pub-2e86082d752843969e1c4572009c2ad7.r2.dev Open in urlscan Pro
2606:4700::6812:323  Public Scan

URL: https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/alert.html
Submission: On May 15 via manual from US — Scanned from NZ

Summary

This website contacted 12 IPs in 3 countries across 8 domains to perform 43 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-2e86082d752843969e1c4572009c2ad7.r2.dev.
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.
This is the only time pub-2e86082d752843969e1c4572009c2ad7.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 2606:4700::68... 13335 (CLOUDFLAR...)
2 2620:12a:8000::4 54113 (FASTLY)
1 ()
17 172.66.44.113 13335 (CLOUDFLAR...)
2 104.17.25.14 13335 (CLOUDFLAR...)
1 117.18.232.200 15133 (EDGECAST)
1 2600:1415:11:... 20940 (AKAMAI-ASN1)
4 151.101.194.217 54113 (FASTLY)
1 76.223.31.44 16509 (AMAZON-02)
4 52.6.53.6 14618 (AMAZON-AES)
1 23.62.156.86 20940 (AKAMAI-ASN1)
43 12
Apex Domain
Subdomains
Transfer
17 pages.dev
recovery-css.pages.dev
397 KB
9 launchdarkly.com
app.launchdarkly.com — Cisco Umbrella Rank: 736
clientstream.launchdarkly.com — Cisco Umbrella Rank: 886
events.launchdarkly.com — Cisco Umbrella Rank: 907
2 KB
7 r2.dev
pub-2e86082d752843969e1c4572009c2ad7.r2.dev
28 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
11 KB
2 pantheonsite.io
dev-usins44.pantheonsite.io
204 KB
1 go-mpulse.net
s2.go-mpulse.net — Cisco Umbrella Rank: 5899
51 KB
1 aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2465
30 KB
1 schwab.com
sws-gateway-nr.schwab.com — Cisco Umbrella Rank: 26173 Failed
585 B
43 8
Domain Requested by
17 recovery-css.pages.dev pub-2e86082d752843969e1c4572009c2ad7.r2.dev
recovery-css.pages.dev
7 pub-2e86082d752843969e1c4572009c2ad7.r2.dev dev-usins44.pantheonsite.io
pub-2e86082d752843969e1c4572009c2ad7.r2.dev
4 events.launchdarkly.com pub-2e86082d752843969e1c4572009c2ad7.r2.dev
4 app.launchdarkly.com pub-2e86082d752843969e1c4572009c2ad7.r2.dev
2 cdnjs.cloudflare.com pub-2e86082d752843969e1c4572009c2ad7.r2.dev
2 dev-usins44.pantheonsite.io pub-2e86082d752843969e1c4572009c2ad7.r2.dev
1 clientstream.launchdarkly.com pub-2e86082d752843969e1c4572009c2ad7.r2.dev
1 s2.go-mpulse.net pub-2e86082d752843969e1c4572009c2ad7.r2.dev
1 ajax.aspnetcdn.com pub-2e86082d752843969e1c4572009c2ad7.r2.dev
1 sws-gateway-nr.schwab.com pub-2e86082d752843969e1c4572009c2ad7.r2.dev
43 10

This site contains links to these domains. Also see Links.

Domain
www.sipc.org
Subject Issuer Validity Valid
*.r2.dev
E1
2024-04-05 -
2024-07-04
3 months crt.sh
pantheonsite.io
R3
2024-04-22 -
2024-07-21
3 months crt.sh
recovery-css.pages.dev
GTS CA 1P5
2024-05-13 -
2024-08-11
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA
2024-01-30 -
2025-01-30
a year crt.sh
s2.go-mpulse.net
R3
2024-04-22 -
2024-07-21
3 months crt.sh
app.launchdarkly.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1
2024-04-04 -
2025-05-06
a year crt.sh
clientstream.launchdarkly.com
Amazon RSA 2048 M02
2023-08-10 -
2024-09-07
a year crt.sh
events.launchdarkly.com
Amazon ECDSA 256 M02
2023-06-21 -
2024-07-20
a year crt.sh
sws-gateway.schwab.com
DigiCert SHA2 Extended Validation Server CA
2023-12-01 -
2024-07-10
7 months crt.sh

This page contains 1 frames:

Primary Page: https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/alert.html
Frame ID: 1C8D9B7519096E850D0F0A279D3B8CFC
Requests: 40 HTTP requests in this frame

Screenshot

Page Title

Charles Schwab and Co., Inc | Log In

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

43
Requests

93 %
HTTPS

27 %
IPv6

8
Domains

10
Subdomains

12
IPs

3
Countries

723 kB
Transfer

1737 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

43 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request alert.html
pub-2e86082d752843969e1c4572009c2ad7.r2.dev/
585 B
894 B
Document
General
Full URL
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/alert.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94cf91b03200926678e3919417bc82ef354177dba5c90e9827513c9fc98e3509

Request headers

Accept-Language
en-NZ,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Accept-Ranges
bytes
CF-RAY
8845b06debd81c5e-AKL
Connection
keep-alive
Content-Length
585
Content-Type
text/html
Date
Wed, 15 May 2024 19:56:04 GMT
ETag
"e7719b8031741c0d0b688afd8c70fa6e"
Last-Modified
Tue, 30 Apr 2024 17:09:06 GMT
Server
cloudflare
Vary
Accept-Encoding
jquery.js
dev-usins44.pantheonsite.io/lean6/
284 KB
101 KB
Script
General
Full URL
https://dev-usins44.pantheonsite.io/lean6/jquery.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/alert.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-pantheon-styx-hostname
styx-fe4-b-7ddf44cd7c-5bzmh
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Wed, 15 May 2024 19:56:05 GMT
age
0
x-cache
MISS, MISS
expires
Wed, 15 May 2024 19:56:04 GMT
x-served-by
cache-chi-klot8100085-CHI, cache-akl10335-AKL
last-modified
Tue, 30 Apr 2024 16:28:43 GMT
server
nginx
x-timer
S1715802965.797294,VS0,VE445
etag
W/"66311c3b-47090"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
29ed2680-12f5-11ef-9dd0-7ebb7ea9bfcf
cache-control
no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
basic.js
dev-usins44.pantheonsite.io/lean6/
262 KB
103 KB
Script
General
Full URL
https://dev-usins44.pantheonsite.io/lean6/basic.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/alert.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8000::4 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
893d85c8d8eb97aabd401223e85829765d06b27b6f01ef546acd95a594d7992c
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-pantheon-styx-hostname
styx-fe4-b-7ddf44cd7c-5bzmh
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Wed, 15 May 2024 19:56:05 GMT
age
0
x-cache
MISS, MISS
expires
Wed, 15 May 2024 19:56:04 GMT
x-served-by
cache-chi-klot8100145-CHI, cache-akl10335-AKL
last-modified
Tue, 30 Apr 2024 16:28:27 GMT
server
nginx
x-timer
S1715802965.797311,VS0,VE444
etag
W/"66311c2b-41867"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
29ece291-12f5-11ef-9dd0-7ebb7ea9bfcf
cache-control
no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
24c08989-d267-4c8d-aca3-0c0552249434
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/
196 KB
0
Document
General
Full URL
blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Requested by
Host: dev-usins44.pantheonsite.io
URL: https://dev-usins44.pantheonsite.io/lean6/basic.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ce2a5d56f3be115147ea8a67f5a9980efc1faa7e82652f01b9941efc2f770c7e

Request headers

Accept-Language
en-NZ,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Content-Length
200861
Content-Type
text/html
favicon.ico
pub-2e86082d752843969e1c4572009c2ad7.r2.dev/
0
0

CharlesModern-Light.49518a871252ad9f5bc3.woff
sws-gateway-nr.schwab.com/ui/host/
0
0

Schwab-Icon-Font.e876f3a7a6cdedc7d4a7.ttf
sws-gateway-nr.schwab.com/ui/host/
0
0

main.css
recovery-css.pages.dev/css/
194 KB
28 KB
Stylesheet
General
Full URL
https://recovery-css.pages.dev/css/main.css
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f6f0e4f6fba35fe9449bc6d2699914628d46054ae65f23eb67373264ad648163
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:07 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"8df210dc2e88e835827bb3f5c71d2aa3"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mc1e0LGp4Y%2F21rbVPcxG98a7K7JJsALeamBZtQlEnXfaa8XhlarFoXxios0Hc3LjmtgKZOUk%2B49n6MbEPq3zuZ%2Bsvf95CuSdy1J4Pyf2YRSxD%2F9ygTJKdRyMNFMH4fXQq1rQMWEcdqQq"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8845b0767e9ca87a-SYD
alt-svc
h3=":443"; ma=86400
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/
30 KB
6 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1134939
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5631
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FbsvPsch9UK%2BW9GMr3WG7a8hxET4pKjDYi8eDjV33N5xCT8C2lF2UshSmyw%2FS16M1L%2F0rZQblOiBdmfRqre1O%2FAsjNeLiTwvkMlAG31iXwsDt7bKFkYTiDqlOwoDZIZvmHQpg5Eo"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8845b0761efc1c50-AKL
expires
Mon, 05 May 2025 19:56:05 GMT
0c1ffc60e859612ed8a62b13afca8e7be00137e8519
recovery-css.pages.dev/css/
152 KB
152 KB
Script
General
Full URL
https://recovery-css.pages.dev/css/0c1ffc60e859612ed8a62b13afca8e7be00137e8519
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
968e38d7b35a59420c4acc93bdee4a52610dbb4c49e4e23e372cdeff57f0219f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:08 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"6d76323cd594a15847a5dd5e79e60f7f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2xupc7i%2Fb1PDSFPrI5%2FVGteCSDNoGr9u7C45ajISxjT46Gd1KF8hxUqdrdiKeHDuuGumLjtHshUKIfUwyWG%2BeVGY2eW2K%2BqjXNRtvGFxS%2Ba8JOY1%2Fe0bOgMNqGoevrzMQdVjPGiJzn0C"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8845b0846b3ba87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
155392
CZVGX-3YDPM-X96ZN-Y57BM-BDYU2
recovery-css.pages.dev/css/
209 KB
209 KB
Script
General
Full URL
https://recovery-css.pages.dev/css/CZVGX-3YDPM-X96ZN-Y57BM-BDYU2
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e973e1b8e6b798931086cf372b83e40c417e33c0922087dad0eb2f89fa891ac
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:07 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"18ddb385484cadcd6b9fc11fef1961d1"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X%2FTM9fd31BYTxDnMNgGgB8v9jgpGc1YZtrPpuwOCvegWcUbEgtbjZWTlUylvaK2eM3K8Glh0u%2FtGzxChMXQ78Pm3R49%2BnUzCNfzJnTt28jG2sgoNKV10hTFBLZv9HEHlRPltmiRRe%2BQQ"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8845b0767ea4a87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
213725
CustomerWeb.css
recovery-css.pages.dev/css/
12 KB
2 KB
Stylesheet
General
Full URL
https://recovery-css.pages.dev/css/CustomerWeb.css
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee1444fd1cabdc9f4d7ef35a3247a4a1c4705cf1922bb85f39d8fe6ec1891eae
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:07 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6be99099e244f44f60f132c003155941"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3kYi6ls9k51hs1Y0deXC6XADVptnhcpLqE5hARWTmUPZFQNXRxR1sjD7OwexsC0bpzTtuxzYKsbBc5Rlgk1V%2FLQHCZ4bKAYYHitukNWOd75tJ5Zjsl3%2FXVGaI6LrdYg5zZpI0ZgS75YF"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8845b0767ea5a87a-SYD
alt-svc
h3=":443"; ma=86400
common.c64ad3713b4d1bc92301.js
recovery-css.pages.dev/css/
0
0
Script
General
Full URL
https://recovery-css.pages.dev/css/common.c64ad3713b4d1bc92301.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:06 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yKTCNUxmCWmfiYvbzA3Pk0%2FzaJIRhJbSiWrQd%2Fv%2B3JZQKVz4MRk7d%2FFdBr2r4DjkP05HGywoZ9%2Fnw78v%2BAcuIAw7IJly1evNwoBR66tU7m3rd94I%2Fbh7Unm9KmR1Q0hhsSwqcPgp2xes"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0767ea6a87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
2.1ac653caecddfc912db2.js
recovery-css.pages.dev/css/
0
0
Script
General
Full URL
https://recovery-css.pages.dev/css/2.1ac653caecddfc912db2.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:06 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mHV5scd3w%2BzW52savw8C1DHEEf%2FGb6EAqYp9CVFMzgHTUoNElJeqjYa4%2BA%2BIshdS0Bmt6VFUgXuIJffeDyzFBBXMuFnZoe505cYPpcOxe8mwYcaJhGQlUN%2BBqfQHewR5htY0F%2Fwi3uC%2F"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0767e9ea87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
GlancePresenceVisitor_6.12.0M.js
recovery-css.pages.dev/css/
0
0
Script
General
Full URL
https://recovery-css.pages.dev/css/GlancePresenceVisitor_6.12.0M.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:06 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=it41RrqA7vlPoQ%2FoAXZSFCp%2FbtKb1txVSc2yzMbrRUPNI0jcnyYSdWLluBUq3zfyh6PfMuLeKoKwG%2FJpKLycycZjWjAs8sGCsC9SblIAPXliETYwYCCd%2B0N4iIWPqW%2F9byoiAmELf0g9"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0767e9fa87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
runtime.b48c8ecddfc347fb9e14.js
recovery-css.pages.dev/css/
0
0
Script
General
Full URL
https://recovery-css.pages.dev/css/runtime.b48c8ecddfc347fb9e14.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:06 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DXOJkjONEy2M6Fvw6ugqEK6HvNvcpwIZi0q%2B%2FFfyXsiwTw36hnV7BDWIcFWYgehAJB4lV%2BM3Ed%2BozoCOrGj7JPNNpY6q0YXZgmBXc4vNphoCPJuV2wxL6qoiUcTeOSjFb7r0wtPQCqO6"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0767ea0a87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
p0lyf1lls.401e2afa8763afffab21.js
recovery-css.pages.dev/css/
0
0
Script
General
Full URL
https://recovery-css.pages.dev/css/p0lyf1lls.401e2afa8763afffab21.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:06 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KolZJ5dv9dtbsQPoutuMTGnXPrTaFE1TE3uxDDIKXYlasPiuP%2BMTzErWjEjhRJ1QgW6Di7Wfg%2Bv0uBunanK6K7IicUMVNQLX23hW9fLBe0UIrYpyJdK01tjh11dMhWjFwO7Fhza3rn9v"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0767ea1a87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
scripts.3b517bdbcd910ce71d98.js
recovery-css.pages.dev/css/
0
0
Script
General
Full URL
https://recovery-css.pages.dev/css/scripts.3b517bdbcd910ce71d98.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:06 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YcD9wWGi%2F2r7vCEtNdnDmbsD5YgTGvxDcfNGUV96bA%2BfqYG1RWXUrCGos9fpjQOF%2FRNOB%2BG8FRC2nzYLPHyrclURc9QHXiaDuXy8Xd2LmRg2Bd0LfNE70oPsVAsg26Ma7HzTbDT8AkWf"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0767ea2a87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
main.83520f44fbed8c8b93bb.js
recovery-css.pages.dev/css/
0
0
Script
General
Full URL
https://recovery-css.pages.dev/css/main.83520f44fbed8c8b93bb.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:06 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Rk%2BDk2Fyum%2B1AyZCCQcZqmrfxNfVfk1dGAeOk2uFmE92RcztdLvlMPawjoayZvkVqEH%2B7yVP311s%2BZ7uHWjif4fUNBaOjoATHUSv7c%2Bru2biwX8IOfqNqMPBc3qnv7Iutuv1mbm54W2"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0767ea3a87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/
85 KB
30 KB
Script
General
Full URL
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
117.18.232.200 , Australia, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nwa/E7A1) /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4418761
x-cache
HIT
content-length
30394
x-xss-protection
1; mode=block
last-modified
Mon, 22 Jan 2018 19:27:49 GMT
server
ECAcc (nwa/E7A1)
etag
"80288516b793d31:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/
20 KB
5 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
670866
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
4517
last-modified
Mon, 04 May 2020 16:11:47 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec3-4e98"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dCd2qBj3d%2Fp4jIjN6Ga%2F5yxTJERS7x9auwxuoX08aN3xmw7OSTp7Dd1qDIhzDT%2BdgzcXF%2BcqYU8fstmOYCl0NH1lNiUOkxCzyUpkb%2FWDWsoyqwVSK4peVJOmkfZlUSxXKlUKvpGo"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8845b0761ef91c50-AKL
expires
Mon, 05 May 2025 19:56:05 GMT
CZVGX-3YDPM-X96ZN-Y57BM-BDYU2
s2.go-mpulse.net/boomerang/
209 KB
51 KB
Script
General
Full URL
https://s2.go-mpulse.net/boomerang/CZVGX-3YDPM-X96ZN-Y57BM-BDYU2
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1415:11:49c::2682 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4e973e1b8e6b798931086cf372b83e40c417e33c0922087dad0eb2f89fa891ac

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:07 GMT
content-encoding
br
customappheader
mpulse-ab-boomr__git__2226cf4__git__2226cf4__p19.alsi10-lite
last-modified
Fri, 12 Apr 2024 01:42:36 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
timing-allow-origin
*
content-length
52061
GlancePresenceVisitor_6.12.0M.js
recovery-css.pages.dev/css/
0
0
Script
General
Full URL
https://recovery-css.pages.dev/css/GlancePresenceVisitor_6.12.0M.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:07 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nTDjtItgst2CGO1Zytj2viTStIgzBtCdH2PLpC0yPIpoEVr3MEgWCrJzC2wpcbcEAsI3SxW%2BNhqrNnqDSGFtkgXAwCi%2BIT9Qhe2Q9N0fb29WSiqd%2B%2FX2yGO5hIJsMKmocBnLIXYkaIG7"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0849b4ea87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
62474b9ceca6dc15256d3ae3
app.launchdarkly.com/sdk/goals/
0
0
Preflight
General
Full URL
https://app.launchdarkly.com/sdk/goals/62474b9ceca6dc15256d3ae3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
x-launchdarkly-user-agent
Access-Control-Request-Method
GET
Origin
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-headers
Accept,Content-Type,Content-Length,Accept-Encoding,Authorization,X-Requested-With,X-LD-Private,X-LD-AccountId,X-LD-EnvId,X-LD-PrjId,X-LaunchDarkly-Event-Schema,X-LaunchDarkly-User-Agent,X-LaunchDarkly-Wrapper,LD-API-Version,X-LaunchDarkly-Tags
access-control-allow-methods
GET, OPTIONS, HEAD
access-control-allow-origin
*
access-control-max-age
3600
age
0
allow
GET, OPTIONS, HEAD
content-encoding
gzip
content-length
23
date
Wed, 15 May 2024 19:56:08 GMT
ld-region
us-east-1
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 varnish
x-cache
HIT
x-cache-hits
4
x-served-by
cache-akl10335-AKL
x-timer
S1715802968.000082,VS0,VE0
eyJrZXkiOiIxOGY3ZGQzOGY2Ny0yMjM2IiwiY3VzdG9tIjp7ImNsaWVudElkIjoiIiwiYnJvd3Nlck5hbWUiOiJjaHJvbWUiLCJvcyI6IldpbmRvd3MiLCJjb29raWVzIjpbXX0sImFub255bW91cyI6dHJ1ZX0
app.launchdarkly.com/sdk/evalx/62474b9ceca6dc15256d3ae3/contexts/
0
0
Preflight
General
Full URL
https://app.launchdarkly.com/sdk/evalx/62474b9ceca6dc15256d3ae3/contexts/eyJrZXkiOiIxOGY3ZGQzOGY2Ny0yMjM2IiwiY3VzdG9tIjp7ImNsaWVudElkIjoiIiwiYnJvd3Nlck5hbWUiOiJjaHJvbWUiLCJvcyI6IldpbmRvd3MiLCJjb29raWVzIjpbXX0sImFub255bW91cyI6dHJ1ZX0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
x-launchdarkly-user-agent
Access-Control-Request-Method
GET
Origin
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-headers
Accept,Content-Type,Content-Length,Accept-Encoding,Authorization,X-Requested-With,X-LD-Private,X-LD-AccountId,X-LD-EnvId,X-LD-PrjId,X-LaunchDarkly-Event-Schema,X-LaunchDarkly-User-Agent,X-LaunchDarkly-Wrapper,LD-API-Version,X-LaunchDarkly-Tags
access-control-allow-methods
GET, OPTIONS, HEAD
access-control-allow-origin
*
access-control-max-age
3600
age
0
allow
GET, OPTIONS, HEAD
content-encoding
gzip
content-length
23
date
Wed, 15 May 2024 19:56:08 GMT
ld-region
us-east-1
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 varnish
x-cache
HIT
x-cache-hits
2
x-served-by
cache-akl10335-AKL
x-timer
S1715802968.000005,VS0,VE0
truncated
/
38 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5e3d5246b17e19e65385092db07554d8e1c5c4a226a6d7f97824b8e1e8571e34

Request headers

Accept-Language
en-NZ,en;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
62474b9ceca6dc15256d3ae3
app.launchdarkly.com/sdk/goals/
2 B
179 B
XHR
General
Full URL
https://app.launchdarkly.com/sdk/goals/62474b9ceca6dc15256d3ae3
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
X-LaunchDarkly-User-Agent
JSClient/3.1.2
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
via
1.1 varnish
date
Wed, 15 May 2024 19:56:08 GMT
content-md5
d751713988987e9331980363e24189ce
age
0
x-cache
HIT
content-length
26
x-served-by
cache-akl10335-AKL
x-timer
S1715802968.032452,VS0,VE1
etag
"d751713988987e9331980363e24189ce"
ld-region
us-east-1
access-control-max-age
300
access-control-allow-methods
GET, OPTIONS, HEAD
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0
vary
Accept-Encoding
accept-ranges
bytes
access-control-allow-headers
Accept,Content-Type,Content-Length,Accept-Encoding,Authorization,X-Requested-With,X-LD-Private,X-LD-AccountId,X-LD-EnvId,X-LD-PrjId,X-LaunchDarkly-Event-Schema,X-LaunchDarkly-User-Agent,X-LaunchDarkly-Wrapper,LD-API-Version,X-LaunchDarkly-Tags
x-cache-hits
0
/
pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/config/sdk/
27 KB
27 KB
XHR
General
Full URL
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/config/sdk/
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 15 May 2024 19:56:09 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
8845b0860d2e1c59-AKL
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
runtime.b48c8ecddfc347fb9e14.js
pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/
0
0
Script
General
Full URL
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/runtime.b48c8ecddfc347fb9e14.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 15 May 2024 19:56:08 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
8845b0860eb47257-AKL
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
p0lyf1lls.401e2afa8763afffab21.js
pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/
0
0
Script
General
Full URL
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/p0lyf1lls.401e2afa8763afffab21.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 15 May 2024 19:56:08 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
8845b0860bdc1c5d-AKL
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
scripts.3b517bdbcd910ce71d98.js
pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/
0
0
Script
General
Full URL
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/scripts.3b517bdbcd910ce71d98.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 15 May 2024 19:56:09 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
8845b0860c761c53-AKL
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
main.83520f44fbed8c8b93bb.js
pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/
0
0
Script
General
Full URL
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/main.83520f44fbed8c8b93bb.js
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 15 May 2024 19:56:08 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
8845b0860efe1c4d-AKL
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
eyJrZXkiOiIxOGY3ZGQzOGY2Ny0yMjM2IiwiY3VzdG9tIjp7ImNsaWVudElkIjoiIiwiYnJvd3Nlck5hbWUiOiJjaHJvbWUiLCJvcyI6IldpbmRvd3MiLCJjb29raWVzIjpbXX0sImFub255bW91cyI6dHJ1ZX0
app.launchdarkly.com/sdk/evalx/62474b9ceca6dc15256d3ae3/contexts/
7 KB
2 KB
XHR
General
Full URL
https://app.launchdarkly.com/sdk/evalx/62474b9ceca6dc15256d3ae3/contexts/eyJrZXkiOiIxOGY3ZGQzOGY2Ny0yMjM2IiwiY3VzdG9tIjp7ImNsaWVudElkIjoiIiwiYnJvd3Nlck5hbWUiOiJjaHJvbWUiLCJvcyI6IldpbmRvd3MiLCJjb29raWVzIjpbXX0sImFub255bW91cyI6dHJ1ZX0
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a11f3e57a447ff088d9fce34992f34403bcc9fca51038cdc113ce4ad5bda11a1

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
X-LaunchDarkly-User-Agent
JSClient/3.1.2
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:08 GMT
content-encoding
gzip
via
1.1 varnish
age
0
x-cache
MISS
content-length
1179
x-served-by
cache-akl10330-AKL, cache-akl10335-AKL
x-timer
S1715802968.032316,VS0,VE9
etag
"36dbb"
access-control-max-age
3600
access-control-allow-methods
OPTIONS, GET
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0
vary
Authorization, Accept-Encoding
accept-ranges
bytes
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization, X-Requested-With, X-LD-Private, X-LD-AccountId, X-LD-EnvId, X-LD-PrjId, X-LaunchDarkly-Event-Schema, X-LaunchDarkly-User-Agent, X-LaunchDarkly-Wrapper, Ld-Api-Version
x-cache-hits
0
img.png
recovery-css.pages.dev/css/
4 KB
5 KB
Image
General
Full URL
https://recovery-css.pages.dev/css/img.png
Requested by
Host: recovery-css.pages.dev
URL: https://recovery-css.pages.dev/css/main.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2662967d7063779967a04c5dad1e33c94e9d20115771a96f7cb4e8fd22642621
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://recovery-css.pages.dev/css/main.css
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:08 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"676c333af63bcf0e88c3c72272d6509e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fOm5MjKZTt9XkHOMTE0P59Ytitiavxswo%2Bg5TH1iibhAY%2Bpyr4GEG7kj7PFqc1fMsj3yIsZMMfyiCe47gtjwcCnZ7%2FL9Ri0KSs3Er5Ij6bn1%2FJgMqFQL2awsQTu5HJPtevbPNEScrKls"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8845b085bbb1a87a-SYD
alt-svc
h3=":443"; ma=86400
content-length
4186
Schwab-Icon-Font.e876f3a7a6cdedc7d4a7.ttf
recovery-css.pages.dev/css/
0
0
Font
General
Full URL
https://recovery-css.pages.dev/css/Schwab-Icon-Font.e876f3a7a6cdedc7d4a7.ttf?gvl1yz
Requested by
Host: recovery-css.pages.dev
URL: https://recovery-css.pages.dev/css/main.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://recovery-css.pages.dev/css/main.css
Origin
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:08 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LTX9ew9Y3nwL7nqtDEC3CyIsxJsaZoJnuCbYLwwR%2BEc2BRm7mkTHu5s7RvO2%2FBf4IhVKnKmyipgOHnQpsYMWkUNQPXLBBvqRYv%2BNsW6uUM8hsTv3zumw3YsfW86IP0guaqwCodRpCGd5"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0864a79dfbd-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
CharlesModern-Light.49518a871252ad9f5bc3.woff
recovery-css.pages.dev/css/
0
0
Font
General
Full URL
https://recovery-css.pages.dev/css/CharlesModern-Light.49518a871252ad9f5bc3.woff
Requested by
Host: recovery-css.pages.dev
URL: https://recovery-css.pages.dev/css/main.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://recovery-css.pages.dev/css/main.css
Origin
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:08 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9NEntNH9qqdz9ckm%2BG66xT6bmLbpqcmFdqNz7PS95qb3y0SBa%2FJOwMKaq%2BfKsfiKa25OahiK9JRm6pyjs%2FJWPVTxNglnwgBLjvivdmYpFJ%2F5LQQsJpy5BZTTApnIaDrX6nieo%2FOwZEuz"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b0864a7adfbd-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
eyJrZXkiOiIxOGY3ZGQzOGY2Ny0yMjM2IiwiY3VzdG9tIjp7ImNsaWVudElkIjoiIiwiYnJvd3Nlck5hbWUiOiJjaHJvbWUiLCJvcyI6IldpbmRvd3MiLCJjb29raWVzIjpbXX0sImFub255bW91cyI6dHJ1ZX0
clientstream.launchdarkly.com/eval/62474b9ceca6dc15256d3ae3/
7 KB
0
EventSource
General
Full URL
https://clientstream.launchdarkly.com/eval/62474b9ceca6dc15256d3ae3/eyJrZXkiOiIxOGY3ZGQzOGY2Ny0yMjM2IiwiY3VzdG9tIjp7ImNsaWVudElkIjoiIiwiYnJvd3Nlck5hbWUiOiJjaHJvbWUiLCJvcyI6IldpbmRvd3MiLCJjb29raWVzIjpbXX0sImFub255bW91cyI6dHJ1ZX0
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.31.44 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a1370dc23e25e46ce.awsglobalaccelerator.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept
text/event-stream
Cache-Control
no-cache
Referer
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:08 GMT
strict-transport-security
max-age=31536000; includeSubDomains
ld-region
ap-southeast-1
access-control-max-age
300
access-control-allow-methods
GET,OPTIONS
content-type
text/event-stream; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
x-content-length
accept-ranges
bytes
access-control-allow-headers
Accept,Content-Type,Content-Length,Accept-Encoding,Cache-Control,X-Requested-With,X-LaunchDarkly-User-Agent,X-LaunchDarkly-Wrapper
Schwab-Icon-Font.91cd0da84ede93d98cff.woff
recovery-css.pages.dev/css/
0
0
Font
General
Full URL
https://recovery-css.pages.dev/css/Schwab-Icon-Font.91cd0da84ede93d98cff.woff?gvl1yz
Requested by
Host: recovery-css.pages.dev
URL: https://recovery-css.pages.dev/css/main.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://recovery-css.pages.dev/css/main.css
Origin
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:08 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fRwXA5fBAVcHTIm0Gt%2FbQ9b%2FOISQa5feQX%2BgWCKQSdA7b1m1kQ7c8xB1uTyfp8YGcWVe4suSosk4fSWIkZeZoY3TWKZLwpg%2FZE4NG8d9pvRFC7K44D7e2x1tnfkvcAzlkmsGj0KYdDrJ"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b086eac4dfbd-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
CharlesModern-Light.e4ef538af8b91232cea7.ttf
recovery-css.pages.dev/css/
0
0
Font
General
Full URL
https://recovery-css.pages.dev/css/CharlesModern-Light.e4ef538af8b91232cea7.ttf
Requested by
Host: recovery-css.pages.dev
URL: https://recovery-css.pages.dev/css/main.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://recovery-css.pages.dev/css/main.css
Origin
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:08 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pp8yYzCdTthf6%2BjJfyBXM1K1ApsKC%2FYzGsI4icR9ResqxxpcSxWw0QxMGQjsTuHIl2q1pldbXgzo9Dsmos5iluBIMzdN1oMyjmkYg%2F9s82pGwcXkTrJr3b6JHTsPxwdJJO3B9I%2Fvl2AY"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
8845b086eac8dfbd-SYD
alt-svc
h3=":443"; ma=86400
content-length
0
62474b9ceca6dc15256d3ae3
events.launchdarkly.com/events/diagnostic/
0
0
Preflight
General
Full URL
https://events.launchdarkly.com/events/diagnostic/62474b9ceca6dc15256d3ae3
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.6.53.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-6-53-6.compute-1.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-launchdarkly-user-agent
Access-Control-Request-Method
POST
Origin
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Accept,Content-Type,Content-Length,Accept-Encoding,X-LaunchDarkly-Event-Schema,X-LaunchDarkly-User-Agent,X-LaunchDarkly-Payload-ID,X-LaunchDarkly-Wrapper,X-LaunchDarkly-Tags
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Date
access-control-max-age
300
date
Wed, 15 May 2024 19:56:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains
62474b9ceca6dc15256d3ae3
events.launchdarkly.com/events/diagnostic/
0
358 B
XHR
General
Full URL
https://events.launchdarkly.com/events/diagnostic/62474b9ceca6dc15256d3ae3
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.6.53.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-6-53-6.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language
en-NZ,en;q=0.9;q=0.9
X-LaunchDarkly-User-Agent
JSClient/3.1.2
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/json
Referer
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
300
access-control-allow-methods
POST,OPTIONS
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
Date
access-control-allow-headers
Accept,Content-Type,Content-Length,Accept-Encoding,X-LaunchDarkly-Event-Schema,X-LaunchDarkly-User-Agent,X-LaunchDarkly-Payload-ID,X-LaunchDarkly-Wrapper,X-LaunchDarkly-Tags
content-length
0
favicon.png
sws-gateway-nr.schwab.com/ui/host/assets/icons/
1 KB
585 B
Other
General
Full URL
https://sws-gateway-nr.schwab.com/ui/host/assets/icons/favicon.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.62.156.86 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-62-156-86.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
11c9dd52aa0864cd40fa2ab09029613f615aa3f486eb7deb5057db755edd0c20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language
en-NZ,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 15 May 2024 19:56:09 GMT
last-modified
Fri, 19 Apr 2024 14:15:45 GMT
etag
"66227c91-57e"
vary
Accept-Encoding
content-type
image/png
f5ip
162.93.231.254
server-timing
cdn-cache; desc=HIT, edge; dur=198, origin; dur=0, ak_p; desc="1715802969572_389979218_20285870_19950_12588_60_141_219";dur=1
accept-ranges
bytes
content-length
247
62474b9ceca6dc15256d3ae3
events.launchdarkly.com/events/bulk/
0
358 B
XHR
General
Full URL
https://events.launchdarkly.com/events/bulk/62474b9ceca6dc15256d3ae3
Requested by
Host: pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.6.53.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-6-53-6.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
X-LaunchDarkly-Payload-ID
2db35670-12f5-11ef-b847-a990c90b6d1e
X-LaunchDarkly-Event-Schema
4
Accept-Language
en-NZ,en;q=0.9;q=0.9
X-LaunchDarkly-User-Agent
JSClient/3.1.2
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/json
Referer
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 19:56:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
300
access-control-allow-methods
POST,OPTIONS
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
Date
access-control-allow-headers
Accept,Content-Type,Content-Length,Accept-Encoding,X-LaunchDarkly-Event-Schema,X-LaunchDarkly-User-Agent,X-LaunchDarkly-Payload-ID,X-LaunchDarkly-Wrapper,X-LaunchDarkly-Tags
content-length
0
62474b9ceca6dc15256d3ae3
events.launchdarkly.com/events/bulk/
0
0
Preflight
General
Full URL
https://events.launchdarkly.com/events/bulk/62474b9ceca6dc15256d3ae3
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
52.6.53.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-6-53-6.compute-1.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-launchdarkly-event-schema,x-launchdarkly-payload-id,x-launchdarkly-user-agent
Access-Control-Request-Method
POST
Origin
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Accept,Content-Type,Content-Length,Accept-Encoding,X-LaunchDarkly-Event-Schema,X-LaunchDarkly-User-Agent,X-LaunchDarkly-Payload-ID,X-LaunchDarkly-Wrapper,X-LaunchDarkly-Tags
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Date
access-control-max-age
300
date
Wed, 15 May 2024 19:56:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
pub-2e86082d752843969e1c4572009c2ad7.r2.dev
URL
https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/favicon.ico
Domain
sws-gateway-nr.schwab.com
URL
https://sws-gateway-nr.schwab.com/ui/host/CharlesModern-Light.49518a871252ad9f5bc3.woff
Domain
sws-gateway-nr.schwab.com
URL
https://sws-gateway-nr.schwab.com/ui/host/Schwab-Icon-Font.e876f3a7a6cdedc7d4a7.ttf?gvl1yz

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| LDClient object| LmsSdk object| BOOMR_config string| BOOMR_API_key object| BOOMR boolean| externalStylesEnabled function| $ function| jQuery number| count number| counts function| BOOMR_check_doc_domain object| ErrorStackParser object| UserTimingCompression object| BOOMR_mq object| boostrap-data number| BOOMR_onload

0 Cookies

23 Console Messages

Source Level URL
Text
javascript error URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Message:
Access to font at 'https://sws-gateway-nr.schwab.com/ui/host/CharlesModern-Light.49518a871252ad9f5bc3.woff' from origin 'https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://sws-gateway-nr.schwab.com' that is not equal to the supplied origin.
network error URL: https://sws-gateway-nr.schwab.com/ui/host/CharlesModern-Light.49518a871252ad9f5bc3.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Message:
Access to font at 'https://sws-gateway-nr.schwab.com/ui/host/Schwab-Icon-Font.e876f3a7a6cdedc7d4a7.ttf?gvl1yz' from origin 'https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://sws-gateway-nr.schwab.com' that is not equal to the supplied origin.
network error URL: https://sws-gateway-nr.schwab.com/ui/host/Schwab-Icon-Font.e876f3a7a6cdedc7d4a7.ttf?gvl1yz
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://recovery-css.pages.dev/css/GlancePresenceVisitor_6.12.0M.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/2.1ac653caecddfc912db2.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/p0lyf1lls.401e2afa8763afffab21.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/scripts.3b517bdbcd910ce71d98.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/runtime.b48c8ecddfc347fb9e14.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/main.83520f44fbed8c8b93bb.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/common.c64ad3713b4d1bc92301.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/GlancePresenceVisitor_6.12.0M.js
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434(Line 332)
Message:
Refused to execute script from 'https://recovery-css.pages.dev/css/CZVGX-3YDPM-X96ZN-Y57BM-BDYU2' because its MIME type ('application/octet-stream') is not executable, and strict MIME type checking is enabled.
network error URL: https://recovery-css.pages.dev/css/Schwab-Icon-Font.e876f3a7a6cdedc7d4a7.ttf?gvl1yz
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/CharlesModern-Light.49518a871252ad9f5bc3.woff
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/Schwab-Icon-Font.91cd0da84ede93d98cff.woff?gvl1yz
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://recovery-css.pages.dev/css/CharlesModern-Light.e4ef538af8b91232cea7.ttf
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/runtime.b48c8ecddfc347fb9e14.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/p0lyf1lls.401e2afa8763afffab21.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
security error URL: blob:https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/24c08989-d267-4c8d-aca3-0c0552249434
Message:
Refused to execute script from 'https://recovery-css.pages.dev/css/0c1ffc60e859612ed8a62b13afca8e7be00137e8519' because its MIME type ('application/octet-stream') is not executable, and strict MIME type checking is enabled.
network error URL: https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/main.83520f44fbed8c8b93bb.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/config/sdk/
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-2e86082d752843969e1c4572009c2ad7.r2.dev/ui/host/scripts.3b517bdbcd910ce71d98.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
app.launchdarkly.com
cdnjs.cloudflare.com
clientstream.launchdarkly.com
dev-usins44.pantheonsite.io
events.launchdarkly.com
pub-2e86082d752843969e1c4572009c2ad7.r2.dev
recovery-css.pages.dev
s2.go-mpulse.net
sws-gateway-nr.schwab.com
pub-2e86082d752843969e1c4572009c2ad7.r2.dev
sws-gateway-nr.schwab.com

104.17.25.14
117.18.232.200
151.101.194.217
172.66.44.113
23.62.156.86
2600:1415:11:49c::2682
2606:4700::6812:323
2620:12a:8000::4
52.6.53.6
76.223.31.44
11c9dd52aa0864cd40fa2ab09029613f615aa3f486eb7deb5057db755edd0c20
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2662967d7063779967a04c5dad1e33c94e9d20115771a96f7cb4e8fd22642621
4e973e1b8e6b798931086cf372b83e40c417e33c0922087dad0eb2f89fa891ac
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
5e3d5246b17e19e65385092db07554d8e1c5c4a226a6d7f97824b8e1e8571e34
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
893d85c8d8eb97aabd401223e85829765d06b27b6f01ef546acd95a594d7992c
94cf91b03200926678e3919417bc82ef354177dba5c90e9827513c9fc98e3509
968e38d7b35a59420c4acc93bdee4a52610dbb4c49e4e23e372cdeff57f0219f
a11f3e57a447ff088d9fce34992f34403bcc9fca51038cdc113ce4ad5bda11a1
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
ce2a5d56f3be115147ea8a67f5a9980efc1faa7e82652f01b9941efc2f770c7e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee1444fd1cabdc9f4d7ef35a3247a4a1c4705cf1922bb85f39d8fe6ec1891eae
f6f0e4f6fba35fe9449bc6d2699914628d46054ae65f23eb67373264ad648163