URL: https://replacemywindows.ca/
Submission Tags: @phishunt_io
Submission: On December 03 via api from DE — Scanned from CA

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 25 HTTP transactions. The main IP is 198.71.248.67, located in Ashburn, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is replacemywindows.ca.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on November 17th 2021. Valid for: a year.
This is the only time replacemywindows.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
17 198.71.248.67 26496 (AS-26496-...)
2 2607:f8b0:400... 15169 (GOOGLE)
5 2607:f8b0:400... 15169 (GOOGLE)
1 23.33.238.153 20940 (AKAMAI-ASN1)
25 4
Domain Requested by
17 replacemywindows.ca replacemywindows.ca
5 fonts.gstatic.com fonts.googleapis.com
2 fonts.googleapis.com replacemywindows.ca
1 img1.wsimg.com replacemywindows.ca
25 4

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
www.instagram.com
herregress.ca
goo.gl
Subject Issuer Validity Valid
replacemywindows.ca
Go Daddy Secure Certificate Authority - G2
2021-11-17 -
2022-11-17
a year crt.sh
upload.video.google.com
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
*.wsimg.com
Starfield Secure Certificate Authority - G2
2021-09-24 -
2022-10-26
a year crt.sh

This page contains 1 frames:

Primary Page: https://replacemywindows.ca/
Frame ID: 503B0DADB8A5F6496788C78C8E63A623
Requests: 25 HTTP requests in this frame

Screenshot

Page Title

Egress Window - HERR Ventures Inc

Page Statistics

25
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

778 kB
Transfer

2173 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
replacemywindows.ca/
33 KB
35 KB
Document
General
Full URL
https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache / PHP/8.0.10
Resource Hash
0627da93d7ffb2ac3d68f01930140478e588cf72f00efe6c161e6b10fa22eaed

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

date
Fri, 03 Dec 2021 10:31:45 GMT
server
Apache
x-powered-by
PHP/8.0.10
link
<https://replacemywindows.ca/wp-json/>; rel="https://api.w.org/", <https://replacemywindows.ca/wp-json/wp/v2/pages/24586>; rel="alternate"; type="application/json", <https://replacemywindows.ca/>; rel=shortlink
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
via
1.1 stark
connection
keep-alive
Transfer-Encoding
chunked
style.min.css
replacemywindows.ca/wp-includes/css/dist/block-library/
79 KB
11 KB
Stylesheet
General
Full URL
https://replacemywindows.ca/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:46 GMT
content-encoding
gzip
last-modified
Thu, 22 Jul 2021 19:26:20 GMT
server
Apache
etag
"51426e7-13abe-5c7bb43056df6-gzip"
vary
Accept-Encoding
content-type
text/css
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
css
fonts.googleapis.com/
27 KB
2 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:808::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ac97bc7f217e4f44ef06f70136d703ef07504dcb904e0848bee504cc8a4aafc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 03 Dec 2021 09:49:22 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 03 Dec 2021 10:31:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 03 Dec 2021 10:31:46 GMT
style.css
replacemywindows.ca/wp-content/themes/Divi/
805 KB
81 KB
Stylesheet
General
Full URL
https://replacemywindows.ca/wp-content/themes/Divi/style.css?ver=4.9.10
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
f61a24dc71fe762d2ff08deed627608b04cec5f079e5a22da2b5d224705002e4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:46 GMT
content-encoding
gzip
last-modified
Thu, 22 Jul 2021 19:16:02 GMT
server
Apache
etag
"52e0934-c9590-5c7bb1e294e60-gzip"
vary
Accept-Encoding
content-type
text/css
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
css
fonts.googleapis.com/
46 KB
2 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Abel:regular|Josefin+Sans:100,200,300,regular,500,600,700,100italic,200italic,300italic,italic,500italic,600italic,700italic|Montserrat:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&subset=latin,latin-ext&display=swap
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:808::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0398ab51f64836c6c35e0cb2bf7313bc37a94272be362f5671aabe9eaf41f32c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 03 Dec 2021 10:31:46 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 03 Dec 2021 10:31:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 03 Dec 2021 10:31:46 GMT
jquery.min.js
replacemywindows.ca/wp-includes/js/jquery/
87 KB
31 KB
Script
General
Full URL
https://replacemywindows.ca/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:46 GMT
content-encoding
gzip
last-modified
Thu, 22 Jul 2021 19:26:31 GMT
server
Apache
etag
"52e10d9-15db1-5c7bb43a42aed-gzip"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
jquery-migrate.min.js
replacemywindows.ca/wp-includes/js/jquery/
11 KB
4 KB
Script
General
Full URL
https://replacemywindows.ca/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:46 GMT
content-encoding
gzip
last-modified
Thu, 22 Jul 2021 19:26:30 GMT
server
Apache
etag
"5142a1a-2bd8-5c7bb439fc203-gzip"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
calculator.js
replacemywindows.ca/wp-content/plugins/windows-calculator/
11 KB
3 KB
Script
General
Full URL
https://replacemywindows.ca/wp-content/plugins/windows-calculator/calculator.js?ver=5.8.2
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
b9253d913c10f927c376f3ee61960fcda6deb690a0cc82dd219318c860c5cc9b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:46 GMT
content-encoding
gzip
last-modified
Mon, 12 Mar 2018 23:50:18 GMT
server
Apache
etag
"52c1634-2a58-5673fcddd8280-gzip"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
modules.ttf
replacemywindows.ca/wp-content/themes/Divi/core/admin/fonts/
90 KB
91 KB
Font
General
Full URL
https://replacemywindows.ca/wp-content/themes/Divi/core/admin/fonts/modules.ttf
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09

Request headers

Referer
https://replacemywindows.ca/
Origin
https://replacemywindows.ca
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:46 GMT
via
1.1 stark
last-modified
Thu, 22 Jul 2021 19:15:59 GMT
server
Apache
etag
"52e08d6-168f0-5c7bb1df7e5db"
Transfer-Encoding
chunked
content-type
font/ttf
connection
keep-alive
accept-ranges
bytes
et-divi-customizer-global-16362378808666.min.css
replacemywindows.ca/wp-content/et-cache/global/
11 KB
3 KB
Stylesheet
General
Full URL
https://replacemywindows.ca/wp-content/et-cache/global/et-divi-customizer-global-16362378808666.min.css
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
c77ae6910a53b652e5aea8a0b680e57e03952293ab8d19bd56d5332d8049efe0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:46 GMT
content-encoding
gzip
last-modified
Sat, 06 Nov 2021 22:31:21 GMT
server
Apache
etag
"52c0018-2ad0-5d02651b392de-gzip"
vary
Accept-Encoding
content-type
text/css
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
HERR-Logo-350x80.png
replacemywindows.ca/wp-content/uploads/2018/05/
13 KB
14 KB
Image
General
Full URL
https://replacemywindows.ca/wp-content/uploads/2018/05/HERR-Logo-350x80.png
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
99d2a4cf517a0455310f6a51612729fa13f6bace88a1ae3447d24c25587ccd6f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:47 GMT
via
1.1 stark
last-modified
Thu, 24 May 2018 20:56:16 GMT
server
Apache
etag
"52e1e6e-357c-56cf9e1e39c00"
Transfer-Encoding
chunked
content-type
image/png
connection
keep-alive
accept-ranges
bytes
custom.unified.js
replacemywindows.ca/wp-content/themes/Divi/js/
606 KB
158 KB
Script
General
Full URL
https://replacemywindows.ca/wp-content/themes/Divi/js/custom.unified.js?ver=4.9.10
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
00f110b686e92d6aa3bed351112fb05074547961b22c0fc5994b203a7dca3c28

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:47 GMT
content-encoding
gzip
last-modified
Thu, 22 Jul 2021 19:16:02 GMT
server
Apache
etag
"52e0927-97620-5c7bb1e274ea7-gzip"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
common.js
replacemywindows.ca/wp-content/themes/Divi/core/admin/js/
1 KB
911 B
Script
General
Full URL
https://replacemywindows.ca/wp-content/themes/Divi/core/admin/js/common.js?ver=4.9.10
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:47 GMT
content-encoding
gzip
last-modified
Thu, 22 Jul 2021 19:15:59 GMT
server
Apache
etag
"52e08e8-53f-5c7bb1df960c3-gzip"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
wp-embed.min.js
replacemywindows.ca/wp-includes/js/
1 KB
1 KB
Script
General
Full URL
https://replacemywindows.ca/wp-includes/js/wp-embed.min.js?ver=5.8.2
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:47 GMT
content-encoding
gzip
last-modified
Thu, 22 Jul 2021 19:26:30 GMT
server
Apache
etag
"51429fe-592-5c7bb439c437a-gzip"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
wp-emoji-release.min.js
replacemywindows.ca/wp-includes/js/
18 KB
5 KB
Script
General
Full URL
https://replacemywindows.ca/wp-includes/js/wp-emoji-release.min.js?ver=5.8.2
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:47 GMT
content-encoding
gzip
last-modified
Thu, 22 Jul 2021 19:27:04 GMT
server
Apache
etag
"5142a96-4705-5c7bb45a798f1-gzip"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 stark
Transfer-Encoding
chunked
connection
keep-alive
accept-ranges
bytes
Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2
fonts.gstatic.com/s/josefinsans/v20/
26 KB
27 KB
Font
General
Full URL
https://fonts.gstatic.com/s/josefinsans/v20/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Abel:regular|Josefin+Sans:100,200,300,regular,500,600,700,100italic,200italic,300italic,italic,500italic,600italic,700italic|Montserrat:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&subset=latin,latin-ext&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aa1c72e44c5aa91d24fc6ef2966a7d68363dd342bc325989e9f4dfaae39f54f0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://replacemywindows.ca
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 23:43:05 GMT
x-content-type-options
nosniff
age
38922
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26696
x-xss-protection
0
last-modified
Wed, 03 Nov 2021 17:20:40 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 02 Dec 2022 23:43:05 GMT
business-01.jpg
replacemywindows.ca/wp-content/uploads/2021/07/
161 KB
161 KB
Image
General
Full URL
https://replacemywindows.ca/wp-content/uploads/2021/07/business-01.jpg
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
4ffb6c573f9cd9a092112d9f614deea339fa9a4090124515659356ab3b9028fc

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:47 GMT
via
1.1 stark
last-modified
Thu, 22 Jul 2021 20:30:05 GMT
server
Apache
etag
"52e0101-28439-5c7bc26fb4221"
Transfer-Encoding
chunked
content-type
image/jpeg
connection
keep-alive
accept-ranges
bytes
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/
44 KB
44 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://replacemywindows.ca
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 27 Nov 2021 13:43:38 GMT
x-content-type-options
nosniff
age
506889
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44656
x-xss-protection
0
last-modified
Thu, 28 Oct 2021 00:30:43 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sun, 27 Nov 2022 13:43:38 GMT
MwQ5bhbm2POE2V9BPQ.woff2
fonts.gstatic.com/s/abel/v12/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/abel/v12/MwQ5bhbm2POE2V9BPQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Abel:regular|Josefin+Sans:100,200,300,regular,500,600,700,100italic,200italic,300italic,italic,500italic,600italic,700italic|Montserrat:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&subset=latin,latin-ext&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8bea498aed7cc1366e8b966e467b98219c803107d728eab8a6c4c9b045def699
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://replacemywindows.ca
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 09:38:01 GMT
x-content-type-options
nosniff
age
348826
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9588
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:02:14 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 29 Nov 2022 09:38:01 GMT
rs=w:1440,h:1440
img1.wsimg.com/isteam/ip/0ef02c12-8e1a-4b46-9330-feb417a35cc8/Screen%20Shot%202020-07-08%20at%209.46.15%20AM.png/:/
27 KB
28 KB
Image
General
Full URL
https://img1.wsimg.com/isteam/ip/0ef02c12-8e1a-4b46-9330-feb417a35cc8/Screen%20Shot%202020-07-08%20at%209.46.15%20AM.png/:/rs=w:1440,h:1440
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.33.238.153 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-33-238-153.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2639f7217dcd091e959a0209de5fb0b6b7628d4a0be6fc3f84e3f16c26539027

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-version
0.4.4+sha-b78ea95
date
Fri, 03 Dec 2021 10:31:47 GMT
access-control-request-method
GET
etag
3351370157
x-height
952
access-control-max-age
864000
edge-cache-tag
/isteam/ip/0ef02c12-8e1a-4b46-9330-feb417a35cc8/Screen%20Shot%202020-07-08%20at%209.46.15%20AM.png/:/rs=w:1440,h:1440
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-track-origin-referer
https://www.google.com/url/?sa=t
x-width
1440
timing-allow-origin
*
content-length
27908
expires
Sat, 03 Dec 2022 10:31:47 GMT
JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/
20 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Abel:regular|Josefin+Sans:100,200,300,regular,500,600,700,100italic,200italic,300italic,italic,500italic,600italic,700italic|Montserrat:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&subset=latin,latin-ext&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://replacemywindows.ca
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 27 Nov 2021 07:29:01 GMT
x-content-type-options
nosniff
age
529366
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20040
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:20:44 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sun, 27 Nov 2022 07:29:01 GMT
JTURjIg1_i6t8kCHKm45_ZpC3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/
19 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_ZpC3gnD_g.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Abel:regular|Josefin+Sans:100,200,300,regular,500,600,700,100italic,200italic,300italic,italic,500italic,600italic,700italic|Montserrat:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&subset=latin,latin-ext&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
13eb615165c92892fcd46e01782dd0fc52d36f236f883aad488c2cf4dcf9206e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://replacemywindows.ca
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 19:37:13 GMT
x-content-type-options
nosniff
age
140074
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19868
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:20:31 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 01 Dec 2022 19:37:13 GMT
/
replacemywindows.ca/
259 B
2 KB
XHR
General
Full URL
https://replacemywindows.ca/
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache / PHP/8.0.10
Resource Hash
3612fee1e3509080969190b94925555d482d0ad87a001d77d28af67a4c906a49

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://replacemywindows.ca/
X-Requested-With
XMLHttpRequest
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Fri, 03 Dec 2021 10:31:47 GMT
via
1.1 stark
server
Apache
x-powered-by
PHP/8.0.10
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
Transfer-Encoding
chunked
connection
keep-alive
HERR-Logo-350x80.png
replacemywindows.ca/wp-content/uploads/2018/05/
13 KB
14 KB
Image
General
Full URL
https://replacemywindows.ca/wp-content/uploads/2018/05/HERR-Logo-350x80.png
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
99d2a4cf517a0455310f6a51612729fa13f6bace88a1ae3447d24c25587ccd6f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:47 GMT
via
1.1 stark
last-modified
Thu, 24 May 2018 20:56:16 GMT
server
Apache
etag
"52e1e6e-357c-56cf9e1e39c00"
Transfer-Encoding
chunked
content-type
image/png
connection
keep-alive
accept-ranges
bytes
HERR-Logo-350x80.png
replacemywindows.ca/wp-content/uploads/2018/05/
13 KB
14 KB
Image
General
Full URL
https://replacemywindows.ca/wp-content/uploads/2018/05/HERR-Logo-350x80.png
Requested by
Host: replacemywindows.ca
URL: https://replacemywindows.ca/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
198.71.248.67 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-198-71-248-67.ip.secureserver.net
Software
Apache /
Resource Hash
99d2a4cf517a0455310f6a51612729fa13f6bace88a1ae3447d24c25587ccd6f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://replacemywindows.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 10:31:47 GMT
via
1.1 stark
last-modified
Thu, 24 May 2018 20:56:16 GMT
server
Apache
etag
"52e1e6e-357c-56cf9e1e39c00"
Transfer-Encoding
chunked
content-type
image/png
connection
keep-alive
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

94 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler string| et_site_url string| et_post_id function| et_core_page_resource_fallback object| _wpemojiSettings undefined| $ function| jQuery object| et_animation_data object| DIVI object| et_shortcodes_strings object| et_pb_custom object| et_builder_utils_params object| et_frontend_scripts object| et_pb_box_shadow_elements object| et_pb_motion_elements object| et_pb_sticky_elements function| et_shortcodes_init function| Waypoint object| salvattore function| et_pb_debounce function| et_pb_smooth_scroll function| et_pb_form_placeholders_init function| et_duplicate_menu function| et_pb_remove_placeholder_text function| et_fix_fullscreen_section function| et_bar_counters_init function| et_fix_pricing_currency_position function| et_pb_set_responsive_grid function| et_pb_set_tabs_height function| et_pb_box_shadow_apply_overlay function| et_pb_init_nav_menu function| et_pb_toggle_nav_menu function| et_pb_apply_sticky_image_effect function| et_pb_menu_inject_inline_centered_logo function| et_pb_menu_inject_item function| et_pb_reposition_menu_module_dropdowns object| ET_Builder object| ET_FE object| ET_FB boolean| et_load_event_fired boolean| et_is_transparent_nav boolean| et_is_vertical_nav boolean| et_is_fixed_nav boolean| et_is_minified_js boolean| et_is_minified_css boolean| et_force_width_container_change function| et_pb_init_woo_star_rating function| et_pb_wrap_woo_attribute_fields_in_span function| et_pb_init_modules function| etFixDividerSpacing function| etInitWooReviewsRatingStars object| ET_SmoothScroll boolean| et_calculating_scroll_position boolean| et_side_nav_links_initialized object| wp string| et_location_hash function| et_calculate_header_values function| et_change_primary_nav_position function| et_fix_page_container_position function| et_pb_window_side_nav_scroll_init function| et_pb_side_nav_page_init object| $et_tooltip object| $et_learn_more function| et_pb_slider_init function| et_countdown_timer function| et_countdown_timer_labels function| et_pb_tabs_init function| et_pb_circle_counter_update function| et_apply_parallax function| et_parallax_set_height function| et_apply_builder_css_parallax function| et_pb_play_overlayed_video function| et_pb_resize_section_video_bg function| et_pb_center_video function| et_pb_adjust_video_margin function| et_fix_slider_height function| et_pb_submit_newsletter function| et_fix_testimonial_inner_width function| et_pb_video_background_init function| et_reinit_waypoint_modules function| et_calc_fullscreen_section function| et_calculate_fullscreen_section_size function| debounced_et_apply_builder_css_parallax function| et_pb_parallax_init function| et_pb_fullwidth_header_scroll function| et_pb_search_init function| et_pb_search_percentage_custom_margin_fix function| et_pb_comments_init function| et_pb_shop_add_hover_class object| twemoji string| waypointContextKey

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
img1.wsimg.com
replacemywindows.ca
198.71.248.67
23.33.238.153
2607:f8b0:4006:808::200a
2607:f8b0:4006:80e::2003
00f110b686e92d6aa3bed351112fb05074547961b22c0fc5994b203a7dca3c28
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0398ab51f64836c6c35e0cb2bf7313bc37a94272be362f5671aabe9eaf41f32c
0627da93d7ffb2ac3d68f01930140478e588cf72f00efe6c161e6b10fa22eaed
13eb615165c92892fcd46e01782dd0fc52d36f236f883aad488c2cf4dcf9206e
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea
2639f7217dcd091e959a0209de5fb0b6b7628d4a0be6fc3f84e3f16c26539027
3612fee1e3509080969190b94925555d482d0ad87a001d77d28af67a4c906a49
4ffb6c573f9cd9a092112d9f614deea339fa9a4090124515659356ab3b9028fc
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
8bea498aed7cc1366e8b966e467b98219c803107d728eab8a6c4c9b045def699
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
99d2a4cf517a0455310f6a51612729fa13f6bace88a1ae3447d24c25587ccd6f
aa1c72e44c5aa91d24fc6ef2966a7d68363dd342bc325989e9f4dfaae39f54f0
ac97bc7f217e4f44ef06f70136d703ef07504dcb904e0848bee504cc8a4aafc4
b9253d913c10f927c376f3ee61960fcda6deb690a0cc82dd219318c860c5cc9b
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c77ae6910a53b652e5aea8a0b680e57e03952293ab8d19bd56d5332d8049efe0
d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60
f61a24dc71fe762d2ff08deed627608b04cec5f079e5a22da2b5d224705002e4