urlscan.io logo urlscan.io
SecurityTrails logo

remboursement-can.com Open in urlscan Pro
111.90.144.61  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://remboursement-can.com/bank/atb/index.htm
Submission: On July 23 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 4 countries across 8 domains to perform 33 HTTP transactions. The main IP is 111.90.144.61, located in Malaysia and belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY. The main domain is remboursement-can.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 20th 2018. Valid for: 3 months.
This is the only time remboursement-can.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ATB Financial (Banking)

Domain & IP information

IP Address AS Autonomous System
21 111.90.144.61 45839 (SHINJIRU-...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 54.230.92.222 16509 (AMAZON-02)
1 23.38.53.224 20940 (AKAMAI-ASN1)
2 52.216.233.181 16509 (AMAZON-02)
1 192.41.58.142 13951 (CENTER-SEVEN)
2 104.111.228.222 16625 (AKAMAI-AS)
33 9
21    111.90.144.61 (Malaysia)

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: shark1.ip-asia.com
remboursement-can.com
1    2a00:1450:4001:81d::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
2    2a00:1450:4001:814::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    54.230.92.222 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-92-222.fra2.r.cloudfront.net
script.crazyegg.com
1    23.38.53.224 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-53-224.deploy.static.akamaitechnologies.com
use.typekit.net
2    52.216.233.181 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
1    192.41.58.142 (Lindon, United States)

ASN13951 (CENTER-SEVEN - C7 Data Centers, Inc., US)
PTR: 192-41-58-142.moneydesktop.com
analytics.moneydesktop.com
2    104.111.228.222 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-228-222.deploy.static.akamaitechnologies.com
zncgfzahqp5dgc7mr-atbfeedback.siteintercept.qualtrics.com
zn0xidhqnpghfjswn-atbfeedback.siteintercept.qualtrics.com
Domain Requested by
21 remboursement-can.com remboursement-can.com
2 s3.amazonaws.com remboursement-can.com
2 www.google-analytics.com remboursement-can.com
1 zn0xidhqnpghfjswn-atbfeedback.siteintercept.qualtrics.com remboursement-can.com
1 zncgfzahqp5dgc7mr-atbfeedback.siteintercept.qualtrics.com remboursement-can.com
1 analytics.moneydesktop.com remboursement-can.com
1 use.typekit.net www.google-analytics.com
1 script.crazyegg.com remboursement-can.com
1 www.googletagmanager.com remboursement-can.com
33 9

This site contains links to these domains. Also see Links.

Domain
www.atbonline.com
get.atb.com
analytics.moneydesktop.com
www.atb.com
Subject Issuer Validity Valid
remboursement-can.com
cPanel, Inc. Certification Authority		 2018-07-20 -
2018-10-18		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://remboursement-can.com/bank/atb/index.htm
Frame ID: F569AA2365F0DCB56F46BDCF617EC281
Requests: 37 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 50%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i
Overall confidence: 100%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 50%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
  • env /^google_tag_manager$/i
Overall confidence: 100%
Detected patterns
  • env /^Typekit$/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

33
Requests

64 %
HTTPS

25 %
IPv6

8
Domains

9
Subdomains

9
IPs

4
Countries

745 kB
Transfer

1635 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

33 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.htm
remboursement-can.com/bank/atb/ 		32 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
fffe11162e31140fdef1634356cd0a4944e84be9803bdafcd032e326ca5ed606
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
remboursement-can.com
:scheme
https
:path
/bank/atb/index.htm
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
F569AA2365F0DCB56F46BDCF617EC281

Response headers

status
200
server
nginx
date
Mon, 23 Jul 2018 00:41:50 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Fri, 11 May 2018 21:25:59 GMT
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-nginx-cache-status
MISS
x-server-powered-by
Engintron
content-encoding
gzip
0832.js
remboursement-can.com/bank/atb/index_perso_files/ 		0
177 B 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/0832.js
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path
/bank/atb/index_perso_files/0832.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
content-type
application/javascript
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
0
expires
Wed, 22 Aug 2018 00:41:50 GMT
analytics.js
remboursement-can.com/bank/atb/index_perso_files/ 		34 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/analytics.js
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675

Request headers

:path
/bank/atb/index_perso_files/analytics.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000
expires
Wed, 22 Aug 2018 00:41:50 GMT
gtm.js
remboursement-can.com/bank/atb/index_perso_files/ 		63 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/gtm.js
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
1aa631b7334bf31e1895b6323166e7395da566daa84b2306f7d10d803d0cb0d8

Request headers

:path
/bank/atb/index_perso_files/gtm.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000
expires
Wed, 22 Aug 2018 00:41:50 GMT
commonScripts_D8041FBA7F6BE8E6DB4D9BA2033E3D1A.js
remboursement-can.com/bank/atb/index_perso_files/ 		427 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/commonScripts_D8041FBA7F6BE8E6DB4D9BA2033E3D1A.js
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
182bcf0b9132cf7234bb8661aa95fd1ccfbe5382b847dbdbbba40aaa69095d3b

Request headers

:path
/bank/atb/index_perso_files/commonScripts_D8041FBA7F6BE8E6DB4D9BA2033E3D1A.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000
expires
Wed, 22 Aug 2018 00:41:50 GMT
qia1usm.js
remboursement-can.com/bank/atb/index_perso_files/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/qia1usm.js
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
62dce705e9c805154e4a3f639b212b39a78bfff6c3da54d4eefa7756fb951578

Request headers

:path
/bank/atb/index_perso_files/qia1usm.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000
expires
Wed, 22 Aug 2018 00:41:50 GMT
publicScripts_BB370365945C5CC150F3847916C7A67F.js
remboursement-can.com/bank/atb/index_perso_files/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/publicScripts_BB370365945C5CC150F3847916C7A67F.js
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
f75e9e828d89462f2e9a93cee9de296e877df758b361f4eb80ba9c7971ffe4c9

Request headers

:path
/bank/atb/index_perso_files/publicScripts_BB370365945C5CC150F3847916C7A67F.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000
expires
Wed, 22 Aug 2018 00:41:50 GMT
fonts.css
remboursement-can.com/bank/atb/index_perso_files/ 		100 KB
75 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/fonts.css
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
bc1d20c0f75e6882604dc25043446dcdf17c5634c98b56a667b2c56779b83b5a

Request headers

:path
/bank/atb/index_perso_files/fonts.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=2592000
expires
Wed, 22 Aug 2018 00:41:50 GMT
commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
remboursement-can.com/bank/atb/index_perso_files/ 		281 KB
53 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
68f2754a833a25d7b577b98dbd1995d2ee46122c912750991b6e0e2aac71f809

Request headers

:path
/bank/atb/index_perso_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=2592000
expires
Wed, 22 Aug 2018 00:41:50 GMT
publicStyles_B4C3D7BDA526D6057A111A01AA17270B.css
remboursement-can.com/bank/atb/index_perso_files/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/publicStyles_B4C3D7BDA526D6057A111A01AA17270B.css
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
da369623e388d7bf36bb00ef742ba81af294e4b10cab7a27ec1f216c333f2710

Request headers

:path
/bank/atb/index_perso_files/publicStyles_B4C3D7BDA526D6057A111A01AA17270B.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=2592000
expires
Wed, 22 Aug 2018 00:41:50 GMT
header-gradient.jpg
remboursement-can.com/bank/atb/index_perso_files/ 		760 B
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/header-gradient.jpg
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
72da7b996e10c7a2a69be39a1a403fbc0eea85182551d12c1b47e02821a86411

Request headers

:path
/bank/atb/index_perso_files/header-gradient.jpg
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
content-type
image/jpeg
status
200
cache-control
max-age=5184000
accept-ranges
bytes
content-length
760
expires
Fri, 21 Sep 2018 00:41:50 GMT
DESGetFiles.aspx
remboursement-can.com/bank/atb/index_perso_files/ 		0
0
DESGetFiles(1).aspx
remboursement-can.com/bank/atb/index_perso_files/ 		70 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/DESGetFiles(1).aspx
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
385869883cbe19d8cd31410e7328bb6c2050ee2697115fa20c93bcbf512886ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/bank/atb/index_perso_files/DESGetFiles(1).aspx
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 23 Jul 2018 00:41:50 GMT
x-content-type-options
nosniff
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
x-nginx-cache-status
MISS
status
200
x-server-powered-by
Engintron
accept-ranges
bytes
content-length
72016
x-xss-protection
1; mode=block
error.gif
remboursement-can.com/bank/atb/index_perso_files/ 		129 B
317 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/error.gif
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
205c6b68b92fd475a63ba98b6e120351ae70d3e3b7572523bb9ebd1727b0e42f

Request headers

:path
/bank/atb/index_perso_files/error.gif
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
content-type
image/gif
status
200
cache-control
max-age=5184000
accept-ranges
bytes
content-length
129
expires
Fri, 21 Sep 2018 00:41:50 GMT
CMP-d6f65bfd-b895-dc34-53ed-c11bf2d04e31.jpg
remboursement-can.com/bank/atb/index_perso_files/ 		67 KB
68 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/CMP-d6f65bfd-b895-dc34-53ed-c11bf2d04e31.jpg
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
56abc55fbd5d9aba5424a7bba3e0a3eba228ee2ca14f86bb05a857dd669ea7cf

Request headers

:path
/bank/atb/index_perso_files/CMP-d6f65bfd-b895-dc34-53ed-c11bf2d04e31.jpg
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
content-type
image/jpeg
status
200
cache-control
max-age=5184000
accept-ranges
bytes
content-length
68909
expires
Fri, 21 Sep 2018 00:41:50 GMT
banner1.js
remboursement-can.com/bank/atb/index_perso_files/ 		478 B
512 B 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/banner1.js
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
782e67c903301b3bd7f6b2f4d52a34063f1c2222794aa98cc687bfd36ab72f5a

Request headers

:path
/bank/atb/index_perso_files/banner1.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
last-modified
Fri, 11 May 2018 21:12:44 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000
expires
Wed, 22 Aug 2018 00:41:50 GMT
saved_resource
remboursement-can.com/bank/atb/index_perso_files/ 		49 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/saved_resource
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
5840ad8d7a0972a7c381916a877238b12d271117a52aa0182a5676002792ce5c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/bank/atb/index_perso_files/saved_resource
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 23 Jul 2018 00:41:50 GMT
x-content-type-options
nosniff
last-modified
Fri, 11 May 2018 21:12:45 GMT
server
nginx
x-nginx-cache-status
MISS
status
200
x-server-powered-by
Engintron
accept-ranges
bytes
content-length
50628
x-xss-protection
1; mode=block
Asset.php
remboursement-can.com/bank/atb/index_perso_files/ 		58 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index_perso_files/Asset.php
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx / PHP/7.0.30
Resource Hash
5b94927d18f63dce5fa286fd779ad8700c1f2d78de4b698c8749a754b56b93a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/bank/atb/index_perso_files/Asset.php
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index.htm
:scheme
https
:method
GET
Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 23 Jul 2018 00:41:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
x-powered-by
PHP/7.0.30
vary
Accept-Encoding
x-nginx-cache-status
MISS
status
200
x-server-powered-by
Engintron
content-type
text/html; charset=UTF-8
x-xss-protection
1; mode=block
gtm.js
www.googletagmanager.com/ 		98 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PHHNRF
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
SPDY
Server
2a00:1450:4001:81d::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
b892b740388c0efdf6d29aeebfb3cd16991fce5d68c18311fd3867ec0d6d6425
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 23 Jul 2018 00:41:51 GMT
content-encoding
gzip
server
Google Tag Manager (scaffolding)
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
26972
x-xss-protection
1; mode=block
expires
Mon, 23 Jul 2018 00:41:51 GMT
analytics.js
www.google-analytics.com/ 		34 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index_perso_files/gtm.js
Protocol
SPDY
Server
2a00:1450:4001:814::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 18 May 2018 01:10:24 GMT
server
Golfe2
age
6183
date
Sun, 22 Jul 2018 22:58:48 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
14386
expires
Mon, 23 Jul 2018 00:58:48 GMT
DESGetFiles.aspx
remboursement-can.com/bank/atb/index_perso_files/ 		0
0
0832.js
script.crazyegg.com/pages/scripts/0012/ 		0
475 B 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/scripts/0012/0832.js?425640
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
HTTP/1.1
Server
54.230.92.222 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-92-222.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 21 Jul 2018 13:39:36 GMT
Via
1.1 0316586b8fd7e325258707448d98d7cd.cloudfront.net (CloudFront)
Last-Modified
Sat, 03 Feb 2018 12:01:17 GMT
Server
AmazonS3
Age
1163
ETag
"d41d8cd98f00b204e9800998ecf8427e"
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Cache-Control
no-cache
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
X-Amz-Cf-Id
twzH05085tghm3yWH51gAF1P1L1JAPcIZoEO9eOHj9RUOYuzC80GKA==
l
use.typekit.net/af/6d5542/00000000000000000001709a/27/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/6d5542/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
SPDY
Server
23.38.53.224 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-53-224.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
99fba0fe3401283e9b1f8411381cf8dc49d61c410cabef03c4f132649f3bf907

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://remboursement-can.com/bank/atb/index.htm
Origin
https://remboursement-can.com

Response headers

date
Mon, 23 Jul 2018 00:41:51 GMT
server
nginx
etag
"1500587fffa9a4bb64d06e988493ea23a02a484a"
status
200, 200 OK
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=8640000
timing-allow-origin
*
content-length
24232
collect
www.google-analytics.com/r/ 		35 B
199 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j68&a=1348299372&t=pageview&_s=1&dl=https%3A%2F%2Fremboursement-can.com%2Fbank%2Fatb%2Findex.htm&ul=en-us&de=UTF-8&dt=Welcome%20to%20ATB%20Online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=1360558418&gjid=2054738708&cid=1589297327.1532306512&tid=UA-537010-68&_gid=311283929.1532306512&_r=1&gtm=G4rPHHNRF&z=1209889712
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
SPDY
Server
2a00:1450:4001:814::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 23 Jul 2018 00:41:51 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
fontawesome-webfont.woff2
remboursement-can.com/bank/Themes/fonts/font-awesome/fonts/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/Themes/fonts/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash

Request headers

:path
/bank/Themes/fonts/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
pragma
no-cache
cookie
_ga=GA1.2.1589297327.1532306512; _gid=GA1.2.311283929.1532306512; _gat_UA-537010-68=1
origin
https://remboursement-can.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index_perso_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://remboursement-can.com/bank/atb/index_perso_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
Origin
https://remboursement-can.com

Response headers

status
404
date
Mon, 23 Jul 2018 00:41:51 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1
truncated
/ 		13 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
936aaa639be8fa6c83d6090a016cf175282c6102980ebb6ef79e84cd25ecf950

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin
https://remboursement-can.com

Response headers

Access-Control-Allow-Origin
*
Content-Type
application/x-font-woff2
truncated
/ 		13 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
14a174147ddbddee334cdcacd0d485cfa340080b2f28f312cbed56fd1ec9b482

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin
https://remboursement-can.com

Response headers

Access-Control-Allow-Origin
*
Content-Type
application/x-font-woff2
CMP-d6f65bfd-b895-dc34-53ed-c11bf2d04e31.jpg
s3.amazonaws.com/MD_Client%2Ftarget/ 		67 KB
68 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/MD_Client%2Ftarget/CMP-d6f65bfd-b895-dc34-53ed-c11bf2d04e31.jpg
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
HTTP/1.1
Server
52.216.233.181 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
56abc55fbd5d9aba5424a7bba3e0a3eba228ee2ca14f86bb05a857dd669ea7cf

Request headers

Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 23 Jul 2018 00:41:53 GMT
Last-Modified
Tue, 31 Oct 2017 15:49:10 GMT
Server
AmazonS3
x-amz-request-id
BA6A4490FF79B060
ETag
"34e829b5dd872b81229a8a2b5ae6ccf2"
Content-Type
Accept-Ranges
bytes
Content-Length
68909
x-amz-id-2
W0Q4AXADHbx8Fs8Va7euzIwQNeMlkA4Oaw6ikS9MasakO+qMkJdJ5qc+iyQFCCxUvjb9bnQ2oTc=
DeleteCookieByName
remboursement-can.com/bank/atb/index.htm/ 		354 B
415 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/atb/index.htm/DeleteCookieByName
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index_perso_files/commonScripts_D8041FBA7F6BE8E6DB4D9BA2033E3D1A.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash
43e7afc90bddc126708abd11ca21f77920b47e4317454ee74f2ee4da68e10bf8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/bank/atb/index.htm/DeleteCookieByName
pragma
no-cache
cookie
_ga=GA1.2.1589297327.1532306512; _gid=GA1.2.311283929.1532306512; _gat_UA-537010-68=1
origin
https://remboursement-can.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/json; charset=UTF-8
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
remboursement-can.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://remboursement-can.com/bank/atb/index.htm
content-length
23
:method
POST
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://remboursement-can.com/bank/atb/index.htm
Origin
https://remboursement-can.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

date
Mon, 23 Jul 2018 00:41:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1
status
404
x-xss-protection
1; mode=block
banner1.js
analytics.moneydesktop.com/offers/ZjHI9zbcmJYmsFecVdYAmTXXm8suILUzS4ProzGKNAVSs-39p7qscenOrAsMegP8ClM8jGiePRNBWK8rJyI5QMLMzOylT22CcD7ud0YC__9ChC08m-8mCK3MhoEqKIIz3e7LcIPWwhcIV453HwEt5eND0544OLZoqVm... 		478 B
871 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.moneydesktop.com/offers/ZjHI9zbcmJYmsFecVdYAmTXXm8suILUzS4ProzGKNAVSs-39p7qscenOrAsMegP8ClM8jGiePRNBWK8rJyI5QMLMzOylT22CcD7ud0YC__9ChC08m-8mCK3MhoEqKIIz3e7LcIPWwhcIV453HwEt5eND0544OLZoqVmbLwSpi9A/banner1.js?element_id=loginAd&default_banner_url=http://www.atb.com/learn/resources/Pages/ApplePay.aspx?utm_source=atbol&utm_medium=login&utm_campaign=CP-2016-ApplePay&default_banner_image_url=/ATB/Images/login_banner.jpg&campaign_group_guid=CMG-06c7415e-50da-71b3-eec1-1dc0e5fd63c7
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index_perso_files/commonScripts_D8041FBA7F6BE8E6DB4D9BA2033E3D1A.js
Protocol
HTTP/1.1
Server
192.41.58.142 Lindon, United States, ASN13951 (CENTER-SEVEN - C7 Data Centers, Inc., US),
Reverse DNS
192-41-58-142.moneydesktop.com
Software
nginx /
Resource Hash
429e36277a5c909a3300626d964962a382afb4c6111233591afa817368a4c698
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Runtime
0.653658
Date
Mon, 23 Jul 2018 00:41:53 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
W/"851bcb796b0cb323d4623e85e1e981ac"
Strict-Transport-Security
max-age=31536000
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=0, private, must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Allow
GET, PUT, POST, DELETE, HEAD, OPTIONS
X-XSS-Protection
1; mode=block
X-Request-Id
77357743b2c351f0d7ec9d4aa13a164d
truncated
/ 		5 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
297a5269f31b7c501886f8f980b01e5e14048f7f8f279ce1fb76f33e3edd6a14

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin
https://remboursement-can.com

Response headers

Access-Control-Allow-Origin
*
Content-Type
application/x-font-woff2
truncated
/ 		5 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
138376ba413b29d8a4354768884cfa9f31417e682385990bdc02136cc2616087

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin
https://remboursement-can.com

Response headers

Access-Control-Allow-Origin
*
Content-Type
application/x-font-woff2
fontawesome-webfont.woff
remboursement-can.com/bank/Themes/fonts/font-awesome/fonts/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/Themes/fonts/font-awesome/fonts/fontawesome-webfont.woff?v=4.7.0
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash

Request headers

:path
/bank/Themes/fonts/font-awesome/fonts/fontawesome-webfont.woff?v=4.7.0
pragma
no-cache
cookie
_ga=GA1.2.1589297327.1532306512; _gid=GA1.2.311283929.1532306512; _gat_UA-537010-68=1
origin
https://remboursement-can.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index_perso_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://remboursement-can.com/bank/atb/index_perso_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
Origin
https://remboursement-can.com

Response headers

status
404
date
Mon, 23 Jul 2018 00:41:51 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1
fontawesome-webfont.ttf
remboursement-can.com/bank/Themes/fonts/font-awesome/fonts/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://remboursement-can.com/bank/Themes/fonts/font-awesome/fonts/fontawesome-webfont.ttf?v=4.7.0
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
111.90.144.61 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
shark1.ip-asia.com
Software
nginx /
Resource Hash

Request headers

:path
/bank/Themes/fonts/font-awesome/fonts/fontawesome-webfont.ttf?v=4.7.0
pragma
no-cache
cookie
_ga=GA1.2.1589297327.1532306512; _gid=GA1.2.311283929.1532306512; _gat_UA-537010-68=1
origin
https://remboursement-can.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
remboursement-can.com
referer
https://remboursement-can.com/bank/atb/index_perso_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://remboursement-can.com/bank/atb/index_perso_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
Origin
https://remboursement-can.com

Response headers

status
404
date
Mon, 23 Jul 2018 00:41:51 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1
CMP-3012aac3-ec2a-05c7-8bae-bb02b60d98e8.jpg
s3.amazonaws.com/MD_Client%2Ftarget/ 		67 KB
68 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/MD_Client%2Ftarget/CMP-3012aac3-ec2a-05c7-8bae-bb02b60d98e8.jpg
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
HTTP/1.1
Server
52.216.233.181 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
131538043d1ea580fe3d251b76f156776f64e7340555ce450756cf1f2094f1e1

Request headers

Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 23 Jul 2018 00:41:54 GMT
Last-Modified
Tue, 03 Jul 2018 03:11:39 GMT
Server
AmazonS3
x-amz-request-id
4B7D050BF5E68A7E
ETag
"8659bed517fc82b6eebfa472dce92817"
Content-Type
Accept-Ranges
bytes
Content-Length
68923
x-amz-id-2
36NUYfos9Bxl/Mgip8uuNJOAiYbn9EfsqSjtjg9/dZ5nVzyXTDj6PsZdRwOSUrhZ0W/R8fgIlB0=
/
zncgfzahqp5dgc7mr-atbfeedback.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		49 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zncgfzahqp5dgc7mr-atbfeedback.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_cGfZAhqp5dgC7mR&Q_LOC=https%3A%2F%2Fremboursement-can.com%2Fbank%2Fatb%2Findex.htm&t=1532306513628
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
SPDY
Server
104.111.228.222 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-228-222.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
740aee87001157690b7f098acb323d48060fe8d7c47ebfa0fc44d4482d9099bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 23 Jul 2018 00:41:53 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
status
200
cache-control
public, max-age=60
strict-transport-security
max-age=31536000; includeSubDomains; preload
servershortname
content-type
application/javascript
content-length
12212
expires
Mon, 23 Jul 2018 00:42:53 GMT
/
zn0xidhqnpghfjswn-atbfeedback.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		49 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zn0xidhqnpghfjswn-atbfeedback.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_0xidHQNpghfJsWN&Q_LOC=https%3A%2F%2Fremboursement-can.com%2Fbank%2Fatb%2Findex.htm&t=1532306513630
Requested by
Host: remboursement-can.com
URL: https://remboursement-can.com/bank/atb/index.htm
Protocol
SPDY
Server
104.111.228.222 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-228-222.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b331011b2c922922825fad4cc94dab96f6b706c53cfa5247dd596f237f9685bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://remboursement-can.com/bank/atb/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 23 Jul 2018 00:41:53 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
status
200
cache-control
public, max-age=60
strict-transport-security
max-age=31536000; includeSubDomains; preload
servershortname
content-type
application/javascript
content-length
12212
expires
Mon, 23 Jul 2018 00:42:53 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
remboursement-can.com
URL
https://remboursement-can.com/bank/atb/index_perso_files/DESGetFiles.aspx
Domain
remboursement-can.com
URL
https://remboursement-can.com/bank/atb/index_perso_files/DESGetFiles.aspx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ATB Financial (Banking)

106 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| getRandomPort function| BlackberryLocationCollector function| detectFields function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector function| UIEvent function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath function| convertTimestampToGMT function| getTimestampInMillis function| debug object| ProxyCollector object| TimestampCollector object| UIEventCollector object| BrowserDetect string| SEP string| PAIR string| DEV string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| popupWindow function| openInvoiceImageWindow function| printField function| getBaseDomain function| HideMxTargetsWhenNoAd function| CloseifParentWindowIsClosed function| EditNick function| CancelEditNick function| ClearAllNickNames function| receiveExtendSession function| extendSession function| RedirectToShoppingCart function| GetMiniSpendingWidgetUrl string| strParentWindowURL function| CreateXmlHttp function| PopulateCreditor function| HandleCreditorResponse function| StartProgressDisplay function| EndProgressDisplay function| DisplayErrorMessage function| SetDataEntryVisible function| SearchPayee function| AddPayee undefined| XmlHttp string| AjaxCreditorPageName string| CREDITOR_SEARCH_QUERYSTRING_KEY function| $ function| jQuery object| jQuery1111036814072835178524 object| TelerikControls function| forceIE89Synchronicity function| MoneyDesktopWidgetLoader object| MDAnalytics object| Typekit function| InvokeServiceRequest object| gaplugins object| gaGlobal object| gaData object| vJDHF object| gDES_VG function| WebForm_OnSubmit undefined| gDES_Actions number| noCookieIndex object| PageData object| el string| banner string| staticBanner object| AjaxHelper object| ModalHelper object| SpinnerHelper object| TextHelper object| ValidationHelper object| Common object| Public object| QSI

3 Cookies

Domain/Path Name / Value
.remboursement-can.com/ Name: _gat_UA-537010-68
Value: 1
.remboursement-can.com/ Name: _gid
Value: GA1.2.311283929.1532306512
.remboursement-can.com/ Name: _ga
Value: GA1.2.1589297327.1532306512

1 Console Messages

Source Level URL
Text
console-api error URL: https://remboursement-can.com/bank/atb/index_perso_files/qia1usm.js(Line 32)
Message:
Typekit: the domain "remboursement-can.com" isn't in the list of published domains for kit "qia1usm".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.moneydesktop.com
remboursement-can.com
s3.amazonaws.com
script.crazyegg.com
use.typekit.net
www.google-analytics.com
www.googletagmanager.com
zn0xidhqnpghfjswn-atbfeedback.siteintercept.qualtrics.com
zncgfzahqp5dgc7mr-atbfeedback.siteintercept.qualtrics.com
remboursement-can.com
104.111.228.222
111.90.144.61
192.41.58.142
23.38.53.224
2a00:1450:4001:814::200e
2a00:1450:4001:81d::2008
52.216.233.181
54.230.92.222
131538043d1ea580fe3d251b76f156776f64e7340555ce450756cf1f2094f1e1
138376ba413b29d8a4354768884cfa9f31417e682385990bdc02136cc2616087
14a174147ddbddee334cdcacd0d485cfa340080b2f28f312cbed56fd1ec9b482
182bcf0b9132cf7234bb8661aa95fd1ccfbe5382b847dbdbbba40aaa69095d3b
1aa631b7334bf31e1895b6323166e7395da566daa84b2306f7d10d803d0cb0d8
205c6b68b92fd475a63ba98b6e120351ae70d3e3b7572523bb9ebd1727b0e42f
2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675
297a5269f31b7c501886f8f980b01e5e14048f7f8f279ce1fb76f33e3edd6a14
385869883cbe19d8cd31410e7328bb6c2050ee2697115fa20c93bcbf512886ea
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
429e36277a5c909a3300626d964962a382afb4c6111233591afa817368a4c698
43e7afc90bddc126708abd11ca21f77920b47e4317454ee74f2ee4da68e10bf8
56abc55fbd5d9aba5424a7bba3e0a3eba228ee2ca14f86bb05a857dd669ea7cf
5840ad8d7a0972a7c381916a877238b12d271117a52aa0182a5676002792ce5c
5b94927d18f63dce5fa286fd779ad8700c1f2d78de4b698c8749a754b56b93a9
62dce705e9c805154e4a3f639b212b39a78bfff6c3da54d4eefa7756fb951578
68f2754a833a25d7b577b98dbd1995d2ee46122c912750991b6e0e2aac71f809
72da7b996e10c7a2a69be39a1a403fbc0eea85182551d12c1b47e02821a86411
740aee87001157690b7f098acb323d48060fe8d7c47ebfa0fc44d4482d9099bd
782e67c903301b3bd7f6b2f4d52a34063f1c2222794aa98cc687bfd36ab72f5a
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
936aaa639be8fa6c83d6090a016cf175282c6102980ebb6ef79e84cd25ecf950
99fba0fe3401283e9b1f8411381cf8dc49d61c410cabef03c4f132649f3bf907
b331011b2c922922825fad4cc94dab96f6b706c53cfa5247dd596f237f9685bb
b892b740388c0efdf6d29aeebfb3cd16991fce5d68c18311fd3867ec0d6d6425
bc1d20c0f75e6882604dc25043446dcdf17c5634c98b56a667b2c56779b83b5a
da369623e388d7bf36bb00ef742ba81af294e4b10cab7a27ec1f216c333f2710
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f75e9e828d89462f2e9a93cee9de296e877df758b361f4eb80ba9c7971ffe4c9
fffe11162e31140fdef1634356cd0a4944e84be9803bdafcd032e326ca5ed606