education learning

documentation technical

adult content

corporate

English

QSI_HistorySession

bm_ss

fs_lua

ai_user

_fbp

cto_bundle

bm_sv

fs_uid

AMCV_0C1038B35278345B0A490D4C%40AdobeOrg

bm_s

gpv_v4

kndctr_0C1038B35278345B0A490D4C_AdobeOrg_identity

s_ivc

s_vnc365

ak_bmsc

_gcl_au

_abck

_utm_tracking_code

ai_session

bm_lso

kndctr_0C1038B35278345B0A490D4C_AdobeOrg_cluster

_ga_NTWN6LKPPS

bm_sz

bm_so

akBMG

keyword

search

html/09/c4/09c47ec2-6b32-4c1b-b11f-83c055438169.html.gz

appId=cid-v1:10145438-aa4e-4870-8785-9a64ffe121ad

default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src 'nonce-qM1xlJJz' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';

default-src 'self'; connect-src 'self' https: wss://ethn.io:4443 wss://*.ethn.io:4443 wss://*.getbeamer.com; font-src 'self' https: data:; frame-src 'self' ethn.io *.ethn.io *.getbeamer.com *.helpscout.net www.google.com/recaptcha/ recaptcha.google.com/recaptcha/ www.recaptcha.net/ td.doubleclick.net www.googletagmanager.com *.calendly.com *.cal.com player.vimeo.com calendly.com cal.com g2.com *.g2.com; img-src 'self' https: data:; media-src 'self' https:; object-src 'none'; script-src 'self' https: 'unsafe-inline' 'wasm-unsafe-eval' ethn.io *.ethn.io *.facebook.net *.getbeamer.com *.helpscout.net; style-src 'self' https: 'unsafe-inline'

default-src 'self' blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;script-src 'nonce-QHsacwfe' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;img-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;media-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;child-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;frame-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;manifest-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;object-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;worker-src 'self' data: blob: facebook.net *.facebook.net facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';

default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-BUAaYSD4' blob: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;

default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-COaBE6UY' blob: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;

Criteo GUM iframe

viewport

Research the used Toyota Supra with CarMax to check out reliability ratings, highlights from each generation, and key changes per year.

description

https://www.carmax.com/research/toyota/supra

Explore Generations and Year-by-Year Changes of the Toyota Supra

robots

https://content-images.carmax.com/qeontfmijmzv/1ZyXip1t77k9Tin1WieSW1/70db09f5f024518bad9ce732b2c7817c/2022_Toyota_GR_Supra_2.0_50032_st2400_156_EVOX.png

emotion-insertion-point

google-play-app

apple-itunes-app

format-detection

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

CSC Corporate Domains, Inc.

CARMAX.COM

Abuse-C Role

Criteo Network Operations Center

CRITEO-MNT

CRITEO-EUROPE-INFRA


window['_fs_debug'] = false;
window['_fs_host'] = 'userinsights.carmax.com';
window['_fs_script'] = 'userinsights.carmax.com/s/fs.js';
window['_fs_app_host'] = 'app.fullstory.com';
window['_fs_org'] 


function getVisitorId() {
  let kmxCookie = null;
  let visitorID = null;
  const docCookie = decodeURIComponent(document.cookie);
  if (docCookie) {
    const cookies = docCookie.split(';');
    coo


  let fsCustomEvents = JSON.parse(window.sessionStorage.getItem('fsCustomEvents'));
  if(Array.isArray(fsCustomEvents)) {
    fsCustomEvents.forEach((customEvent) => {
      let eventName = customEve


let testName = 'oa-my-account-vehicles';
function emitEvents() {
    window.dispatchEvent(new CustomEvent(testName));
    window.dispatchEvent(new CustomEvent('enableSUYCTest', { detail: testName }))

(window.BOOMR_mq=window.BOOMR_mq||[]).push(["addVar",{"rua.upush":"false","rua.cpush":"false","rua.upre":"false","rua.cpre":"false","rua.uprl":"false","rua.cprl":"false","rua.cprf":"false","rua.trans"

!function(e){var n="https://s.go-mpulse.net/boomerang/";if("False"=="True")e.BOOMR_config=e.BOOMR_config||{},e.BOOMR_config.PageParams=e.BOOMR_config.PageParams||{},e.BOOMR_config.PageParams.pci=!0,n=

{"@context":"https://schema.org/","@type":"WebSite","url":"https://www.carmax.com","name":"CarMax"}

{"@context":"https://schema.org/","@type":"Organization","legalName":"CarMax","url":"https://www.carmax.com","logo":"https://www.carmax.com/research/images/carmax-logo-full.png","contactPoint":{"@cont

{"@context":"https://schema.org/","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"https://www.carmax.com/research","name":"Car research & advice"}},{"@type"

{"@context":"https://schema.org/","@type":"ImageObject","contentUrl":"//content-images.carmax.com/qeontfmijmzv/1ZyXip1t77k9Tin1WieSW1/70db09f5f024518bad9ce732b2c7817c/2022_Toyota_GR_Supra_2.0_50032_st

{"@context":"https://schema.org/","@type":"ImageObject","contentUrl":"//content-images.carmax.com/qeontfmijmzv/3LX3o7E72Jna6NARtiIlQh/2967f01abd8b6fa742aeb9f8ab8c081e/Perry_Stern_Headshot1.JPG?fit=thu

{"@context":"https://schema.org/","@type":"ImageObject","contentUrl":"//content-images.carmax.com/qeontfmijmzv/2pE5XFdjef4JTkf8Lfj12T/8569bdb19ca27dda70c8e232c68d0775/2022_Toyota_GR_Supra_2.0_50032_st

{"@context":"https://schema.org/","@type":"ImageObject","contentUrl":"//content-images.carmax.com/qeontfmijmzv/0r8nic3odwo365EUM6hFw/995b39b2903cab53db3f798ce090c56d/2021_Toyota_GR_Supra-14086_st1280_

{"@context":"https://schema.org/","@type":"ImageObject","contentUrl":"//content-images.carmax.com/qeontfmijmzv/1PW3Ds9KXihASgvWbiJzl5/240e61de3882079bff59916b9b6f46a0/2020_Toyota_GR_Supra_Launch_Editi

{"props":{"pageProps":{"sharedHeaderData":{"header":"\u003clink href=\"https://www.carmax.com/shared/header-footer/full/css/main.css\" rel=\"stylesheet\"\u003e\u003ckmx-global-header\u003e\u003c/kmx-g

_satellite["_runScript1"](function(event, target, Promise) {
void 0!==window.FS&&null!==window.FS&&window.FS&&FS.event("Research View (event4)");
});

_satellite["_runScript2"](function(event, target, Promise) {
var thirdParty=document.createElement("div");thirdParty.setAttribute("id","third-party-tags"),thirdParty.setAttribute("style","display: non


    window.dataLayer = window.dataLayer || [];
    function gtag(){dataLayer.push(arguments);}
    gtag('js', new Date());

  console.log("enter AW-10777432239-1,AW-1060501044-2,AW-708462047");


   

_satellite["_runScript3"](function(event, target, Promise) {
var logOdds=_satellite.getVar("logOdds");console.log("prinitng logodds"),console.log(logOdds),logOdds<.523321&&logOdds>=.209111?fbq("trackC

_satellite["_runScript4"](function(event, target, Promise) {
var thirdPartyTags=document.createElement("div");thirdPartyTags.setAttribute("id","third-party-tags"),thirdPartyTags.setAttribute("style","


    window.dataLayer = window.dataLayer || [];
    function gtag(){dataLayer.push(arguments);}
    gtag('js', new Date());

    gtag('config', 'DC-8789640');
    gtag('config', 'AW-1060501044', {'all


/*jshint sub:true*/
//<--------------------------------------------------------------------------------------------Full Story AA Setup-----------------------------------------------------------------

_satellite["_runScript5"](function(event, target, Promise) {
!function(){var t=function(t,e,n,i){this.get=function(t){t+="=";for(var e=document.cookie.split(";"),n=0,i=e.length;n<i;n++){for(var r=e[n]

Requests	IP Address	Location	AS Autonomous System
111	178.250.1.24	France	AS44788Criteo Technology SAS
1	13.107.213.44	United States	AS8075MICROSOFT-CORP-MSN-AS-BLOCK
1	173.223.116.132	Schiphol, North Holland, Netherlands	AS16625AKAMAI-AS
1	3.33.220.150	Seattle, Washington, United States	AS16509AMAZON-02
1	23.206.208.207	Frankfurt am Main, Hesse, Germany	AS16625AKAMAI-AS
1	135.125.145.78	France	AS16276OVH SAS
1	51.195.34.222	France	AS16276OVH SAS
1	142.250.185.130	United States	AS15169GOOGLE
1	157.240.0.6	Frankfurt am Main, Hesse, Germany	AS32934FACEBOOK
1	51.195.126.30	Germany	AS16276OVH SAS
241	131	-	-

Security Scan Report: www.carmax.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies8

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History