![](/screenshots/83750d50-160a-47f2-974c-efe701c90686.png)
securexx00cxsw.z13.web.core.windows.net
Open in
urlscan Pro
20.60.220.228
Malicious Activity!
Public Scan
Effective URL: https://securexx00cxsw.z13.web.core.windows.net/Win/index.html?phone=null
Submission: On August 14 via api from US — Scanned from CA
Summary
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 08 on April 4th 2024. Valid for: a year.
This is the only time securexx00cxsw.z13.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
securexx00cxsw.z13.web.core.windows.net |
ASN16276 (OVH, FR)
PTR: ns562109.ip-54-39-128.net
s4.histats.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-196-3-181.deploy.static.akamaitechnologies.com
pxdrop.lijit.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-223-60-98.us-east-2.compute.amazonaws.com
pd.sharethis.com |
ASN32748 (STEADFAST, US)
PTR: ip31.67-202-105.static.steadfastdns.net
ic.tynt.com | |
de.tynt.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-196-3-202.deploy.static.akamaitechnologies.com
t.sharethis.com |
ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-28.jfk50.r.cloudfront.net
tags.crwdcntrl.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-231-251-31.compute-1.amazonaws.com
ps.eyeota.net |
ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f2.1e100.net
cm.g.doubleclick.net |
ASN32748 (STEADFAST, US)
PTR: ip23.67-202-105.static.steadfastdns.net
dp2.33across.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-216-137-114.deploy.static.akamaitechnologies.com
tags.bluekai.com |
ASN32748 (STEADFAST, US)
PTR: ip24.67-202-105.static.steadfastdns.net
dp2.33across.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com
idsync.rlcdn.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-196-3-185.deploy.static.akamaitechnologies.com
t.sharethis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
windows.net
securexx00cxsw.z13.web.core.windows.net |
383 KB |
6 |
eyeota.net
4 redirects
ps.eyeota.net — Cisco Umbrella Rank: 1596 |
3 KB |
4 |
doubleclick.net
4 redirects
cm.g.doubleclick.net — Cisco Umbrella Rank: 363 |
3 KB |
4 |
sharethis.com
pd.sharethis.com — Cisco Umbrella Rank: 30000 t.sharethis.com — Cisco Umbrella Rank: 7974 |
5 KB |
3 |
33across.com
2 redirects
dp2.33across.com — Cisco Umbrella Rank: 23691 cdn-tc.33across.com — Cisco Umbrella Rank: 35993 dp1.33across.com Failed |
1007 B |
3 |
tynt.com
cdn.tynt.com — Cisco Umbrella Rank: 18487 ic.tynt.com — Cisco Umbrella Rank: 15045 de.tynt.com — Cisco Umbrella Rank: 2349 |
9 KB |
3 |
dtscout.com
e.dtscout.com — Cisco Umbrella Rank: 8004 t.dtscout.com — Cisco Umbrella Rank: 6811 |
4 KB |
2 |
onaudience.com
2 redirects
pixel.onaudience.com — Cisco Umbrella Rank: 3463 |
800 B |
2 |
lijit.com
pxdrop.lijit.com — Cisco Umbrella Rank: 6153 |
2 KB |
2 |
histats.com
s10.histats.com — Cisco Umbrella Rank: 6836 s4.histats.com — Cisco Umbrella Rank: 6819 |
5 KB |
1 |
rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 689 |
441 B |
1 |
bluekai.com
tags.bluekai.com — Cisco Umbrella Rank: 1219 |
|
1 |
dtscdn.com
t.dtscdn.com — Cisco Umbrella Rank: 7251 |
590 B |
1 |
crwdcntrl.net
tags.crwdcntrl.net — Cisco Umbrella Rank: 1256 |
19 KB |
1 |
ipwho.is
ipwho.is — Cisco Umbrella Rank: 72804 |
952 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
27 KB |
0 |
krxd.net
Failed
usermatch.krxd.net Failed |
|
0 |
adnxs.com
Failed
secure.adnxs.com — Cisco Umbrella Rank: 764 Failed |
|
47 | 18 |
Domain | Requested by | |
---|---|---|
21 | securexx00cxsw.z13.web.core.windows.net |
securexx00cxsw.z13.web.core.windows.net
|
6 | ps.eyeota.net |
4 redirects
securexx00cxsw.z13.web.core.windows.net
|
4 | cm.g.doubleclick.net | 4 redirects |
2 | dp2.33across.com | 2 redirects |
2 | pixel.onaudience.com | 2 redirects |
2 | t.sharethis.com |
pd.sharethis.com
t.sharethis.com |
2 | pd.sharethis.com |
e.dtscout.com
securexx00cxsw.z13.web.core.windows.net |
2 | pxdrop.lijit.com |
e.dtscout.com
pxdrop.lijit.com |
2 | t.dtscout.com |
e.dtscout.com
|
1 | idsync.rlcdn.com |
securexx00cxsw.z13.web.core.windows.net
|
1 | cdn-tc.33across.com |
de.tynt.com
|
1 | tags.bluekai.com |
de.tynt.com
|
1 | de.tynt.com |
cdn.tynt.com
|
1 | t.dtscdn.com |
e.dtscout.com
|
1 | tags.crwdcntrl.net |
e.dtscout.com
|
1 | ic.tynt.com |
securexx00cxsw.z13.web.core.windows.net
|
1 | cdn.tynt.com |
e.dtscout.com
|
1 | e.dtscout.com |
s4.histats.com
|
1 | s4.histats.com |
s10.histats.com
|
1 | s10.histats.com |
securexx00cxsw.z13.web.core.windows.net
|
1 | ipwho.is |
securexx00cxsw.z13.web.core.windows.net
|
1 | code.jquery.com |
securexx00cxsw.z13.web.core.windows.net
|
0 | dp1.33across.com Failed |
securexx00cxsw.z13.web.core.windows.net
|
0 | usermatch.krxd.net Failed |
securexx00cxsw.z13.web.core.windows.net
|
0 | secure.adnxs.com Failed |
securexx00cxsw.z13.web.core.windows.net
|
47 | 25 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.web.core.windows.net Microsoft Azure RSA TLS Issuing CA 08 |
2024-04-04 - 2025-03-30 |
a year | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
ipwho.is GoGetSSL ECC DV CA |
2024-03-13 - 2025-03-13 |
a year | crt.sh |
s10.histats.com WE1 |
2024-08-07 - 2024-11-05 |
3 months | crt.sh |
histats.com R11 |
2024-08-06 - 2024-11-04 |
3 months | crt.sh |
dtscout.com WE1 |
2024-07-13 - 2024-10-11 |
3 months | crt.sh |
cert2-prod.aut.a24365.net R11 |
2024-07-26 - 2024-10-24 |
3 months | crt.sh |
sharethis.com Amazon RSA 2048 M03 |
2024-04-21 - 2025-05-20 |
a year | crt.sh |
*.tynt.com Sectigo RSA Domain Validation Secure Server CA |
2023-09-05 - 2024-09-30 |
a year | crt.sh |
cert1-prod.aut.a24365.net R11 |
2024-08-05 - 2024-11-03 |
3 months | crt.sh |
*.crwdcntrl.net Amazon RSA 2048 M01 |
2023-10-08 - 2024-11-05 |
a year | crt.sh |
dtscdn.com WE1 |
2024-07-09 - 2024-10-07 |
3 months | crt.sh |
odc-pixel-prod-01.oracle.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-12-11 - 2024-12-11 |
a year | crt.sh |
*.33across.com Sectigo RSA Domain Validation Secure Server CA |
2023-09-06 - 2024-09-30 |
a year | crt.sh |
This page contains 6 frames:
Primary Page:
https://securexx00cxsw.z13.web.core.windows.net/Win/index.html?phone=null
Frame ID: 02455A78B995B48D03D7A72C0D8E1807
Requests: 43 HTTP requests in this frame
Frame:
https://t.dtscout.com/idg/?su=51A017235983676819B075EAE2195CFC
Frame ID: 5DE9AF198D10797A0F2D54F7BF5A7310
Requests: 1 HTTP requests in this frame
Frame:
https://pxdrop.lijit.com/a/t_.htm?ver=1.1501.802&cid=c026&cls=sync
Frame ID: 322EA02A383E1DCA14B4C1BEF77942A0
Requests: 1 HTTP requests in this frame
Frame:
https://tags.bluekai.com/site/27519?id=212561415422037&ret=html&random=1723598372
Frame ID: 3B19F2434FBD43BABB9CAF8D6E0A2E57
Requests: 1 HTTP requests in this frame
Frame:
https://cdn-tc.33across.com/lotame-sync.html
Frame ID: 243EC94BB482E54800FC17071914089D
Requests: 1 HTTP requests in this frame
Frame:
https://t.sharethis.com/a/t_.htm?ver=1.1501.23402&cid=c010&cls=C
Frame ID: E878D4DA461BB9F1C1CB91A45F2B2838
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/83750d50-160a-47f2-974c-efe701c90686.png)
Page Title
Computer Error 2V7HG0TVBPage URL History Show full URLs
- https://securexx00cxsw.z13.web.core.windows.net/ Page URL
- https://securexx00cxsw.z13.web.core.windows.net/Win/index.html?phone=null Page URL
Detected technologies
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://securexx00cxsw.z13.web.core.windows.net/ Page URL
- https://securexx00cxsw.z13.web.core.windows.net/Win/index.html?phone=null Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 37- https://pixel.onaudience.com/?partner=137085098&mapped=51A017235983676819B075EAE2195CFC HTTP 302
- https://pixel.onaudience.com/?partner=236&icm&cver&gdpr=0&smartmap=1&redirect=ps.eyeota.net%2Fpixel%3Fgdpr%3D0%26gdpr_consent%3D%26pid%3D3b2cb90%26t%3Dgif%26uid%3D%25m HTTP 302
- https://ps.eyeota.net/pixel?gdpr=0&gdpr_consent=&pid=3b2cb90&t=gif&uid=33e73ccd90e17abb HTTP 302
- https://ps.eyeota.net/pixel/bounce/?gdpr=0&gdpr_consent=&pid=3b2cb90&t=gif&uid=33e73ccd90e17abb HTTP 302
- https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MjYzN3VtVTFuVFFpU19Jc0JDTkw2NHZuZk1JNWVrVGswWXF2U1hjVTc3ZFU&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=3b2cb90 HTTP 302
- https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MjYzN3VtVTFuVFFpU19Jc0JDTkw2NHZuZk1JNWVrVGswWXF2U1hjVTc3ZFU&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=3b2cb90&google_tc= HTTP 302
- https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=3b2cb90&google_gid=CAESECP6iP43-f6j0oMf7FgcudQ&google_cver=1
- https://dp2.33across.com/ps/?tt=iframe&pid=1198&us_privacy=&random=1723598369359.4 HTTP 302
- https://tags.bluekai.com/site/27519?id=212561415422037&ret=html&random=1723598372
- https://map.go.affec.tv/map/3a/?pid=CoIKSma8BiEU2fbyLcfGAg%3D%3D&us_privacy=&ts=1723598369359.1 HTTP 303
- https://secure.adnxs.com/getuid?https%3A%2F%2Fmap.go.affec.tv%2Fmap%2Fan%2F%24UID%3Fch%3D66bc06286eb817000185a2d3%26chc%3Dtt%26redirect_url%3D%26gdpr%3D%26gdpr_consent%3D&gdpr=&gdpr_consent= HTTP 307
- https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fmap.go.affec.tv%252Fmap%252Fan%252F%2524UID%253Fch%253D66bc06286eb817000185a2d3%2526chc%253Dtt%2526redirect_url%253D%2526gdpr%253D%2526gdpr_consent%253D%26gdpr%3D%26gdpr_consent%3D
- https://pixel.tapad.com/idsync/ex/receive?partner_id=1388&partner_device_id=CoIKSma8BiEU2fbyLcfGAg%3D%3D&us_privacy=&random=1723598369359.2&redirect=https%3A%2F%2Fthinkcxad.azurewebsites.net%2Fapi%2Fpixel%3Fid%3D%24%7BTA_DEVICE_ID%7D%26partner%3DTAPAD HTTP 302
- https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1388&partner_device_id=CoIKSma8BiEU2fbyLcfGAg%3D%3D&us_privacy=&random=1723598369359.2&redirect=https%3A%2F%2Fthinkcxad.azurewebsites.net%2Fapi%2Fpixel%3Fid%3D%24%7BTA_DEVICE_ID%7D%26partner%3DTAPAD HTTP 302
- https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=862762b0-1eec-4209-a9bb-152ab7c898c6%252Chttps%25253A%25252F%25252Fusermatch.krxd.net%25252Fum%25252Fv2%25253Fpartner%25253Dtapad%252C&gdpr=0&gdpr_consent= HTTP 302
- https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=66a25c27-9693-43f1-8483-2f883a3cc229&ttd_puid=862762b0-1eec-4209-a9bb-152ab7c898c6%2Chttps%253A%252F%252Fusermatch.krxd.net%252Fum%252Fv2%253Fpartner%253Dtapad%2C HTTP 302
- https://usermatch.krxd.net/um/v2?partner=tapad
- https://dp2.33across.com/ps/?pid=1205&rand=1723598369359.3 HTTP 302
- https://idsync.rlcdn.com/405716.gif?partner_uid=212741942484828
- https://ps.eyeota.net/pixel?pid=c9gd671&t=gif&uid=CoIKSma8BiEU2fbyLcfGAg%3D%3D&us_privacy=&33random=1723598369359.5&cat=33across HTTP 302
- https://ps.eyeota.net/pixel/bounce/?pid=c9gd671&t=gif&uid=CoIKSma8BiEU2fbyLcfGAg%3D%3D&us_privacy=&33random=1723598369359.5&cat=33across HTTP 302
- https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MlZDWkY1dVh4cjNndTZUek0yUzB2STNOVng4TFpxUjdtNzlnMHFMeGdrYms&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671 HTTP 302
- https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MlZDWkY1dVh4cjNndTZUek0yUzB2STNOVng4TFpxUjdtNzlnMHFMeGdrYms&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_tc= HTTP 302
- https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=c9gd671&google_gid=CAESEPiYYJm6K4S_s0UVfRo06e8&google_cver=1
47 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
securexx00cxsw.z13.web.core.windows.net/ |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
securexx00cxsw.z13.web.core.windows.net/Win/ |
18 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12tapa.css
securexx00cxsw.z13.web.core.windows.net/Win/ |
17 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.4.4.min.js
code.jquery.com/ |
77 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12noir.js
securexx00cxsw.z13.web.core.windows.net/Win/ |
82 KB 83 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12script.compat.js
securexx00cxsw.z13.web.core.windows.net/Win/ |
1 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12bg4.png
securexx00cxsw.z13.web.core.windows.net/Win/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mnc.png
securexx00cxsw.z13.web.core.windows.net/Win/ |
187 B 557 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
msmm.png
securexx00cxsw.z13.web.core.windows.net/Win/ |
168 B 538 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
set.png
securexx00cxsw.z13.web.core.windows.net/Win/ |
364 B 734 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vsc.png
securexx00cxsw.z13.web.core.windows.net/Win/ |
722 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dm.png
securexx00cxsw.z13.web.core.windows.net/Win/ |
332 B 702 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cs.png
securexx00cxsw.z13.web.core.windows.net/Win/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
re.gif
securexx00cxsw.z13.web.core.windows.net/Win/ |
14 KB 15 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12nvidia.js
securexx00cxsw.z13.web.core.windows.net/Win/ |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12jupiter.js
securexx00cxsw.z13.web.core.windows.net/Win/ |
490 B 866 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asd.js
securexx00cxsw.z13.web.core.windows.net/Win/ |
12 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
ipwho.is/ |
680 B 952 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
349 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jfbvd737nn.mp3
securexx00cxsw.z13.web.core.windows.net/Win/ |
196 KB 197 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bel.png
securexx00cxsw.z13.web.core.windows.net/Win/ |
321 B 321 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pcm.png
securexx00cxsw.z13.web.core.windows.net/Win/ |
321 B 321 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js15_as.js
s10.histats.com/ |
11 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
event
securexx00cxsw.z13.web.core.windows.net/api/ |
335 B 673 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ai2.mp3
securexx00cxsw.z13.web.core.windows.net/Win/ |
321 B 629 B |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.php
s4.histats.com/stats/ |
379 B 514 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
e.dtscout.com/e/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
t.dtscout.com/idg/ Frame 5DE9 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t.dhj
pxdrop.lijit.com/1/d/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dtscout
pd.sharethis.com/pd/ |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
afwu.js
cdn.tynt.com/ |
19 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
t.dtscout.com/pv/ |
51 B 326 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t_.htm
pxdrop.lijit.com/a/ Frame 322E |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
35 B 648 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t.dhj
t.sharethis.com/1/k/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dtscout
pd.sharethis.com/pd/ |
42 B 265 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lt.min.js
tags.crwdcntrl.net/lt/c/3825/ |
62 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
t.dtscdn.com/widget/ |
0 590 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
match
ps.eyeota.net/ Redirect Chain
|
70 B 440 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v2
de.tynt.com/deb/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
27519
tags.bluekai.com/site/ Frame 3B19 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lotame-sync.html
cdn-tc.33across.com/ Frame 243E |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
bounce
secure.adnxs.com/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
v2
usermatch.krxd.net/um/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
405716.gif
idsync.rlcdn.com/ Redirect Chain
|
42 B 441 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
match
ps.eyeota.net/ Redirect Chain
|
70 B 440 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
dp1.33across.com/ps/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t_.htm
t.sharethis.com/a/ Frame E878 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- secure.adnxs.com
- URL
- https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fmap.go.affec.tv%252Fmap%252Fan%252F%2524UID%253Fch%253D66bc06286eb817000185a2d3%2526chc%253Dtt%2526redirect_url%253D%2526gdpr%253D%2526gdpr_consent%253D%26gdpr%3D%26gdpr_consent%3D
- Domain
- usermatch.krxd.net
- URL
- https://usermatch.krxd.net/um/v2?partner=tapad
- Domain
- dp1.33across.com
- URL
- https://dp1.33across.com/ps/?pid=669&uid=CoIKSma8BiEU2fbyLcfGAg%3D%3D&us_privacy=&random=1723598369359.7&pu=https%3A%2F%2Fsecurexx00cxsw.z13.web.core.windows.net%2FWin%2Findex.html%3Fphone%3Dnull
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)240 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 function| $ function| jQuery object| t function| toggleFullScreen function| addEvent number| isNS function| mischandler function| mousehandler function| win_onkeydown_handler object| _Hasync function| plausible function| chfh function| chfh2 string| _HST_cntval object| Histats object| _HistatsCounterGraphics_0_setValues object| a object| cv object| Tynt object| _dtspv object| _33Across function| __uspapi object| lotame_3825 number| char string| ipadd string| city string| country string| isp string| currtime function| lotameIsCompatible function| lt3825_ba function| lt3825_b function| lt3825_ea object| lt3825_e function| lt3825_fa function| lt3825_g function| lt3825_ha object| lt3825_ object| lt3825_ma object| lt3825_na object| lt3825_p object| lt3825_Na object| lt3825_6 function| lt3825_aa function| lt3825_a function| lt3825_d function| lt3825_f function| lt3825_h function| lt3825_ga function| lt3825_ia function| lt3825_i function| lt3825_ja function| lt3825_j function| lt3825_k function| lt3825_l function| lt3825_m function| lt3825_n function| lt3825_ka function| lt3825_la function| lt3825_o function| lt3825_q function| lt3825_s function| lt3825_t function| lt3825_u function| lt3825_v function| lt3825_w function| lt3825_ra function| lt3825_oa function| lt3825_pa function| lt3825_x function| lt3825_qa function| lt3825_y function| lt3825_z function| lt3825_B function| lt3825_sa function| lt3825_r function| lt3825_C function| lt3825_D function| lt3825_ta function| lt3825_ua function| lt3825_va function| lt3825_E function| lt3825_wa function| lt3825_xa function| lt3825_F function| lt3825_G function| lt3825_ya function| lt3825_H function| lt3825_I function| lt3825_J function| lt3825_za function| lt3825_Aa function| lt3825_L function| lt3825_Ba function| lt3825_M function| lt3825_K function| lt3825_Ca function| lt3825_Da function| lt3825_Ea function| lt3825_Fa function| lt3825_Ga function| lt3825_N function| lt3825_Ha function| lt3825_Ia function| lt3825_Ja function| lt3825_Ka function| lt3825_La function| lt3825_Ma function| lt3825_O function| lt3825_Oa function| lt3825_Pa function| lt3825_Qa function| lt3825_Ra function| lt3825_Sa function| lt3825_Ta function| lt3825_Ua function| lt3825_Va function| lt3825_Wa function| lt3825_Xa function| lt3825_Ya function| lt3825_Za function| lt3825_P function| lt3825_Q function| lt3825__a function| lt3825_R function| lt3825_S function| lt3825_0a function| lt3825_1a function| lt3825_2a function| lt3825_T function| lt3825_U function| lt3825_V function| lt3825_W function| lt3825_6a function| lt3825_3a function| lt3825_7a function| lt3825_5a function| lt3825_4a function| lt3825_X function| lt3825_Y function| lt3825_9a function| lt3825_$a function| lt3825_8a function| lt3825_ab function| lt3825__ function| lt3825_db function| lt3825_fb function| lt3825_eb function| lt3825_hb function| lt3825_cb function| lt3825_bb function| lt3825_Z function| lt3825_gb function| lt3825_2 function| lt3825_jb function| lt3825_lb function| lt3825_0 function| lt3825_kb function| lt3825_3 function| lt3825_1 function| lt3825_ib function| lt3825_mb function| lt3825_nb function| lt3825_rb function| lt3825_ob function| lt3825_pb function| lt3825_qb function| lt3825_sb function| lt3825_ub function| lt3825_tb function| lt3825_vb function| lt3825_wb function| lt3825_xb function| lt3825_yb function| lt3825_4 function| lt3825_5 function| lt3825_zb function| lt3825_Ab function| lt3825_Bb function| lt3825_Cb function| lt3825_Db function| lt3825_Eb function| lt3825_Fb function| lt3825_Gb function| lt3825_Hb function| lt3825_Ib function| lt3825_7 function| lt3825_Lb function| lt3825_Mb function| lt3825_Kb function| lt3825_Jb function| lt3825_Ob function| lt3825_Nb function| lt3825_Qb function| lt3825_Pb function| lt3825_Rb function| lt3825_Sb function| lt3825_Tb function| lt3825_Ub function| lt3825_Vb function| lt3825_Wb function| lt3825_Yb function| lt3825_0b function| lt3825__b function| lt3825_Xb function| lt3825_3b function| lt3825_Zb function| lt3825_1b function| lt3825_5b function| lt3825_4b function| lt3825_6b function| lt3825_2b function| lt3825_7b function| lt3825_8b function| lt3825_9b function| lt3825_8 function| lt3825_$b function| lt3825_ac function| lt3825_bc function| lt3825_cc function| lt3825_dc function| lt3825_9 function| lt3825_ec function| lt3825_fc function| lt3825_gc function| lt3825_hc function| lt3825_ic function| lt3825_jc function| lt3825_kc function| lt3825_$ function| lt3825_lc function| lt3825_oc function| lt3825_nc function| lt3825_pc function| lt3825_mc45 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
securexx00cxsw.z13.web.core.windows.net/ | Name: HstCfa4854462 Value: 1723598367272 |
|
securexx00cxsw.z13.web.core.windows.net/ | Name: HstCla4854462 Value: 1723598367272 |
|
securexx00cxsw.z13.web.core.windows.net/ | Name: HstCmu4854462 Value: 1723598367272 |
|
securexx00cxsw.z13.web.core.windows.net/ | Name: HstPn4854462 Value: 1 |
|
securexx00cxsw.z13.web.core.windows.net/ | Name: HstPt4854462 Value: 1 |
|
securexx00cxsw.z13.web.core.windows.net/ | Name: HstCnv4854462 Value: 1 |
|
securexx00cxsw.z13.web.core.windows.net/ | Name: HstCns4854462 Value: 1 |
|
.dtscout.com/ | Name: m Value: 1 |
|
.dtscout.com/ | Name: st Value: 1 |
|
.dtscout.com/ | Name: df Value: 1723598367 |
|
.dtscout.com/ | Name: l Value: 51A017235983676819B075EAE2195CFC |
|
.lijit.com/ | Name: lijitAcc3PC Value: 1 |
|
.sharethis.com/ | Name: __stid Value: ZG4AAWa8BiEAAAAIE4jEAw== |
|
.sharethis.com/ | Name: __stidv Value: 2 |
|
.tynt.com/ | Name: uid Value: CoIKSma8BiEU2fbyLcfGAg== |
|
.windows.net/ | Name: __dtsu Value: 51A017235983676819B075EAE2195CFC |
|
.tynt.com/ | Name: pids Value: %5B%7B%22p%22%3A%22fcb82aaae3%22%2C%22f%22%3A1%2C%22ts%22%3A1723598369359%7D%2C%7B%22p%22%3A%224bbb341d17%22%2C%22f%22%3A1%2C%22ts%22%3A1723598369359%7D%2C%7B%22p%22%3A%22002f98d420%22%2C%22f%22%3A1%2C%22ts%22%3A1723598369359%7D%2C%7B%22p%22%3A%22d9fe068602%22%2C%22f%22%3A1%2C%22ts%22%3A1723598369359%7D%2C%7B%22p%22%3A%226361f7f203%22%2C%22f%22%3A1%2C%22ts%22%3A1723598369359%7D%2C%7B%22p%22%3A%22e32a9fc66e%22%2C%22f%22%3A1%2C%22ts%22%3A1723598369359%7D%2C%7B%22p%22%3A%227361b0e8e4%22%2C%22f%22%3A1%2C%22ts%22%3A1723598369359%7D%5D |
|
.onaudience.com/ | Name: cookie Value: 08fe385de11667c2 |
|
.onaudience.com/ | Name: done_redirects236 Value: 1 |
|
.t.sharethis.com/ | Name: pxcelPage_default_c010_C Value: 1_0_1723598369862 |
|
.adsrvr.org/ | Name: TDID Value: 66a25c27-9693-43f1-8483-2f883a3cc229 |
|
.dtscdn.com/ | Name: uid Value: 51A017235983676819B075EAE2195CFC |
|
.eyeota.net/ | Name: mako_uid Value: 1914e77f93b-78040000010a5ef7 |
|
.eyeota.net/ | Name: SERVERID Value: 24311~DM |
|
.ml314.com/ | Name: pi Value: 3646274755309338641 |
|
.rlcdn.com/ | Name: rlas3 Value: rt6cPunliFwgpSjIvpkn0yFR0uOucbOBqz/HT3+FhEM= |
|
.rlcdn.com/ | Name: pxrc Value: CKOM8LUGEgUI204QAA== |
|
.doubleclick.net/ | Name: IDE Value: AHWqTUluEHocjk1Bpt2QXy5OTZswkq-gvOS4Tn7y74paUQzl0xbV88TwVg1q32JeNNg |
|
.33across.com/ | Name: 33x_ps Value: u%3D212561415422037%3As1%3D1723598372602%3Ats%3D1723598372602 |
|
.tapad.com/ | Name: TapAd_TS Value: 1723598372841 |
|
.tapad.com/ | Name: TapAd_DID Value: 862762b0-1eec-4209-a9bb-152ab7c898c6 |
|
.bluekai.com/ | Name: bkdc Value: phx |
|
.bluekai.com/ | Name: bkpa Value: KJpEnXTLu5Dl1MzN+nEwEnWN1Mx0BE161ExN1E/01ejUv6G+Lz6G0zNHv6g1uX7w+ED6Bp/t+qxyBMzY91zIefQ= |
|
.bluekai.com/ | Name: bku Value: 4tL99YxsFsS6vmWb |
|
.t.sharethis.com/ | Name: pxcelBcnLcy Value: 36 |
|
.adsrvr.org/ | Name: TDCPM Value: CAESFAoFdGFwYWQSCwiUo_n7pYKePRAFGAEgASgCMgsI9Jj8qLyCnj0QBTgBWgV0YXBhZGAC |
|
.crwdcntrl.net/ | Name: _cc_dc Value: 0 |
|
.crwdcntrl.net/ | Name: _cc_id Value: 871603222c24dfa731473c5819fc0cb7 |
|
.tapad.com/ | Name: TapAd_3WAY_SYNCS Value: 1!5449 |
|
.go.affec.tv/ | Name: ck Value: 66bc06286eb817000185a2d2 |
|
.go.affec.tv/ | Name: oo Value: 1 |
|
.go.affec.tv/ | Name: pt Value: eyJ0dCI6eyJkdCI6MTcyMzU5ODM3NiwiaWQiOiJDb0lLU21hOEJpRVUyZmJ5TGNmR0FnPT0iLCJscyI6MTcyMzU5ODM3Nn0sInYiOjB9|1723598376|40da810ab5da21d039bfd2d82a1edb52c136f38f |
|
.adnxs.com/ | Name: XANDR_PANID Value: kYWta9VjyHiT-UZX2mmHe340_3aqr3X19Vx5aJYGE0zfBHx1mi8v_8MUOYbVwMVCwYLwx0qswdhxVA4kHAc2rpNod4jYo83Ju73TR4AaB-A. |
|
.adnxs.com/ | Name: receive-cookie-deprecation Value: 1 |
|
.adnxs.com/ | Name: uuid2 Value: 5089512152032453139 |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn-tc.33across.com
cdn.tynt.com
cm.g.doubleclick.net
code.jquery.com
de.tynt.com
dp1.33across.com
dp2.33across.com
e.dtscout.com
ic.tynt.com
idsync.rlcdn.com
ipwho.is
pd.sharethis.com
pixel.onaudience.com
ps.eyeota.net
pxdrop.lijit.com
s10.histats.com
s4.histats.com
secure.adnxs.com
securexx00cxsw.z13.web.core.windows.net
t.dtscdn.com
t.dtscout.com
t.sharethis.com
tags.bluekai.com
tags.crwdcntrl.net
usermatch.krxd.net
dp1.33across.com
secure.adnxs.com
usermatch.krxd.net
104.18.35.167
104.26.12.60
108.138.128.28
141.101.120.10
141.101.120.11
142.250.65.162
148.113.153.93
15.204.213.5
151.101.66.137
172.64.153.173
172.66.132.114
18.223.60.98
20.60.220.228
23.196.3.181
23.196.3.185
23.196.3.202
23.216.137.114
34.231.251.31
35.244.154.8
54.39.128.162
67.202.105.23
67.202.105.24
67.202.105.31
0a68643a7662d784f31695744031cbbe16121ad43f3ba5cbe4c28595b350969a
1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115
1b5e06cde18afe9771f7715ee847a0ca7acc8fe502caa74d2a4262a8af964e0d
1ee2eab102e7a65bceb91e2d8518a79ec98f5925368ac8c28cf2f8d72a3afa14
24bd50f480ebc46c5d6d183da6055fb1ea98e49096cd667f3bb682ed16a19fcd
29a6e5e7eba92edfdd82d653cd2542571918bb382d6df1babe72c9270cb5cf10
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
31c6dbe9d867436244f38566adad57e3870f4c8489c6804280eb564bfac5c1bd
3db5fc063868d3ca5fc3cc2695f483266cffea00bef68dffd7e4944b947aacc8
3f71bbd8d396a9d96fe282210a1dd1464418e892205785fc20e1273360eb94d6
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7
4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86
517364f2d45162fb5037437b5b6cb953d00d9b2b3b79ba87d9fe57ea6ee6070c
52617196f93a9796d3f4ff88a5e2af0a85c40312685a0665affa50ff46d9d9ea
5e0506e9f5736d25677b197cb223b3c6de29d52d06da4aa9a4b2006b28d5039a
64a82871cbdf67ddcaf2b5348b9d49c8cac1ae944cc3d664604244e4b957ac4e
6dde5484c1ac5114257ede7697b8af912083de4436f02627cfdceedffbfae07c
7df9f467d23ee1887edb2123cca10a1a9c4624cdcf7199c64e78a8430031f9f5
8066cb90f41a75e95e29b2723f6a6fab181df24a30e4562b12920fa49b5dd20d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
a51c4740840a89f02e720d4f6d566c9e5fe57850d8e9de555cb04ec44a630734
b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a
b39c8c9dcd2ce249a9328d3dcfc51c324e94100cc8abdc96be8ef8458655b74f
b3e3d78548606a335a0bcbc7b99f9d7307b1187028a65ada18ed12a08add5e84
b40d5142c2a7a608758ef96ecac0ed36af70631c1cd48b053322c5e451ded9d1
b67a7c07a045d7cb0f2e216a557aec0d99405e17c36d1a6b1ff3e2733aa35348
b798b58fc4a385707fb077daf5ba24055b71efe377609ebed8dd557be4b24e1c
ba057af4fc92481969287eddb905f654a57b9bde290dd8358ced3c343321f5b0
c5a324f181af16879b6c4c52b731b23392f2816def159b157c4de620cff1cd41
d041f329c51340b5b810d305ac16553444f3d034a1e061bc875e971e945e859d
d8dc097d0d2ebabea489762f4da9f09eda2cae95a4f5ecb1f8de8cb13c88a59c
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea986a7c3a13432b9e1ed293d23ce51fa8550f5c253d7cf423faba707723e3a9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65
fe7772793b656dd53fbeacf1ff24d3c1af0b6375def2928893fb82f4ea3c361e