api.id.me
Open in
urlscan Pro
2a02:26f0:6c00::210:ba9b
Malicious Activity!
Public Scan
Effective URL: https://api.id.me/en/session/new
Submission: On April 09 via manual from US — Scanned from IT
Summary
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on January 27th 2022. Valid for: 9 months.
This is the only time api.id.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: IRS (Government)Domain & IP information
ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-240-39.eu-west-1.compute.amazonaws.com
click.pstmrk.it |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN16509 (AMAZON-02, US)
static.chartbeat.com |
ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-36.dus51.r.cloudfront.net
static.queue-it.net |
ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
idme-production.s3.amazonaws.com |
ASN16509 (AMAZON-02, US)
d21y75miwcfqoq.cloudfront.net |
ASN16509 (AMAZON-02, US)
PTR: ae8af9489dcf8bb01.awsglobalaccelerator.com
tls-use1.fpapi.io |
ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-15.dus51.r.cloudfront.net
assets.queue-it.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-130-14.us-west-2.compute.amazonaws.com
wait.id.me |
ASN19551 (INCAPSULA, US)
PTR: 107.154.251.104.ip.incapdns.net
globalsiteanalytics.com |
ASN16509 (AMAZON-02, US)
PTR: a9a7b0e2063eae3b2.awsglobalaccelerator.com
device.id.me |
ASN14618 (AMAZON-AES, US)
PTR: ec2-44-193-158-234.compute-1.amazonaws.com
ping.chartbeat.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
26 |
id.me
api.id.me — Cisco Umbrella Rank: 40614 wait.id.me — Cisco Umbrella Rank: 62142 device.id.me — Cisco Umbrella Rank: 50561 |
726 KB |
7 |
zdassets.com
static.zdassets.com — Cisco Umbrella Rank: 2110 ekr.zdassets.com — Cisco Umbrella Rank: 2348 |
377 KB |
4 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 37 |
40 KB |
3 |
zendesk.com
idmeidentity.zendesk.com — Cisco Umbrella Rank: 60749 |
2 KB |
3 |
queue-it.net
static.queue-it.net — Cisco Umbrella Rank: 13525 assets.queue-it.net — Cisco Umbrella Rank: 12464 |
12 KB |
3 |
go-mpulse.net
s.go-mpulse.net — Cisco Umbrella Rank: 1272 c.go-mpulse.net — Cisco Umbrella Rank: 558 |
99 KB |
2 |
globalsiteanalytics.com
globalsiteanalytics.com — Cisco Umbrella Rank: 24771 |
3 KB |
2 |
googleapis.com
maps.googleapis.com — Cisco Umbrella Rank: 338 |
55 KB |
2 |
chartbeat.com
static.chartbeat.com — Cisco Umbrella Rank: 1216 |
29 KB |
2 |
newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 380 |
35 KB |
1 |
fpapi.io
tls-use1.fpapi.io — Cisco Umbrella Rank: 25113 |
331 B |
1 |
cloudfront.net
d21y75miwcfqoq.cloudfront.net |
436 B |
1 |
amazonaws.com
idme-production.s3.amazonaws.com — Cisco Umbrella Rank: 78650 |
15 KB |
1 |
chartbeat.net
ping.chartbeat.net — Cisco Umbrella Rank: 1170 Failed |
201 B |
1 |
nr-data.net
bam-cell.nr-data.net — Cisco Umbrella Rank: 354 Failed |
720 B |
1 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 95 |
437 B |
1 |
pstmrk.it
1 redirects
click.pstmrk.it — Cisco Umbrella Rank: 49353 |
445 B |
0 |
google.it
Failed
www.google.it Failed |
|
0 |
google.com
Failed
www.google.com Failed |
|
66 | 19 |
Domain | Requested by | |
---|---|---|
24 | api.id.me |
api.id.me
|
6 | static.zdassets.com |
api.id.me
static.zdassets.com |
4 | www.google-analytics.com |
api.id.me
|
3 | idmeidentity.zendesk.com |
static.zdassets.com
|
2 | globalsiteanalytics.com |
api.id.me
|
2 | maps.googleapis.com |
api.id.me
|
2 | static.queue-it.net |
api.id.me
|
2 | static.chartbeat.com |
api.id.me
|
2 | js-agent.newrelic.com |
api.id.me
|
2 | s.go-mpulse.net |
api.id.me
|
1 | device.id.me |
api.id.me
|
1 | ekr.zdassets.com |
api.id.me
|
1 | wait.id.me |
api.id.me
|
1 | assets.queue-it.net |
api.id.me
|
1 | tls-use1.fpapi.io |
api.id.me
|
1 | d21y75miwcfqoq.cloudfront.net |
api.id.me
|
1 | idme-production.s3.amazonaws.com |
api.id.me
|
1 | ping.chartbeat.net | |
1 | bam-cell.nr-data.net |
api.id.me
js-agent.newrelic.com |
1 | c.go-mpulse.net |
api.id.me
|
1 | stats.g.doubleclick.net |
api.id.me
|
1 | click.pstmrk.it | 1 redirects |
0 | www.google.it Failed | |
0 | www.google.com Failed | |
66 | 24 |
Subject Issuer | Validity | Valid | |
---|---|---|---|
id.me DigiCert SHA2 Extended Validation Server CA |
2022-01-27 - 2022-10-20 |
9 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-03-21 - 2022-06-13 |
3 months | crt.sh |
akstat.io DigiCert SHA2 Secure Server CA |
2021-06-08 - 2022-06-13 |
a year | crt.sh |
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA H2 2021 |
2021-10-06 - 2022-11-07 |
a year | crt.sh |
*.chartbeat.com Thawte RSA CA 2018 |
2021-05-20 - 2022-06-03 |
a year | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2022-03-21 - 2022-06-13 |
3 months | crt.sh |
*.queue-it.net Amazon |
2021-08-26 - 2022-09-24 |
a year | crt.sh |
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2021-12-13 - 2022-12-13 |
a year | crt.sh |
*.cloudfront.net Amazon |
2022-02-01 - 2023-01-31 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-03-21 - 2022-06-13 |
3 months | crt.sh |
tls-use1.fpapi.io R3 |
2022-02-12 - 2022-05-13 |
3 months | crt.sh |
sslcertificate2.queue-it.net Amazon |
2021-09-07 - 2022-10-06 |
a year | crt.sh |
ssl1036557.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2021-07-08 - 2022-07-07 |
a year | crt.sh |
imperva.com GlobalSign Atlas R3 DV TLS CA 2022 Q1 |
2022-04-01 - 2022-09-30 |
6 months | crt.sh |
device.idmelabs.com Amazon |
2021-05-13 - 2022-06-11 |
a year | crt.sh |
idmeidentity.zendesk.com Cloudflare Inc ECC CA-3 |
2021-05-31 - 2022-05-30 |
a year | crt.sh |
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1 |
2022-01-10 - 2023-02-10 |
a year | crt.sh |
*.chartbeat.net Thawte RSA CA 2018 |
2021-12-01 - 2022-12-30 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://api.id.me/en/session/new
Frame ID: 48D3CBDA2C9F4CA339BABE9F93D11AFC
Requests: 58 HTTP requests in this frame
Frame:
https://static.zdassets.com/web_widget/latest/web-widget-framework-b7310ce58dcedc03b05e.js
Frame ID: 2A3E2DE7A7835E0B42FF32106E7CFE55
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Sign in to ID.me - ID.mePage URL History Show full URLs
-
https://click.pstmrk.it/2sm/api.id.me%2Foauth%2Fauthorize%3Fclient_id%3Da255e650b9a8194b0264468854b5...
HTTP 302
https://api.id.me/oauth/authorize?client_id=a255e650b9a8194b0264468854b57b41&nonce=Zn7VaRZg7rL... Page URL
- https://api.id.me/en/session/new Page URL
Detected technologies
Google Maps (Maps) ExpandDetected patterns
- //maps\.google(?:apis)?\.com/maps/api/js
Akamai Bot Manager (Security) Expand
Detected patterns
Chartbeat (Analytics) Expand
Detected patterns
- chartbeat\.js
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: What is ID.me?
Search URL Search Domain Scan URL
Title: Terms of Service
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://click.pstmrk.it/2sm/api.id.me%2Foauth%2Fauthorize%3Fclient_id%3Da255e650b9a8194b0264468854b57b41%26nonce%3DZn7VaRZg7rL2AMPqONyMiVA95%252Bz%252FqJsNq7NFgvabS3A%253D%26redirect_uri%3Dhttps%253A%252F%252Fsa.www4.irs.gov%252Fsadiapi%252Foidc%252Ftkngen%26response_type%3Dcode%26scope%3Dhttp%253A%252F%252Fidmanagement.gov%252Fns%252Fassurance%252Fial%252F2%252Faal%252F2%2Bopenid%26state%3DTID%253Dc959154c-7853-4933-a2af-b1eb71dfe9f9PARM_DELIMOT%253DLVNNLWh0dHAlM2ElMmYlMmZzYSUyZXd3dzQlMmVpcnMlMmVnb3YlMmZvbGElMmY%253DPARM_DELIMCSPSELECT%253DidmeprodPARM_DELIMSRCIP%253D206.213.251.31/dyYD7CsN/weg/3VgKqPwCZo/aXZhLnZlcmlmaWNhdGlvbi5yZWVuZ2FnZQ
HTTP 302
https://api.id.me/oauth/authorize?client_id=a255e650b9a8194b0264468854b57b41&nonce=Zn7VaRZg7rL2AMPqONyMiVA95%2Bz%2FqJsNq7NFgvabS3A%3D&redirect_uri=https%3A%2F%2Fsa.www4.irs.gov%2Fsadiapi%2Foidc%2Ftkngen&response_type=code&scope=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F2%2Faal%2F2+openid&state=TID%3Dc959154c-7853-4933-a2af-b1eb71dfe9f9PARM_DELIMOT%3DLVNNLWh0dHAlM2ElMmYlMmZzYSUyZXd3dzQlMmVpcnMlMmVnb3YlMmZvbGElMmY%3DPARM_DELIMCSPSELECT%3DidmeprodPARM_DELIMSRCIP%3D206.213.251.31 Page URL
- https://api.id.me/en/session/new Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://click.pstmrk.it/2sm/api.id.me%2Foauth%2Fauthorize%3Fclient_id%3Da255e650b9a8194b0264468854b57b41%26nonce%3DZn7VaRZg7rL2AMPqONyMiVA95%252Bz%252FqJsNq7NFgvabS3A%253D%26redirect_uri%3Dhttps%253A%252F%252Fsa.www4.irs.gov%252Fsadiapi%252Foidc%252Ftkngen%26response_type%3Dcode%26scope%3Dhttp%253A%252F%252Fidmanagement.gov%252Fns%252Fassurance%252Fial%252F2%252Faal%252F2%2Bopenid%26state%3DTID%253Dc959154c-7853-4933-a2af-b1eb71dfe9f9PARM_DELIMOT%253DLVNNLWh0dHAlM2ElMmYlMmZzYSUyZXd3dzQlMmVpcnMlMmVnb3YlMmZvbGElMmY%253DPARM_DELIMCSPSELECT%253DidmeprodPARM_DELIMSRCIP%253D206.213.251.31/dyYD7CsN/weg/3VgKqPwCZo/aXZhLnZlcmlmaWNhdGlvbi5yZWVuZ2FnZQ HTTP 302
- https://api.id.me/oauth/authorize?client_id=a255e650b9a8194b0264468854b57b41&nonce=Zn7VaRZg7rL2AMPqONyMiVA95%2Bz%2FqJsNq7NFgvabS3A%3D&redirect_uri=https%3A%2F%2Fsa.www4.irs.gov%2Fsadiapi%2Foidc%2Ftkngen&response_type=code&scope=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F2%2Faal%2F2+openid&state=TID%3Dc959154c-7853-4933-a2af-b1eb71dfe9f9PARM_DELIMOT%3DLVNNLWh0dHAlM2ElMmYlMmZzYSUyZXd3dzQlMmVpcnMlMmVnb3YlMmZvbGElMmY%3DPARM_DELIMCSPSELECT%3DidmeprodPARM_DELIMSRCIP%3D206.213.251.31
66 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
authorize
api.id.me/oauth/ Redirect Chain
|
40 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-cbd534242bbbd274274cef25e21b9508f9fa02c55aa5620ed7f380584ee2418c.css
api.id.me/assets/ |
159 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-da6f72148bad4c4037e015bf01d84c2245169c1146b55e69b4200b9862f1e424.js
api.id.me/assets/analytics/ |
474 B 529 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-a5c5e579dd6d0c7f5ce4b9a7eb5e319059de45a7b5c2cad60423a6324a0b2da7.js
api.id.me/assets/ |
732 KB 189 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chartbeat-9c03ab793d94f40664e96cc4dc78936326b3f32b224bb410b9b1119fd760a5a7.js
api.id.me/assets/analytics/ |
469 B 504 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GTDQ2-YPV4D-ZPN8M-VW3LM-H9A7G
s.go-mpulse.net/boomerang/ |
205 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
4 B 204 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-spa-1215.min.js
js-agent.newrelic.com/ |
47 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chartbeat.js
static.chartbeat.com/js/ |
36 KB 14 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
new
api.id.me/en/session/ |
45 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
4 B 437 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
config.json
c.go-mpulse.net/api/ |
51 B 323 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
24d93c7748
bam-cell.nr-data.net/1/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ping
ping.chartbeat.net/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ga-audiences
www.google.com/ads/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ga-audiences
www.google.it/ads/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
24d93c7748
bam-cell.nr-data.net/events/1/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
24d93c7748
bam-cell.nr-data.net/jserrors/1/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
device-2854bc02623bf14ff2e80dd02913907f92b5c8c4cc14944c4a805106be38c8f5.js
api.id.me/assets/analytics/ |
93 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-da6f72148bad4c4037e015bf01d84c2245169c1146b55e69b4200b9862f1e424.js
api.id.me/assets/analytics/ |
474 B 530 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
queueclient.min.js
static.queue-it.net/script/ |
13 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
queueconfigloader.min.js
static.queue-it.net/script/ |
24 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-cbd534242bbbd274274cef25e21b9508f9fa02c55aa5620ed7f380584ee2418c.css
api.id.me/assets/ |
159 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
idme-logo-3057e2be22d5d5f8ba5cbdbb0f115ec14f65c7aefcf0dfb2a85be35043ce3f90.svg
api.id.me/assets/logos/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-addition-fe8cd4237f377dfb69a77ba964e61124df3dfd2fa919f1bfdf7084520c97fd0e.svg
api.id.me/assets/icons/ |
714 B 617 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
large.png
idme-production.s3.amazonaws.com/applications/7134/ |
14 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chevron-blue-3b68e6589623265f7384f91db850d8cd4e842144ebd499b2dc5411a47eabdd87.svg
api.id.me/assets/icons/ |
836 B 651 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ff1f8948
d21y75miwcfqoq.cloudfront.net/ |
68 B 436 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
maps.googleapis.com/maps/api/ |
167 KB 55 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-a5c5e579dd6d0c7f5ce4b9a7eb5e319059de45a7b5c2cad60423a6324a0b2da7.js
api.id.me/assets/ |
732 KB 189 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chat-86bb64581fb2b49ce6097f4c4c18f16b7e4b9c129cb58a7f7be53a2fa3b86293.js
api.id.me/assets/zendesk/ |
509 B 560 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chartbeat-9c03ab793d94f40664e96cc4dc78936326b3f32b224bb410b9b1119fd760a5a7.js
api.id.me/assets/analytics/ |
469 B 504 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
tls-use1.fpapi.io/ |
204 B 331 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
queueclientConfig.js
assets.queue-it.net/idme/integrationconfig/javascript/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GTDQ2-YPV4D-ZPN8M-VW3LM-H9A7G
s.go-mpulse.net/boomerang/ |
205 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Poppins-Regular-849c718edde71e76ae38c89f93b10073e06b6b48d5368090b3e05a412f5b94f4.woff
api.id.me/assets/ |
67 KB 67 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
facebook-699a9e94a00fe999c23b3de33afaff3e581ffdb329bf719c07e45cd8ce32849e.svg
api.id.me/assets/icons/login/ |
1 KB 747 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-2f9473688802a70a829e6fed5c070d58c1dbaf85539868c036939e22f43ebe5b.svg
api.id.me/assets/icons/login/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
linkedin-97e6d129799352c35ec1bab214e036a3a03db27c2ba59b14790f1facdd988d44.svg
api.id.me/assets/icons/login/ |
2 KB 977 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
down-4643437afa880c3628561c0cc061d5296a994835298cebcdab0cef26484972ca.svg
api.id.me/assets/icons/ |
663 B 576 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Poppins-SemiBold-7d4187c3373ec4c000f03314ad24b93cacbddcf62b7bc32689ead9fd2ad574ec.woff
api.id.me/assets/ |
66 KB 67 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Semibold-98e308576c54531be8643d249d1daf2d2111252237210e733774cef1545da023.woff
api.id.me/assets/ |
14 KB 14 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Poppins-Medium-94ff9c11734ed5e68a5b736baea74adefff71364c2f605c0983c501606ce0080.woff
api.id.me/assets/ |
67 KB 67 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
www.google-analytics.com/j/ |
2 B 22 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1649547178813
wait.id.me/javascriptqueue/idme/prodapi/ |
355 B 869 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gen_204
maps.googleapis.com/maps/api/mapsjs/ |
3 B 45 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_composer.js
static.zdassets.com/ekr/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
resource.png
globalsiteanalytics.com/resource/ |
67 B 796 B |
XHR
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
hdim
globalsiteanalytics.com/service/ |
2 KB 2 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
65176a74-8b1f-41c2-9661-cf8fb6762a16
ekr.zdassets.com/compose/ |
323 B 969 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
device.id.me/ |
923 B 1 KB |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web-widget-framework-b7310ce58dcedc03b05e.js
static.zdassets.com/web_widget/latest/ Frame 2A3E |
212 KB 71 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
config
idmeidentity.zendesk.com/embeddable/ Frame 2A3E |
301 B 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-spa-1215.min.js
js-agent.newrelic.com/ |
47 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chartbeat.js
static.chartbeat.com/js/ |
36 KB 14 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
24d93c7748
bam-cell.nr-data.net/1/ |
49 B 720 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ping
ping.chartbeat.net/ |
43 B 201 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
resource.png
api.id.me/en/device/ |
0 590 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web-widget-classic-640b011.js
static.zdassets.com/web_widget/latest/classic/ Frame 2A3E |
13 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web-widget-1561-640b011.js
static.zdassets.com/web_widget/latest/classic/ Frame 2A3E |
608 KB 184 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web-widget-4794-640b011.js
static.zdassets.com/web_widget/latest/classic/ Frame 2A3E |
463 KB 104 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
embeddable_blip
idmeidentity.zendesk.com/ Frame 2A3E |
0 493 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
it-it-json-640b011.js
static.zdassets.com/web_widget/latest/classic/web-widget-locales/classic/ Frame 2A3E |
27 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
embeddable_blip
idmeidentity.zendesk.com/ Frame 2A3E |
0 297 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- bam-cell.nr-data.net
- URL
- https://bam-cell.nr-data.net/1/24d93c7748?a=14700416&v=1215.1253ab8&to=cwwIRUdXWlgEQU0MUUUXDh5UTUJcDkELGVFECglfRhdeVQ9XDgY%3D&rst=1233&ck=1&ref=https://api.id.me/oauth/authorize&qt=1&ap=90&be=903&fe=1124&dc=1094&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1649547177047,%22n%22:0,%22f%22:236,%22dn%22:236,%22dne%22:465,%22c%22:465,%22s%22:503,%22ce%22:602,%22rq%22:602,%22rp%22:878,%22rpe%22:885,%22dl%22:882,%22di%22:1093,%22ds%22:1093,%22de%22:1094,%22dc%22:1124,%22l%22:1124,%22le%22:1125%7D,%22navigation%22:%7B%7D%7D&fp=983&fcp=983&jsonp=NREUM.setToken
- Domain
- ping.chartbeat.net
- URL
- https://ping.chartbeat.net/ping?h=api.id.me&p=%2Foauth%2Fauthorize%3Fclient_id%3Da255e650b9a8194b0264468854b57b41%26nonce%3DZn7VaRZg7rL2AMPqONyMiVA95%2Bz%252FqJsNq7NFgvabS3A%3D%26redirect_uri%3Dhttps%3A%252F%252Fsa.www4.irs.gov%252Fsadiapi%252Foidc%252Ftkngen%26response_type%3Dcode%26scope%3Dhttp%3A%252F%252Fidmanagement.gov%252Fns%252Fassurance%252Fial%252F2%252Faal%252F2%2Bopenid%26state%3DTID%3Dc959154c-7853-4933-a2af-b1eb71dfe9f9PARM_DELIMOT%3DLVNNLWh0dHAlM2ElMmYlMmZzYSUyZXd3dzQlMmVpcnMlMmVnb3YlMmZvbGElMmY%3DPARM_DELIMCSPSELECT%3DidmeprodPARM_DELIMSRCIP%3D206.213.251.31&u=BWMqNUCfzLolDM-wB0&d=api.id.me&g=24363&g0=No%20Section&g1=No%20Author&n=1&f=00001&c=0&x=0&m=0&y=1200&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=1124&t=BLQLTb3vXJfq943TCvsIbKpUbSI&V=129&i=Please%20wait...&tz=0&sn=1&sv=Cn6z09Nom8eC89n0hmu-IwDAA_82&sd=1&im=0e030403&_
- Domain
- www.google.com
- URL
- https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-40672673-1&cid=931484133.1649547178&jid=1964377942&_u=IEBAAEAAAAAAAC~&z=1709174593
- Domain
- www.google.it
- URL
- https://www.google.it/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-40672673-1&cid=931484133.1649547178&jid=1964377942&_u=IEBAAEAAAAAAAC~&z=1709174593
- Domain
- bam-cell.nr-data.net
- URL
- https://bam-cell.nr-data.net/events/1/24d93c7748?a=14700416&v=1215.1253ab8&to=cwwIRUdXWlgEQU0MUUUXDh5UTUJcDkELGVFECglfRhdeVQ9XDgY%3D&rst=1402&ck=1&ref=https://api.id.me/oauth/authorize
- Domain
- bam-cell.nr-data.net
- URL
- https://bam-cell.nr-data.net/jserrors/1/24d93c7748?a=14700416&v=1215.1253ab8&to=cwwIRUdXWlgEQU0MUUUXDh5UTUJcDkELGVFECglfRhdeVQ9XDgY%3D&rst=1403&ck=1&ref=https://api.id.me/oauth/authorize
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: IRS (Government)60 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails object| NREUM object| newrelic function| __nr_require number| _sf_startpt object| settings number| QUEUE_IDENTIFIER object| locales object| FingerprintJS string| GoogleAnalyticsObject function| ga object| QueueIt function| queueClient function| __extends object| en string| BOOMR_API_key object| BOOMR object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| BOOMR_check_doc_domain object| ErrorStackParser object| UserTimingCompression object| BOOMR_mq object| queueit_clientside_config object| queueit object| myQueueClient object| google object| module$exports$mapsapi$util$event object| module$contents$mapsapi$overlay$overlayView_OverlayView object| RetinaTag object| Mailcheck function| $ function| jQuery object| Select2 object| Base64URL object| IDme function| Inputmask object| intlTelInputGlobals object| intlTelInputUtils object| adx object| Binder object| I18n function| zEmbed function| zE number| _sf_endpt object| _sf_async_config object| zEWebpackACJsonp boolean| zEACLoaded number| BOOMR_onload object| _cb_shared object| pSUPERFLY_mab object| _cbq object| pSUPERFLY function| $zopim18 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
api.id.me/ | Name: _mkra_stck Value: 40ffd871eb45e7ec3045b5c377cee77a%3A1649547182.829334 |
|
.id.me/ | Name: idme-session Value: 8de1056854a251e9908d3fdf3f6ebe63 |
|
.api.id.me/ | Name: ak_bmsc Value: 4C8AFBFBC01CF3DA1053D54C0CA7EFCA~000000000000000000000000000000~YAAQl7oQAiKeJwGAAQAAt2+sEA8WQKaSdL5nk+4sZJQisQ6XTqloeMVJdQdNajQdifqFk/1LTVyoCdZquKODgSXsMcqNK+GnRZWEa6Se71Ky/UzDDp1ClH+7Al2pjUY7HwTUIbjhnuZwHa0tZkHZG6xF+2xTWrfLNprpTfAvY/1hxFP6hZUasqVFtL2zWiWVt633UqKxUBER64a9qcowNzxtwECZdzqvOm0fA5Qmv6JpXmN0DsWvu4uiLGMeWhlUly5iT8oglg0VZUQwzGolV6YeKCBkpu3h+tzSTkCroZFddu2l322vsKD2/Y5UzOuXolOywB4Q8F+CmaSDlBbVeH0zDtgq/ioOO8hwgRBmwCINsYL/8z9OB2B1zmMyzCrcgGK/fL6A2hpPUrjFT7E= |
|
.id.me/ | Name: _ga Value: GA1.2.931484133.1649547178 |
|
.id.me/ | Name: _gid Value: GA1.2.1688050787.1649547178 |
|
.id.me/ | Name: _gat Value: 1 |
|
api.id.me/ | Name: _cb_ls Value: 1 |
|
api.id.me/ | Name: _cb Value: BWMqNUCfzLolDM-wB0 |
|
api.id.me/ | Name: _cb_svref Value: null |
|
.api.id.me/ | Name: bm_sv Value: E7D1DFCBD2348A1824F681CA0F75F099~ZVYyQVmQh5raNJRPHoWdhu1+RTEBGO1Wreieohu8gZvhRg9vN3gW3DJqDzCGhB1iFTgpOZsdx3H2v9/93RwMtf2oC6m9tpn66EylB3I8LqHUAGX8d/U2XxJZkzU3cEZnoY5VT+Dqe1cJ7MeoYfDQcX5lAdCaUsM03ZSXAqbLsZ8= |
|
.api.id.me/ | Name: RT Value: "z=1&dm=api.id.me&si=e30a1a5a-3e92-4e15-acfb-9750e7d7f52a&ss=l1shsrpz&sl=1&tt=v9&rl=1" |
|
wait.id.me/ | Name: Queue-it-14b63d34-60a3-4454-9d14-dbcc3b5e5e5c Value: WasRedirected=false&i=637851439793196029 |
|
wait.id.me/ | Name: Queue-it Value: u=d3a77db3-8c48-48a8-909c-7ad284e39bc8 |
|
.id.me/ | Name: QueueITAccepted-SDFrts345E-V3_prodapi Value: EventId%3Dprodapi%26QueueId%3D14b63d34-60a3-4454-9d14-dbcc3b5e5e5c%26RedirectType%3Dsafetynet%26IssueTime%3D1649547179%26Hash%3D18cc387ddd4a48471657d27db00e098400bf7f10f0bde4fd59bee526f9d1855b |
|
api.id.me/ | Name: _chartbeat2 Value: .1649547178339.1649547179472.1.Cn6z09Nom8eC89n0hmu-IwDAA_82.2 |
|
.id.me/ | Name: _iidt Value: WEixtbZr/a69ZSvUEzyC3IuUT0pZTsa2hvKB/HEHytmerX7UCZ3e4axpYJSqOmKOU1vXTWIZUJiCEQ== |
|
.id.me/ | Name: _vid_t Value: SrrXk+L0fcKmcZmCxWZmyx4ucDo+LEQ890BB9mbilF2MbYuS1OmxBcA2gTIexsJnLSZ4lZAg3onVLA== |
|
.nr-data.net/ | Name: JSESSIONID Value: ace3af9a17a074e3 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors https://nextgenid-mbetenantworkflow.azurewebsites.net |
Strict-Transport-Security | max-age=15552000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | allow-from https://nextgenid-mbetenantworkflow.azurewebsites.net |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.id.me
assets.queue-it.net
bam-cell.nr-data.net
c.go-mpulse.net
click.pstmrk.it
d21y75miwcfqoq.cloudfront.net
device.id.me
ekr.zdassets.com
globalsiteanalytics.com
idme-production.s3.amazonaws.com
idmeidentity.zendesk.com
js-agent.newrelic.com
maps.googleapis.com
ping.chartbeat.net
s.go-mpulse.net
static.chartbeat.com
static.queue-it.net
static.zdassets.com
stats.g.doubleclick.net
tls-use1.fpapi.io
wait.id.me
www.google-analytics.com
www.google.com
www.google.it
bam-cell.nr-data.net
ping.chartbeat.net
www.google.com
www.google.it
104.16.51.111
104.18.72.113
107.154.251.104
108.157.4.36
13.248.196.115
151.101.2.137
162.247.243.147
18.66.248.15
2600:9000:2156:f400:1b:ef38:3680:21
2600:9000:2315:dc00:18:1fcd:34f:cdc1
2a00:1450:4001:811::200a
2a00:1450:4001:811::200e
2a00:1450:400c:c06::9d
2a02:26f0:6c00:287::11a6
2a02:26f0:6c00::210:ba9b
2a02:26f0:fb:1ad::11a6
35.71.172.36
44.193.158.234
52.19.240.39
52.216.140.116
52.88.130.14
01da5a84c2d9eca477df392c86ab0e2eb115cd74d9a320aed40b5614dd9d3f85
05ea38a4baec40609d074a1f75b6fb1644a6a43caa74c19e2067f82151300cc3
07dfb6f85698788704e3c2ce9eb5202189b7ef3e8c90d03455699152f3e24c9e
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
0f98697cb73a590684c4f80043924755d727067dbb5936aaf8e85ff0d670f414
10737a20653122a358d1eb32dbb940fb9b09e7721a3e669e502851c63cf05910
17593b668a8f0153d6a2e3e3ae65227b3cb852a32e5f75cd725035ac9c6ba927
28e5a7bc5703c00c8bc6fd0cfe45a3088e0a88a7862d206bb93f6cba655157ff
2cd165c92b3e1a6131d761c0513cd42cd6f2d8427b4a4ada3c1abffaf0844cdc
3336463552631f0491d50ff8c2fdc764fdf4f9e989793176baae53d4b40e669e
34a1043d57ffa3a2e3774e68e5fa59581e22bbe7d8ba40041845fc3fdbe5a8c0
42eac0480398aab3c3fd2c6bea45d030444e13eee1b1fac93c76ced6aa22bc9c
4dd24e0e88280b1a33f8e18e06f3262e6d3efb1a5d53cb8501812904531d467f
5d1fec6a1ea7b70ac7e6914e4ae259a8ce333026240093ff8a190c0699d71dc3
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
6dfdf411a70ae4d26942efdf1034e66976435758d29f2a7d556d77e08b9e2412
7157deb8ebe872e9ad11477112493ef6d3175123c43073bbbc81954295049f08
7741f73f12a392299269774e7bf0f9d5b0137f5facb9377ee756c0b96e334d88
7c71e88a96a6d1c5207fbaf7f75ac376d8df29e9e784cfa2a9f65ce1d06b77e4
7fcef1b48f6634aed24c7a1043bfbfe71da4ae287b160bade94b2a58862aa6db
85190119f624df960f19499320c14503f93e4c676ecb9fd1bca3abd8bc832203
869759a5f7714c0683c70833a79bd2664a5cedddb2716c6c7570fd050dae59d7
88287bf73c699b030a6dd9a581ca97d4771ef04bb699acec172629d25dc3b457
8f1d6d4cc75e4aa9496b424cd30b080acfdc983a42910afcd0069560cf2b11d4
937c7bd392e945cd2e1ee86cf47b357af016af281c2062d3249132c023f65f39
944ab414abd7379509535f0f7422544deaf2a4d19b9fbee4ef9bd1b6b02b3dcd
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a229e323ff491babb44e0a4bfde9dded15f70886c84b2e09e606552631cd71fa
a44ca05f13f5ec8c4f8afec41fd9e771289751c897c3e6460e6df8b7e5e92639
ad5fb58ad11730ef707d4f28db7a83ec4804bb3e8373dc69bedd94cd7a872efc
c47576302ee3e3045e7ab79fc4343b5316cd180d0ef46f1ce3a55d328bd7f5c3
c61deb474a21bfaff47f66bc3dd5ecf2e8af0b00890c38f18783219c901a370b
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0adb1f0c3640d439d2f0c41936b2c7010ebc02fbbb3d12a493f6d973367e9e6
d2517ba6157a5cbce327b70d01126185d536bcdef134b44731f65202bcd4e4b1
d9e10a520e956bec2a9372a988633eaab99299c3f504d6fb503d482364fc2070
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
dd2d8d288526b88b0eae53168e31b4092acf39ed38d40ffcbc6d0ab2f7a4aa66
e2c28f3e8b6a2e5170859e67cff3e8240e6b888d02005306ef3d2129f5cbd74c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb439f785d33858dfe7300098e5f38c7ebb471ccfe409dde80df79c90c11e5e9
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a
fd16c4d698cee310f33271b9520c1a24f275d0d8ffe0b6c4be5fe7322dd95a21
fde792a59b2d8c08de434b640bcc2a0f24ac77e88d905d63cb3415c67223a6a3
ff85ff0328c46981d85920f1075d4a3cb76b344f300c4f6b09beaca4d320567e