.de |
ssl.xplosion.de
|
1 | s2.adform.net |
costaricaretireonss.com
|
1 | www.googleadservices.com |
www.googletagmanager.com
|
1 | cdn.wbtrk.net |
costaricaretireonss.com
|
1 | responder.wt-safetag.com |
costaricaretireonss.com
|
1 | www.googletagmanager.com |
costaricaretireonss.com
|
1 | i.ibb.co |
costaricaretireonss.com
|
81 | 23 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-05-22 - 2023-05-22 |
a year | crt.sh |
ibb.co R3 |
2022-08-07 - 2022-11-05 |
3 months | crt.sh |
track.adform.net DigiCert TLS RSA SHA256 2020 CA1 |
2021-09-06 - 2022-10-07 |
a year | crt.sh |
*.tiqcdn.com DigiCert SHA2 Secure Server CA |
2022-02-27 - 2023-02-28 |
a year | crt.sh |
*.intelliad.de Thawte RSA CA 2018 |
2022-09-02 - 2023-09-02 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-08-29 - 2022-11-21 |
3 months | crt.sh |
*.wt-safetag.com Sectigo RSA Domain Validation Secure Server CA |
2020-08-17 - 2022-11-19 |
2 years | crt.sh |
*.wbtrk.net Sectigo RSA Domain Validation Secure Server CA |
2022-01-17 - 2023-01-22 |
a year | crt.sh |
pix.telekom.de TeleSec ServerPass Class 2 CA |
2022-07-13 - 2023-07-17 |
a year | crt.sh |
www.googleadservices.com GTS CA 1C3 |
2022-08-29 - 2022-11-21 |
3 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2022-06-28 - 2022-09-26 |
3 months | crt.sh |
*.xplosion.de R3 |
2022-07-30 - 2022-10-28 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2022-08-29 - 2022-11-21 |
3 months | crt.sh |
www.telekom.de TeleSec ServerPass Class 2 CA |
2022-08-02 - 2023-08-06 |
a year | crt.sh |
*.google.com GTS CA 1C3 |
2022-08-29 - 2022-11-21 |
3 months | crt.sh |
*.google.nl GTS CA 1C3 |
2022-08-29 - 2022-11-21 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://costaricaretireonss.com/wp-content/themes/dir/
Frame ID: FA2C3C3EDC137FFCEC67A5AE90AFD366
Requests: 16 HTTP requests in this frame
Frame:
https://costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking.htm
Frame ID: 09AF27283359906629FA0255175DDB20
Requests: 60 HTTP requests in this frame
Frame:
https://costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ls.htm
Frame ID: BD12A5CEEBD605C3B92493E7594CAA91
Requests: 1 HTTP requests in this frame
Frame:
https://ssl.xplosion.de/profiler.html?customer=telekom.de.unterwegs&event_id=shop_visit&shop_id=www.telekom.de.privatkunden.&shop_trackingproducts=
Frame ID: DCB1F52BC441C38433E7C7AE4AD0ED7F
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/ff4c5bbd-e576-4d0e-86fa-f527ffb414d8.png)
Page Title
Telekom LoginDetected technologies
![](/vendor/wappa/icons/Intershop.png)
Detected patterns
- (?:is-bin|INTERSHOP)
Detected patterns
- /wp-(?:content|includes)/
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 38- https://googleads.g.doubleclick.net/pagead/viewthroughconversion/947828095/?value=0&guid=ON&script=0&data=pagetype=authentication.login;pageid=www.telekom.de.privatkunden.;prodid=;prodname=;status=&_rnd=0.8685060121570536 HTTP 302
- https://www.google.com/pagead/1p-user-list/947828095/?value=0&guid=ON&script=0&data=pagetype=authentication.login;pageid=www.telekom.de.privatkunden.;prodid=;prodname=;status=&is_vtc=1&random=1021410390 HTTP 302
- https://www.google.nl/pagead/1p-user-list/947828095/?value=0&guid=ON&script=0&data=pagetype=authentication.login;pageid=www.telekom.de.privatkunden.;prodid=;prodname=;status=&is_vtc=1&random=1021410390&ipr=y
- https://track.adform.net/serving/scripts/trackpoint/async/ HTTP 301
- https://s2.adform.net/banners/scripts/st/trackpoint-async.js
- https://track.adform.net/Serving/TrackPoint/?pm=120050&lid=3130201&ord=775754030398&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&itm=eyJzdjIiOiJ3d3cudGVsZWtvbS5kZSIsInN2MTAiOiJwcml2YXRrdW5kZW4iLCJzdjEyIjoiYXV0aGVudGljYXRpb24ubG9naW4iLCJzdjQwIjoibm9wcm9kdWN0cyIsInN2OTYiOiJwaG9lbml4Iiwic3YxIjoid3d3LnRlbGVrb20uZGUlN0Nwcml2YXRrdW5kZW4lN0MifQ&loc=https%3A%2F%2Fcostaricaretireonss.com%2Fwp-content%2Fthemes%2Fdir%2FTelekom%2520Login_files%2Fphoenix_login_tracking. HTTP 302
- https://track.adform.net/Serving/TrackPoint/?CC=1&pm=120050&lid=3130201&ord=775754030398&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&itm=eyJzdjIiOiJ3d3cudGVsZWtvbS5kZSIsInN2MTAiOiJwcml2YXRrdW5kZW4iLCJzdjEyIjoiYXV0aGVudGljYXRpb24ubG9naW4iLCJzdjQwIjoibm9wcm9kdWN0cyIsInN2OTYiOiJwaG9lbml4Iiwic3YxIjoid3d3LnRlbGVrb20uZGUlN0Nwcml2YXRrdW5kZW4lN0MifQ&loc=https%3A%2F%2Fcostaricaretireonss.com%2Fwp-content%2Fthemes%2Fdir%2FTelekom%2520Login_files%2Fphoenix_login_tracking.
- https://pix.telekom.de/423493631852538/cc?a=r&c=wteid_423493631852538&t=https%3A%2F%2Ffbc.wcfbc.net%2Fv1%2Ffbc%3Fp%3D441%2C0%26acc%3D423493631852538%26t%3D1663599792359%26err%3D HTTP 301
- https://fbc.wcfbc.net/v1/fbc?p=441,0&acc=423493631852538&t=1663599792359&err=&c=wteid_423493631852538&v=4166359979200757177 HTTP 307
- https://fbc.wcfbc.net/v1/fbc?p=441,0&acc=423493631852538&t=1663599792359&err=&c=wteid_423493631852538&v=4166359979200757177&rc
81 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
costaricaretireonss.com/wp-content/themes/dir/ |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
components.css
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/ |
96 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/ |
85 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
components.js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/ |
76 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/ |
12 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Screenshot-8.jpg
i.ibb.co/DfzDgmX/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
phoenix_login_tracking.htm
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/ Frame 09AF |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
data_protection.svg
costaricaretireonss.com/wp-content/themes/dir/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
telegroteskscreen-bold.woff
costaricaretireonss.com/wp-content/themes/dir/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
telegroteskscreen-thin.woff
costaricaretireonss.com/wp-content/themes/dir/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
telegroteskscreen-regular.woff
costaricaretireonss.com/wp-content/themes/dir/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
teleicon-ui.woff
costaricaretireonss.com/wp-content/themes/dir/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
teleicon-ui.ttf
costaricaretireonss.com/wp-content/themes/dir/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
telegroteskscreen-bold.ttf
costaricaretireonss.com/wp-content/themes/dir/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
telegroteskscreen-thin.ttf
costaricaretireonss.com/wp-content/themes/dir/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
conversion_async.js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
23 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
196380495960676
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
49 KB 50 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
a_002
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
92 B 607 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag.js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
96 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag_004.js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
88 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag_003.js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
onsite.js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
127 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
91 KB 91 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
a
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utag_002.js
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame 09AF |
104 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
telegroteskscreen-regular.ttf
costaricaretireonss.com/wp-content/themes/dir/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ls.htm
costaricaretireonss.com/wp-content/themes/dir/Telekom%20Login_files/phoenix_login_tracking_data/ Frame BD12 |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
track.adform.net/Serving/Cookie/ Frame 09AF |
73 B 495 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.12.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
11 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.40.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
11 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.55.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.37.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
9 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.101.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
16 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.120.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
15 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.125.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
15 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.126.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
15 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.137.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
6 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.151.js
tags-eu.tiqcdn.com/utag/telekom/phoenix/prod/ Frame 09AF |
18 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.nl/pagead/1p-user-list/947828095/ Frame 09AF Redirect Chain
|
42 B 548 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hfpc.min.js
t13.intelliad.de/ Frame 09AF |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ Frame 09AF |
116 KB 46 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
196380495960676
responder.wt-safetag.com/resp/api/get/ Frame 09AF |
0 230 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
geid.min.js
cdn.wbtrk.net/js/ Frame 09AF |
1 KB 959 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wt
pix.telekom.de/865234457892410/ Frame 09AF |
43 B 692 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
crossdevice.php
t23.intelliad.de/ Frame 09AF |
125 B 573 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conversion_async.js
www.googleadservices.com/pagead/ Frame 09AF |
41 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ Frame 09AF |
101 KB 27 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
profiler.html
ssl.xplosion.de/ Frame DCB1 |
176 B 619 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cc
geid.wbtrk.net/ Frame 09AF |
2 B 441 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
trackpoint-async.js
s2.adform.net/banners/scripts/st/ Frame 09AF Redirect Chain
|
81 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cc
geid.wbtrk.net/ Frame 09AF |
2 B 222 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1703416313287473
connect.facebook.net/signals/config/ Frame 09AF |
293 KB 84 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
ssl.xplosion.de/scripts/ Frame DCB1 |
24 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6393536373136323131303.js
t13.intelliad.de/cl/ Frame 09AF |
26 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telekom.de.unterwegs.config.jsonp
ssl.xplosion.de/config/ Frame DCB1 |
713 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1001948399/ Frame 09AF |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnc.php
t23.intelliad.de/ Frame 09AF |
43 B 605 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mct.php
t23.intelliad.de/ Frame 09AF |
43 B 605 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sidebar_min.css
www.telekom.de/is-bin/INTERSHOP.static/WFS/EKI-TELEKOM-Site/EKI-TELEKOM/-/functions/sidebar-dev/ Frame 09AF |
73 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sidebar_min.css
www.telekom.de/is-bin/INTERSHOP.static/WFS/EKI-TELEKOM-Site/EKI-TELEKOM/-/functions/sidebar-dev/ Frame 09AF |
63 KB 63 KB |
Image
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
xups.xplosion.de/ Frame DCB1 |
4 B 492 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
254127818673288
connect.facebook.net/signals/config/ Frame 09AF |
293 KB 84 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ Frame 09AF |
44 B 297 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ Frame 09AF |
44 B 101 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ Frame 09AF |
44 B 101 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ Frame 09AF |
44 B 101 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
track.adform.net/Serving/TrackPoint/ Frame 09AF Redirect Chain
|
42 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.google.com/pagead/1p-user-list/1001948399/ Frame 09AF |
42 B 64 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.google.nl/pagead/1p-user-list/1001948399/ Frame 09AF |
42 B 64 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sidebar_min.js
www.telekom.de/is-bin/INTERSHOP.static/WFS/EKI-TELEKOM-Site/EKI-TELEKOM/-/functions/sidebar-dev/ Frame 09AF |
132 KB 58 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wt
pix.telekom.de/423493631852538/ Frame 09AF |
43 B 291 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
track.adform.net/Serving/TrackPoint/ Frame 09AF |
139 B 618 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbc
fbc.wcfbc.net/v1/ Frame 09AF Redirect Chain
|
69 B 128 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.v.js
tags-eu.tiqcdn.com/utag/tiqapp/ Frame 09AF |
2 B 180 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cc
pix.telekom.de/423493631852538/ Frame 09AF |
160 B 308 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
usersync
uss.xplosion.de/ Frame 09AF |
42 B 664 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cc
geid.wbtrk.net/ Frame 09AF |
34 B 161 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cc
geid.wbtrk.net/ Frame 09AF |
34 B 149 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.facebook.com/tr/ Frame 09AF |
44 B 88 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.facebook.com/tr/ Frame 09AF |
44 B 91 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation boolean| accountLocked boolean| accountLockedPermanent number| accountLockExpiration boolean| loginFailed function| $ function| jQuery object| Login28 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
pix.telekom.de/865234457892410 | Name: wteid_865234457892410 Value: 4166359979100553075 |
|
pix.telekom.de/865234457892410 | Name: wtsid_865234457892410 Value: 1 |
|
pix.telekom.de/423493631852538 | Name: wteid_423493631852538 Value: 4166359979200757177 |
|
pix.telekom.de/423493631852538 | Name: wtsid_423493631852538 Value: 1 |
|
.costaricaretireonss.com/ | Name: CONSENTMGR Value: c1:1%7Cc2:1%7Cc3:1%7Cc4:1%7Cc5:1%7Cc6:1%7Cc7:1%7Cc8:1%7Cc9:1%7Cc10:1%7Cc11:1%7Cc12:1%7Cc13:1%7Cc14:1%7Cc15:1%7Cts:1663599791013%7Cconsent:true |
|
.costaricaretireonss.com/ | Name: utag_main Value: v_id:018356464ba60072a046ac13b84803074006606c00b08$_sn:1$_ss:1$_st:1663601591015$ses_id:1663599791015%3Bexp-session$_pn:1%3Bexp-session |
|
.costaricaretireonss.com/ | Name: first_encounter Value: 1 |
|
.costaricaretireonss.com/ | Name: wt_cdbeid Value: 1 |
|
.costaricaretireonss.com/ | Name: _gcl_au Value: 1.1.214478741.1663599792 |
|
pix.telekom.de/ | Name: wt_nbg_Q3 Value: !OyBgSeole/ojNC27MOh2eXQWYSomxsWcbnopHhlAg46zyhORK4mSau/4Dft/hH/bFR+d5bpmciMo4g== |
|
.t23.intelliad.de/ | Name: iact Value: 000113BDADAD30758B0E82035FB3CC434849 |
|
costaricaretireonss.com/ | Name: ia-6393536373136323131303 Value: XD:N4RILTgh+if7zU6RHccwZur0/W+3l6A4ZY4Za1eEeQI8lapz0xpLI6bFOPHk4QWeyjtNxBCKyg+2mXh7Yp5c/hea0OMrm1BwvrELTKXYmc4= |
|
geid.wbtrk.net/ | Name: wt_nbg_Q3 Value: !hbNhO2qPRRGP7+TpjGYh4zwSUbWZoLaFjBmkYsdOOv8IL4kztrdIxf/tpqLAmX+2TG1yxHDUnrjMIg== |
|
costaricaretireonss.com/ | Name: ia_bncl_6393536373136323131303 Value: 0.5032523894270151%201663599792%201663599792%200%200 |
|
.t23.intelliad.de/ | Name: iactxd_42882 Value: 000113BDADAD30758B0E82035FB3CC434849 |
|
.costaricaretireonss.com/ | Name: _fbp Value: fb.1.1663599791953.1194820192 |
|
.doubleclick.net/ | Name: IDE Value: AHWqTUm9HkyMzOzeOjTs9wPC4sUhCV9w--mG_X8zOyqsRNTCkCUTnwKYac13YF9S |
|
.xplosion.de/ | Name: pid Value: BSwCBsaZESRZBSb3Wsw0EiRkWs7CBDwkBSfABifABifABfrr |
|
.xplosion.de/ | Name: pid_short Value: 5qcO5SuCRSjAxFWj6OW2xiy2__rr |
|
.xplosion.de/ | Name: pid_signature Value: Hd7ZBiUFwqBCwsRsWqwFWs_CWDjlWsfZWS5IWi7ABqyIBDJ8Bd_ABArr |
|
.adform.net/ | Name: C Value: 1 |
|
.adform.net/ | Name: uid Value: 3414922338052956941 |
|
.wcfbc.net/ | Name: wt_cdbeid Value: 8a0a483a2c833d84ba69e85225b7dc49 |
|
.costaricaretireonss.com/ | Name: wt3_eid Value: %3B423493631852538%7C4166359979200757177 |
|
.costaricaretireonss.com/ | Name: wt_cookiecontrol Value: 1 |
|
.costaricaretireonss.com/ | Name: wt_rla Value: 865234457892410%2C1%2C1663599791509%3B423493631852538%2C3%2C1663599792038 |
|
.xplosion.de/ | Name: ep Value: YyiEsMyREV6SW5DIO-_Z |
|
.costaricaretireonss.com/ | Name: wt_geid Value: 68934a3e9455fa72420237eb |
14 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.wbtrk.net
connect.facebook.net
costaricaretireonss.com
fbc.wcfbc.net
geid.wbtrk.net
googleads.g.doubleclick.net
i.ibb.co
pix.telekom.de
responder.wt-safetag.com
s2.adform.net
ssl.xplosion.de
t13.intelliad.de
t23.intelliad.de
tags-eu.tiqcdn.com
track.adform.net
uss.xplosion.de
www.facebook.com
www.google.com
www.google.nl
www.googleadservices.com
www.googletagmanager.com
www.telekom.de
xups.xplosion.de
104.111.215.143
142.250.185.98
185.54.150.115
185.54.150.123
185.54.150.22
185.54.150.52
185.54.150.79
2600:9000:214f:c600:7:2732:be80:93a1
2a00:1450:4001:80b::2002
2a00:1450:4001:810::2004
2a00:1450:4001:812::2008
2a00:1450:4001:82b::2003
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f107:83:face:b00c:0:25de
2a06:98c1:3120::c
3.248.103.16
3.71.168.227
34.242.116.104
37.157.2.237
37.157.2.249
51.210.32.103
52.58.27.30
80.158.67.40
0160833250f888a24fda0fc62b1a091dcd975c910f84b8754b5cc1bde644e149
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
12dd26d92febfda94104e8e6e1fae56a700dde48ee46d557538497d15de1e6cb
14382ccce783715cd78910b3b74ca0863367c01b6923b137d598e3c7a1f5900f
1a96d30a100b47d5e1e1aa27005d349a1138871aafbd0c7f615741007e8473ce
2780be4293bd393b54fb765c8ec205363800aa0daa2e8f75e8fe6dc3ccbe8ccc
29a0146cd582489b149595e14b33fbbf41cf2ddb761b2f2ef60d0bd3d3e7517d
306f2ebde2a8145229dd48225e00d99fecb7dc729b4cfc0b4fa15c21ddcede29
40f12df8ac1275dc47e45c4286652edad140acdcf82db35c82840134b53d80df
42cd8c654da6bc525e0af88cf50384e1dc44e9ed97962f20a652c3c191a1eb26
42d274b3c3f7c6565c2f3cc9b009770f143ceca121b91bc25f844f7040f18c94
43d5062c71b15a64799eb2428ac313f92af2be89a905469946aa45192407b038
484ea4f4d5ed51367f4e173e81b800343aed32334af8bd6df57a64f76f917162
4ab3e6719513e071caf669acd89fb8b819a0e9aead9bffb8ce340224f5c6ed54
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5551e5d205435786101eed90dbef5731d891fb7f14b558e8146acab938b7ec3d
5a46ae9b04fdb63d5a7132ebb1678c262d5470f74ec18d3a7e4f96de96c5b805
5bb09b27436ec99c084d4a7c1a555fc0f302081704b1e2eb20617dc522bda1cb
5c2b63b6a04bea042f33716a5ec7692e1cf3154f660b7e4423e5d185211810d6
5d9e8cfd13ab9f3cb184ee716c93c4c007837b001ab17f762269a64b2d8958cc
5e0a336c4dd2f591c67eb9067c1b90d93d70a091b0723f3728be497db48664b6
5ef468e6b28f8232ff6dc2b54f48a016be6b2776a27b7e5191ab71393637dc57
609a8ecef2bee9ffaf0da9bfdaafc0246ab2656c4869f11e96130cf56942ab9e
62610c7225cf2c75c8c2c9e0a6ac9145a33b557f08da9429995d2b414ab933f3
63e3696c5e5e8b037e28e8fbef871184b0d1d60a7314c965b1426d9cce84dd69
6b59459f7ef5e38feccabfee137052674538b59b60ea869db1e8318a6c0387dc
6c179f21e6f62b629055d8ab40f454ed02e48b68563913473b857d3638e23b28
6d0d8621173b58a3431981207a529619a69b8ce1941cbb3dd0426fe13f668ed9
7bcbe327243628310e84027b85bca98a20d208f66f64685d979c6ccfa587d2d2
844bfb2ff3311ad9b5611b51d8c72e0c483a8ceafe7c625a5c321637f9277399
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8c38bcebdeb39314df096a73d8d898029c59993071e4b8a1650d1dd9fd4466b2
8e7dd30fa424475486000787392372f06cf8ec1882c749a5a818fd6624b1dc37
905d2b3a1d589f9c58199ad5e1183399c62048a619d2278f274829aa54252613
944a7def70eb7737d284bd226db6bec65d5b98da215d28ff680468273998d848
96abded29d7f33d0939bd257815ad1828604f9d5d0d3057c489f1afff0612b06
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a7fb7ea7ac5d4073f1505391c735942e45e6be306696bd3572e9e53dc291848b
aab0aa8c696ed5060433943cb05ee7d043d38b09e4620f77007f48844af240cc
ab2c778685ffddd1e0933e57fc864729fa8cb7921a3783d6546285c3e357aabc
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
b928e4bff00195d50132fbd2eb4e09aed0b5d3e4ae50f58d1d48f78ad80f72d4
b95aa3f47aa13e07f6874689ff02c2a7757bd71dd61177c9ebbb55508fc7bb7d
b9f56a894575e0ee1b3c6ecd875724806f9090a86dc38a62b600f7e1a8e6b3ea
c1a69853198ae592f980806d6d489f43d03ee49f60df58b32ad375c03127703a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d7cc3389c6e9b2eacd26e9bd8c0ce27e8cb1f665ee620f9c13500f6eb812585e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4f06e1e6f9a75c292bae9623c46adfd265be893bd19869f90559776b4cf08b6
eaeb24bc549357402c7acf7ae8e52d0ec65ad132f0ee1fa40d59d23e8b25ff8a
ee94251fea8b03da5d0dc6f8489a529c1a2d2a031d874b0ec61866784e3c73c3
eefcfc1305138f6f58526af6d51a1a8ff86658dc09b93caef33a382017dd0adf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f410c489fe29c824fb79a74cdd9981740d0167b0dd4c3d392561d27c043e259e
f7c9a6a063bebf358281210d89deab95b3664efdaa7221d33003e76bb819481a
f88e6b79e5cbd5c5bd0fc64b7747e35ab0f9d28d737482dcebec962e241bf43e
f9ded5934212189b61777ae3bc3fc776dab5f9e438f85d239d7b2ede571e21e5
fc76360c70e8389fdd38e99d5c153c9d88b86569b3f42c40062f1c51ed85b336