urlscan.io logo urlscan.io
SecurityTrails logo

rewardscampaign.com Open in urlscan Pro
82.221.136.1  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2...
Submission: On October 27 via manual from AU — Scanned from IS
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 4 countries across 5 domains to perform 34 HTTP transactions. The main IP is 82.221.136.1, located in Iceland and belongs to THORDC-AS, IS. The main domain is rewardscampaign.com.
This is the only time rewardscampaign.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ANZ Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
10 82.221.136.1 50613 (THORDC-AS)
2 63.140.62.22 16509 (AMAZON-02)
2 202.2.56.40 9564 (ANZ-BANK-...)
8 45.60.124.46 19551 (INCAPSULA)
4 3.105.68.94 16509 (AMAZON-02)
3 3.106.103.218 16509 (AMAZON-02)
1 52.64.145.47 16509 (AMAZON-02)
1 3 34.241.182.209 16509 (AMAZON-02)
1 34.251.64.143 16509 (AMAZON-02)
1 1 63.33.173.25 16509 (AMAZON-02)
1 66.235.152.152 15224 (OMNITURE)
34 10
10    82.221.136.1 (Iceland)

ASN50613 (THORDC-AS, IS)
PTR: lettir.orangewebsite.com
rewardscampaign.com
2    63.140.62.22 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-22.data.adobedc.net
infos.anz.com
2    202.2.56.40 (Australia)

ASN9564 (ANZ-BANK-AP Australia and New Zealand Banking Group Limited, AU)
PTR: anz.sg
anz.com
8    45.60.124.46 (United States)

ASN19551 (INCAPSULA, US)
www.anz.com
4    3.105.68.94 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-105-68-94.ap-southeast-2.compute.amazonaws.com
ctmdx.anz.com
3    3.106.103.218 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-106-103-218.ap-southeast-2.compute.amazonaws.com
mstcl3.anz.com
1    52.64.145.47 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-64-145-47.ap-southeast-2.compute.amazonaws.com
waf1x.anz.com
3    34.241.182.209 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-241-182-209.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    34.251.64.143 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-64-143.eu-west-1.compute.amazonaws.com
anz.demdex.net
1    63.33.173.25 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-173-25.eu-west-1.compute.amazonaws.com
cm.everesttech.net
1    66.235.152.152 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-66-235-152-152.data.adobedc.net
australianewzealandb.tt.omtrdc.net
Apex Domain
Subdomains		 Transfer
20 anz.com
infos.anz.com
anz.com — Cisco Umbrella Rank: 253478
www.anz.com — Cisco Umbrella Rank: 635681
ctmdx.anz.com
mstcl3.anz.com
waf1x.anz.com
511 KB
10 rewardscampaign.com
rewardscampaign.com
312 KB
4 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 228
anz.demdex.net
7 KB
1 omtrdc.net
australianewzealandb.tt.omtrdc.net
697 B
1 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 1275
517 B
34 5
Domain Requested by
10 rewardscampaign.com rewardscampaign.com
8 www.anz.com rewardscampaign.com
anz.com
4 ctmdx.anz.com rewardscampaign.com
ctmdx.anz.com
3 dpm.demdex.net 1 redirects rewardscampaign.com
3 mstcl3.anz.com rewardscampaign.com
mstcl3.anz.com
2 anz.com rewardscampaign.com
2 infos.anz.com rewardscampaign.com
anz.com
1 australianewzealandb.tt.omtrdc.net anz.com
1 cm.everesttech.net 1 redirects
1 anz.demdex.net rewardscampaign.com
1 waf1x.anz.com rewardscampaign.com
34 11

This site contains links to these domains. Also see Links.

Domain
www.recovery.anz.com
www.anz.com.au
Subject Issuer Validity Valid
infos.anz.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-12-20 -
2024-01-20		 a year crt.sh
www.anz.com
DigiCert Global CA G2		 2023-02-14 -
2024-02-14		 a year crt.sh
ctmdx.anz.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-10-05 -
2024-10-04		 a year crt.sh
mstcl3.anz.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-28 -
2024-09-26		 a year crt.sh
waf1x.anz.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-10-03 -
2024-10-01		 a year crt.sh
*.demdex.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-26 -
2024-10-26		 a year crt.sh

This page contains 4 frames:

Primary Page: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Frame ID: 1481D58EF6A8208EBA621E2C063A2C59
Requests: 31 HTTP requests in this frame

Frame: https://anz.demdex.net/dest5.html?d_nsid=0
Frame ID: DC46B6A15A3704175BACF7B9E54E2755
Requests: 1 HTTP requests in this frame

Frame: https://mstcl3.anz.com/947684/3FjB.html//?cid=5&si=0&e=http%3A%2F%2Frewardscampaign.com&LSESSIONID=eyJpIjoiOFwvQVBFeGRCRHFJV2hxaVdNZEthWUE9PSIsImUiOiJWZDZPYzREYjFZNzBcL09QaENONE5JdUk0U0JLMjJNRHpvb0RUSTl0bFhlTmVsVUhoYnExb2NidUx0N01MRnBLdmV0TjVDXC9uQ0lkR2Q0VlpwWXRDSjBTczR2TnFkbW5cLzZoUVhpV1wvdDd4ZzlqQzBnZ3RycngwN0RLMTdPWHAyNHF5cWpIc3VBckZHcnQ2c0cxNDY4allBPT0ifQ%3D%3D.8432e8d31b144e40.MjdlNmRjY2NkYzhhNWZiNjgwMDBhNWRjYmJjMjMwZWJmYTlhMTM3MzE0MWIwMzBkZGI5Mjg5ZDBlNzUxNGQyNQ%3D%3D&t=xframe&eu=http%3A%2F%2Frewardscampaign.com%2Finetbank.html&icid=169836740202259695
Frame ID: FBF7214588ED778B6BD8C3E475FD792F
Requests: 1 HTTP requests in this frame

Frame: https://mstcl3.anz.com/947684/pTx.html?si=0&e=http%3A%2F%2Frewardscampaign.com&LSESSIONID=eyJpIjoiOFwvQVBFeGRCRHFJV2hxaVdNZEthWUE9PSIsImUiOiJWZDZPYzREYjFZNzBcL09QaENONE5JdUk0U0JLMjJNRHpvb0RUSTl0bFhlTmVsVUhoYnExb2NidUx0N01MRnBLdmV0TjVDXC9uQ0lkR2Q0VlpwWXRDSjBTczR2TnFkbW5cLzZoUVhpV1wvdDd4ZzlqQzBnZ3RycngwN0RLMTdPWHAyNHF5cWpIc3VBckZHcnQ2c0cxNDY4allBPT0ifQ%3D%3D.8432e8d31b144e40.MjdlNmRjY2NkYzhhNWZiNjgwMDBhNWRjYmJjMjMwZWJmYTlhMTM3MzE0MWIwMzBkZGI5Mjg5ZDBlNzUxNGQyNQ%3D%3D&t=xframe&eu=http%3A%2F%2Frewardscampaign.com%2Finetbank.html&icid=169836740202990143
Frame ID: 61B56304328B5F232205DEAF01D7F778
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login - ANZ Internet Banking

Detected technologies

Overall confidence: 100%
Detected patterns
  • /_Incapsula_Resource

Page Statistics

34
Requests

62 %
HTTPS

0 %
IPv6

5
Domains

11
Subdomains

10
IPs

4
Countries

829 kB
Transfer

1801 kB
Size

12
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18
  • https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67A216D751E567B20A490D4C%40AdobeOrg&d_nsid=0&ts=1698367400868 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67A216D751E567B20A490D4C%40AdobeOrg&d_nsid=0&ts=1698367400868
Request Chain 28
  • https://cm.everesttech.net/cm/dd?d_uuid=21723496585347926224199944356479690189 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZTsHqQAAAFsfTQNn

34 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request inetbank.html
rewardscampaign.com/ 		59 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash
3115caa1c6d528ff24bd1fa1f93198f7f972fecd3f3a462aafadc5f2651e11db

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
is-IS,is;q=0.9

Response headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
accept-ranges
bytes
content-encoding
gzip
content-length
16054
content-type
text/html
date
Fri, 27 Oct 2023 00:43:17 GMT
last-modified
Thu, 26 Oct 2023 19:46:21 GMT
server
LiteSpeed
vary
Accept-Encoding
s63274976744356
infos.anz.com/b/ss/anzcomprd/10/JS-2.22.0-LBQ1/ 		913 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://infos.anz.com/b/ss/anzcomprd/10/JS-2.22.0-LBQ1/s63274976744356?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=12%2F5%2F2021%2023%3A20%3A8%206%20-300&d.&nsid=0&jsonv=1&.d&sdid=487BFDCC8FCEEB35-52EEB6A414A418FB&mid=17614164333551285424350705849922740374&aamlh=3&ce=UTF-8&ns=anz&cdp=2&fpCookieDomainPeriods=2&pageName=ib%3Alogin%3Alogin&g=https%3A%2F%2Flogin.anz.com%2Finternetbanking%3Fadobe_mc%3DMCMID%253D11505818159956809190824924643855087767%257CMCAID%253D2EA1C588853150AF-4000010B2000EDDC%257CMCORGID%253D67A216D751E567B20A490D4C%252540AdobeOrg%257CTS%253D1623510110&cc=AUD&ch=ib%3Alogin%3Alogin&server=login.anz.com&events=event29%3D49&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=ib%7Clogin%7Clogin&c21=launch%7Cauthenticationpageshybriddatalayernodatalayer%7Cproduction%7C2021-02-11T05%3A37%3A48Z&v26=ib%3Alogin%3Alogin&v31=17470173446792340884336867512483075168&v63=Visitor-ID%3A5.1.1%7CAnalytics%3ANot%20Installed%7CAAM-DIL%3ANot%20Installed%7CTarget%3A2.3.3&c70=ib%3Alogin%3Alogin&c71=100&c72=49&c.&a.&activitymap.&page=ib%3Alogin%3Alogin&link=Log%20in&region=root&pageIDType=1&.activitymap&.a&.c&pid=ib%3Alogin%3Alogin&pidt=1&oid=Log%20in&oidt=3&ot=SUBMIT&s=1366x768&c=24&j=1.6&v=N&k=Y&bw=1366&bh=657&mcorgid=67A216D751E567B20A490D4C%40AdobeOrg&AQE=1
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.140.62.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-63-140-62-22.data.adobedc.net
Software
jag /
Resource Hash
331f28032df167773ab3b08e84fa75ac94330bf8740e60b7a5980749ba2a4c8b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-aam-tid
MzSIJZeTR9g=
date
Fri, 27 Oct 2023 00:43:18 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy"
content-length
913
x-xss-protection
1; mode=block
dcs
dcs-prod-apse-1-v050-04e5e27ac.edge-apse.demdex.com 5 ms
pragma
no-cache
last-modified
Sat, 28 Oct 2023 00:43:18 GMT
server
jag
etag
3647216216663293952-4617866910789967427
vary
*
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 26 Oct 2023 00:43:18 GMT
analytics.js
anz.com/auxiliary/supertag/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://anz.com/auxiliary/supertag/analytics.js?plat=ib-logon
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
202.2.56.40 , Australia, ASN9564 (ANZ-BANK-AP Australia and New Zealand Banking Group Limited, AU),
Reverse DNS
anz.sg
Software
/
Resource Hash
0f12656a38947cd455c1591b01c31a7925a2fce4c1303bba49a52eebe0e84765

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 00:43:19 GMT
Content-Encoding
gzip
Last-Modified
Thu, 24 Nov 2022 03:12:22 GMT
Server
ETag
"0efa191b2ffd81:0"
X-Powered-By
Vary
Accept-Encoding
MicrosoftOfficeWebServer
Content-Type
application/javascript
Cache-Control
max-age=3600
Accept-Ranges
bytes
Content-Length
1314
launch-73076f385d1d.min.js
anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/ 		321 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/launch-73076f385d1d.min.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
202.2.56.40 , Australia, ASN9564 (ANZ-BANK-AP Australia and New Zealand Banking Group Limited, AU),
Reverse DNS
anz.sg
Software
/
Resource Hash
2eb58bbf68062c3a2e106fb67b42e11a2a57bea08bf122e9725d96b399fda85e

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Fri, 27 Oct 2023 00:43:19 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Feb 2023 02:48:23 GMT
Server
ETag
"80b584d7a42d91:0"
X-Powered-By
Vary
Accept-Encoding
MicrosoftOfficeWebServer
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
96461
AppMeasurement.min.js
www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/8a4e2a3d1cd7/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/8a4e2a3d1cd7/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.46 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers
AppMeasurement_Module_ActivityMap.min.js
www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/8a4e2a3d1cd7/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/8a4e2a3d1cd7/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.46 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers
AppMeasurement_Module_AudienceManagement.min.js
www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/8a4e2a3d1cd7/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/8a4e2a3d1cd7/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_AudienceManagement.min.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.46 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers
QAW.js
ctmdx.anz.com/947684/ 		69 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ctmdx.anz.com/947684/QAW.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.105.68.94 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-68-94.ap-southeast-2.compute.amazonaws.com
Software
haile /
Resource Hash
38dfc726e1aa331feed5c9053a37992da13c77087fc7c4c7b3939a8f5f4dc1c1
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 Oct 2023 00:43:19 GMT
strict-transport-security
max-age=86400
content-encoding
gzip
server
haile
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type
application/x-javascript
cache-control
no-cache, no-store, must-revalidate
pics-label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
assembly.js
mstcl3.anz.com/947684/ 		69 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mstcl3.anz.com/947684/assembly.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.106.103.218 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-106-103-218.ap-southeast-2.compute.amazonaws.com
Software
haile /
Resource Hash
6be6b5358d307a7c2b61a8c8302fa76ac09e38fabb77499e4ea243c991ea809b
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 Oct 2023 00:43:19 GMT
strict-transport-security
max-age=86400
content-encoding
gzip
server
haile
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type
application/x-javascript
cache-control
no-cache, no-store, must-revalidate
pics-label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
Lrt.js
waf1x.anz.com/inetbank1/ 		150 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://waf1x.anz.com/inetbank1/Lrt.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.64.145.47 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-64-145-47.ap-southeast-2.compute.amazonaws.com
Software
haile /
Resource Hash
0a70b1f1447dfbe39e2e6676130f923a2431a3bc3be790d091e00188ee31bfb0
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 Oct 2023 00:43:19 GMT
strict-transport-security
max-age=86400
content-encoding
gzip
server
haile
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type
application/x-javascript
cache-control
no-cache, no-store, must-revalidate
pics-label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
uHDqs
ctmdx.anz.com/947684/ 		0
434 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ctmdx.anz.com/947684/uHDqs?d=JTVCJTdCJTIyaWQlMjIlM0ElMjIxNSUyMiUyQyUyMmRhdGElMjIlM0ElN0IlMjJyZWYlMjIlM0ElMjIlMjIlN0QlN0QlMkMlN0IlMjJpZCUyMiUzQSUyMjQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTIycyUyMiUzQSUyMiU3QjEzNTBlMGQ5LWM4ZGEtNDQ5ZC04MzkwLTFmMzc5NTAxZDkxYyU3RCUyMiU3RCU3RCU1RA%3D%3D&cid=15%2C4&si=2&e=https%3A%2F%2Flogin.anz.com&LSESSIONID=eyJpIjoiOVppMzNDS1JNeVNjc1JCQzBGTWJDZz09IiwiZSI6IjFxU2greXBhTlk1MnBlVkdiNkJRXC92aEoxeEpPeGIzOVRCMTkzRFNRS0V0WDBVMkRqY2pWYmYxUjBmeWVMZDNUa0ZwbEsrVGxcLzN3NHlzNjAwbTRkdWhjN0M3SllQK1ZvajJsV3ZNaGpBWFVxQzZ6eG03MGxrWkNDckd0dlVsbU9sS1c1ZURSbDN1NkYybnFxZU4zZjdwSFcrQUYzNHdRT2dLZDYxaWFuOXB0VzBxbXJQZ2syZEtsV0JhWk84dmlhIn0%3D.ca50fe64b859d4d7.MzdmNDU1NGNlZDU4NmZkNjRjNjQxZTZjMmM5N2E1ZGUwYjBmZDNmNGY0NGI3YzAxMDQ2ODYzNWJjNjQ3YWU5Yw%3D%3D&t=jsonp&__tp=login&c=qwmrgsnnveu_ieqz&eu=https%3A%2F%2Flogin.anz.com%2Finternetbanking%3Fadobe_mc%3DMCMID%253D11505818159956809190824924643855087767%257CMCAID%253D2EA1C588853150AF-4000010B2000EDDC%257CMCORGID%253D67A216D751E567B20A490D4C%252540AdobeOrg%257CTS%253D1623510110
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.105.68.94 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-68-94.ap-southeast-2.compute.amazonaws.com
Software
haile /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

expires
0
pragma
no-cache
date
Fri, 27 Oct 2023 00:43:21 GMT
server
haile
content-type
text/html
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control
no-cache, no-store, must-revalidate
content-length
0
pics-label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
anz-logo.1.0.0.svg
rewardscampaign.com/assets/img/ 		38 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://rewardscampaign.com/assets/img/anz-logo.1.0.0.svg
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash
df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:17 GMT
content-encoding
gzip
last-modified
Sun, 13 Jun 2021 01:34:48 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
28641
expires
Fri, 03 Nov 2023 00:43:17 GMT
env.js
rewardscampaign.com/assets/config/ 		893 B
849 B 		Script
General
Check archive.org
Download Go to
Full URL
http://rewardscampaign.com/assets/config/env.js?5541B3054923547800000057
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash
47411138d872bec9bea4c2724ae5a68f508f537244bd2f8545f358cd6c9301b4

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:17 GMT
content-encoding
gzip
last-modified
Sun, 13 Jun 2021 02:28:34 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
465
expires
Fri, 03 Nov 2023 00:43:17 GMT
manifest.e2edb374.js
rewardscampaign.com/assets/config/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://rewardscampaign.com/assets/config/manifest.e2edb374.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash
bdcedcc0085acc0e4d5a4489b2d73c2aae3f918b17f31bafcf4d8e8b1cc772be

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:17 GMT
content-encoding
gzip
last-modified
Sun, 13 Jun 2021 02:28:16 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
733
expires
Fri, 03 Nov 2023 00:43:17 GMT
vendors~main.e2edb374.js
rewardscampaign.com/assets/config/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://rewardscampaign.com/assets/config/vendors~main.e2edb374.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 Oct 2023 00:43:17 GMT
server
LiteSpeed
content-type
text/html
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-length
1238
main.e2edb374.js
rewardscampaign.com/assets/config/ 		322 KB
111 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://rewardscampaign.com/assets/config/main.e2edb374.js
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash
251549d96b5ba250b7d302c5b486955238be8f79d7e504631d49dacc04f34584

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:17 GMT
content-encoding
gzip
last-modified
Sun, 13 Jun 2021 02:28:00 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
113362
expires
Fri, 03 Nov 2023 00:43:17 GMT
_Incapsula_Resource
rewardscampaign.com/assets/config/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://rewardscampaign.com/assets/config/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=978994992
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 Oct 2023 00:43:20 GMT
server
LiteSpeed
content-type
text/html
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-length
1238
hyptxt.js
ctmdx.anz.com/947684/ 		74 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ctmdx.anz.com/947684/hyptxt.js?dt=login&r=0.9317261831246131
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.105.68.94 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-68-94.ap-southeast-2.compute.amazonaws.com
Software
haile /
Resource Hash
34b7540d8e3acd1b76c54a4887f66e343d3f0779bff8056b1a7e5cd8fca735e5
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 Oct 2023 00:43:21 GMT
strict-transport-security
max-age=86400
content-encoding
gzip
server
haile
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
content-type
application/x-javascript
cache-control
no-cache, no-store, must-revalidate
pics-label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
launch-73076f385d1d.min.js
www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/ 		321 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/launch-73076f385d1d.min.js
Requested by
Host: anz.com
URL: https://anz.com/auxiliary/supertag/analytics.js?plat=ib-logon
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.46 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
2eb58bbf68062c3a2e106fb67b42e11a2a57bea08bf122e9725d96b399fda85e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:20 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 17 Feb 2023 02:49:39 GMT
x-cdn
Imperva
age
2758, 29, 54
etag
"26d61fb9"
vary
Accept-Encoding
content-type
application/javascript
x-iinfo
11-59624180-0 0cNN RT(1698367399954 489) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=60, public
x-incap-sess-cookie-hdr
jSO1OuY5Qkves5TkGXdLZKgHO2UAAAAA20Y2jTq6pV6khVLwlHMNuw==
accept-ranges
bytes
content-length
124769
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67A216D751E567B20A490D4C%40AdobeOrg&d_nsid=0&ts=1698367400868
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67A216D751E567B20A490D4C%40AdobeOrg&d_nsid=0&ts=1698367400868
1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67A216D751E567B20A490D4C%40AdobeOrg&d_nsid=0&ts=1698367400868
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
34.241.182.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-241-182-209.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
847e396fcdbaabf1c7d08f1633c9790b864dcbef0f63a8082e18bd27cf5fb710
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v053-009269c29.edge-irl1.demdex.com 1 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
rWCXjtDcS3U=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
http://rewardscampaign.com
Content-Type
application/json;charset=utf-8
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
560
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v053-0fbdfaa63.edge-irl1.demdex.com 0 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
XBDvi9azTKg=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
http://rewardscampaign.com
Location
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=67A216D751E567B20A490D4C%40AdobeOrg&d_nsid=0&ts=1698367400868
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
AppMeasurement.min.js
www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/f5f2847e7fa4/hostedLibFiles/EPbf7b42aa08bc4f10879b1484195e80d1/ 		34 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/f5f2847e7fa4/hostedLibFiles/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js
Requested by
Host: anz.com
URL: https://anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/launch-73076f385d1d.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.46 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:20 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 17 Feb 2023 02:49:41 GMT
x-cdn
Imperva
age
2757, 30, 2
etag
"91a1ca4e"
vary
Accept-Encoding
content-type
application/javascript
x-iinfo
11-59624180-0 0cNN RT(1698367399954 497) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=60, public
x-incap-sess-cookie-hdr
MbrJR418SgDes5TkGXdLZKgHO2UAAAAAYaH0CTzQOz5iTBVdshzuag==
accept-ranges
bytes
content-length
15550
AppMeasurement_Module_ActivityMap.min.js
www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/f5f2847e7fa4/hostedLibFiles/EPbf7b42aa08bc4f10879b1484195e80d1/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/f5f2847e7fa4/hostedLibFiles/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: anz.com
URL: https://anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/launch-73076f385d1d.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.46 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:20 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 17 Feb 2023 02:49:41 GMT
x-cdn
Imperva
age
2757, 30, 57
etag
"e599c46d"
vary
Accept-Encoding
content-type
application/javascript
x-iinfo
11-59624180-0 0cNN RT(1698367399954 519) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=60, public
x-incap-sess-cookie-hdr
8lT/KC51eUTes5TkGXdLZKgHO2UAAAAALQgNtiJxQEU4TjzhaR0IkQ==
accept-ranges
bytes
content-length
1943
AppMeasurement_Module_AudienceManagement.min.js
www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/f5f2847e7fa4/hostedLibFiles/EPbf7b42aa08bc4f10879b1484195e80d1/ 		25 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/f5f2847e7fa4/hostedLibFiles/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_AudienceManagement.min.js
Requested by
Host: anz.com
URL: https://anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/launch-73076f385d1d.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.46 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:20 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 17 Feb 2023 02:49:42 GMT
x-cdn
Imperva
age
2757, 29, 3
etag
"b5c9c16c"
vary
Accept-Encoding
content-type
application/javascript
x-iinfo
11-59624180-0 0cNN RT(1698367399954 526) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=60, public
x-incap-sess-cookie-hdr
TIPvNW/jilzes5TkGXdLZKgHO2UAAAAARZcMXezkTdqnqOvUNGOVJQ==
accept-ranges
bytes
content-length
10901
dest5.html
anz.demdex.net/ Frame DC46 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://anz.demdex.net/dest5.html?d_nsid=0
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.64.143 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-64-143.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
http://rewardscampaign.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
is-IS,is;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
text/html;charset=UTF-8
DCS
dcs-prod-irl1-1-v053-04cbe58d5.edge-irl1.demdex.com 0 ms
Expires
Thu, 01 Jan 1970 00:00:00 UTC
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
MGDExy78Quc=
content-encoding
gzip
date
Fri, 27 Oct 2023 00:43:21 GMT
last-modified
Thu, 26 Oct 2023 10:55:07 GMT
transfer-encoding
chunked
vary
accept-encoding
MyriadPro-Regular.1.0.0.woff
rewardscampaign.com/assets/font/ 		51 KB
52 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://rewardscampaign.com/assets/font/MyriadPro-Regular.1.0.0.woff
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash
9af4df3b7f044525975716b175351fa75553070734627cf3b1325332284208c5

Request headers

Referer
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Origin
http://rewardscampaign.com
accept-language
is-IS,is;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:20 GMT
last-modified
Sun, 13 Jun 2021 02:48:56 GMT
server
LiteSpeed
content-type
font/woff
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
52656
MyriadPro-Semibold.1.0.0.woff
rewardscampaign.com/assets/font/ 		52 KB
52 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://rewardscampaign.com/assets/font/MyriadPro-Semibold.1.0.0.woff
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash
b6bf163550dd994ccb01b937f1210281ec8681bfea58b38cf92b266a3d257cfc

Request headers

Referer
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Origin
http://rewardscampaign.com
accept-language
is-IS,is;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:20 GMT
last-modified
Sun, 13 Jun 2021 02:49:46 GMT
server
LiteSpeed
content-type
font/woff
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
52808
MyriadPro-Light.1.0.0.woff
rewardscampaign.com/assets/font/ 		51 KB
51 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://rewardscampaign.com/assets/font/MyriadPro-Light.1.0.0.woff
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
82.221.136.1 , Iceland, ASN50613 (THORDC-AS, IS),
Reverse DNS
lettir.orangewebsite.com
Software
LiteSpeed /
Resource Hash
a3080630cedf7c6bb87229c4b11d206b3adb83753ced5558c7fea114bc0fd87a

Request headers

Referer
http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Origin
http://rewardscampaign.com
accept-language
is-IS,is;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:20 GMT
last-modified
Sun, 13 Jun 2021 02:49:32 GMT
server
LiteSpeed
content-type
font/woff
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
52140
RC1bf2d4ff074d4757838ac176e8865bc9-source.min.js
www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/f5f2847e7fa4/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/f5f2847e7fa4/RC1bf2d4ff074d4757838ac176e8865bc9-source.min.js
Requested by
Host: anz.com
URL: https://anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/launch-73076f385d1d.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.46 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
803efdb5e4693d4cc82afc1ff3799a363d3dffeb0e2393049513043df0925515
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 00:43:20 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 17 Feb 2023 02:49:40 GMT
x-cdn
Imperva
age
2755, 27, 4
etag
"e1f53d21"
vary
Accept-Encoding
content-type
application/javascript
x-iinfo
11-59624180-0 0cNN RT(1698367399954 543) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=60, public
x-incap-sess-cookie-hdr
o/RPfhq+5jbes5TkGXdLZKgHO2UAAAAA26X5rMQ7SuIG0PTwW3XSNg==
accept-ranges
bytes
content-length
1007
id
infos.anz.com/ 		48 B
281 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://infos.anz.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=67A216D751E567B20A490D4C%40AdobeOrg&mid=21917988285243702644181129148792000827&ts=1698367401447
Requested by
Host: anz.com
URL: https://anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/launch-73076f385d1d.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.140.62.22 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-63-140-62-22.data.adobedc.net
Software
jag /
Resource Hash
6e1c538de8c7d1019c485e1acea878c2861c4f97b51a1c36e2209c4cab08808e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://rewardscampaign.com/
accept-language
is-IS,is;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Fri, 27 Oct 2023 00:43:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
server
jag
vary
Origin
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
http://rewardscampaign.com
p3p
CP="This is not a P3P policy"
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
content-length
48
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=ZTsHqQAAAFsfTQNn
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=21723496585347926224199944356479690189
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZTsHqQAAAFsfTQNn
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZTsHqQAAAFsfTQNn
Requested by
Host: rewardscampaign.com
URL: http://rewardscampaign.com/inetbank.html?bankmain.asp%3Fadobe_mc=MCMID%3D11605818159956809190824924643855087767%7CMCAID%3D2EA1C588853150AF-4000010B2000EDDC%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1604867900
Protocol
HTTP/1.1
Server
34.241.182.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-241-182-209.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v053-0574b8717.edge-irl1.demdex.com 1 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
Wky0r5X6TiE=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZTsHqQAAAFsfTQNn
Date
Fri, 27 Oct 2023 00:43:21 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
delivery
australianewzealandb.tt.omtrdc.net/rest/v1/ 		49 B
697 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://australianewzealandb.tt.omtrdc.net/rest/v1/delivery?client=australianewzealandb&sessionId=c5eb28221d9f489cadb8f592609c8ae7&version=2.10.0
Requested by
Host: anz.com
URL: https://anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/launch-73076f385d1d.min.js
Protocol
HTTP/1.1
Server
66.235.152.152 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
ip-66-235-152-152.data.adobedc.net
Software
jag /
Resource Hash
70ac34d176f59098e867cd1008c65de5e945ae2ee702444a4e6e9ee10ae314dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://rewardscampaign.com/
accept-language
is-IS,is;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 27 Oct 2023 00:43:21 GMT
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
server
jag
x-content-type-options
nosniff
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
transfer-encoding
chunked
content-type
application/json;charset=UTF-8
access-control-allow-origin
http://rewardscampaign.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
x-xss-protection
1; mode=block
/
mstcl3.anz.com/947684/3FjB.html// Frame FBF7 		69 KB
32 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mstcl3.anz.com/947684/3FjB.html//?cid=5&si=0&e=http%3A%2F%2Frewardscampaign.com&LSESSIONID=eyJpIjoiOFwvQVBFeGRCRHFJV2hxaVdNZEthWUE9PSIsImUiOiJWZDZPYzREYjFZNzBcL09QaENONE5JdUk0U0JLMjJNRHpvb0RUSTl0bFhlTmVsVUhoYnExb2NidUx0N01MRnBLdmV0TjVDXC9uQ0lkR2Q0VlpwWXRDSjBTczR2TnFkbW5cLzZoUVhpV1wvdDd4ZzlqQzBnZ3RycngwN0RLMTdPWHAyNHF5cWpIc3VBckZHcnQ2c0cxNDY4allBPT0ifQ%3D%3D.8432e8d31b144e40.MjdlNmRjY2NkYzhhNWZiNjgwMDBhNWRjYmJjMjMwZWJmYTlhMTM3MzE0MWIwMzBkZGI5Mjg5ZDBlNzUxNGQyNQ%3D%3D&t=xframe&eu=http%3A%2F%2Frewardscampaign.com%2Finetbank.html&icid=169836740202259695
Requested by
Host: mstcl3.anz.com
URL: https://mstcl3.anz.com/947684/assembly.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.106.103.218 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-106-103-218.ap-southeast-2.compute.amazonaws.com
Software
haile /
Resource Hash
43f8f122cd9bab694f84e243314165416455612a567c9970d62654d9d23f2f1d
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
http://rewardscampaign.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
is-IS,is;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
text/html
date
Fri, 27 Oct 2023 00:43:22 GMT
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pragma
no-cache
server
haile
strict-transport-security
max-age=86400
pTx.html
mstcl3.anz.com/947684/ Frame 61B5 		77 KB
36 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mstcl3.anz.com/947684/pTx.html?si=0&e=http%3A%2F%2Frewardscampaign.com&LSESSIONID=eyJpIjoiOFwvQVBFeGRCRHFJV2hxaVdNZEthWUE9PSIsImUiOiJWZDZPYzREYjFZNzBcL09QaENONE5JdUk0U0JLMjJNRHpvb0RUSTl0bFhlTmVsVUhoYnExb2NidUx0N01MRnBLdmV0TjVDXC9uQ0lkR2Q0VlpwWXRDSjBTczR2TnFkbW5cLzZoUVhpV1wvdDd4ZzlqQzBnZ3RycngwN0RLMTdPWHAyNHF5cWpIc3VBckZHcnQ2c0cxNDY4allBPT0ifQ%3D%3D.8432e8d31b144e40.MjdlNmRjY2NkYzhhNWZiNjgwMDBhNWRjYmJjMjMwZWJmYTlhMTM3MzE0MWIwMzBkZGI5Mjg5ZDBlNzUxNGQyNQ%3D%3D&t=xframe&eu=http%3A%2F%2Frewardscampaign.com%2Finetbank.html&icid=169836740202990143
Requested by
Host: mstcl3.anz.com
URL: https://mstcl3.anz.com/947684/assembly.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.106.103.218 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-106-103-218.ap-southeast-2.compute.amazonaws.com
Software
haile /
Resource Hash
7f3299a03780c427125b2498d139ee97c5f04780a40d1bb9590787b3aeb11731
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
http://rewardscampaign.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
is-IS,is;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
text/html
date
Fri, 27 Oct 2023 00:43:22 GMT
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pragma
no-cache
server
haile
strict-transport-security
max-age=86400
uHDqs
ctmdx.anz.com/947684/ 		90 B
497 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ctmdx.anz.com/947684/uHDqs?d=ZW5jZEBwWlIxNDBIRGtITEZ5cXBpMDByNnlpdDdwNlc1Uldwd3ZEdzlGYVRqZXV6ZVhNWXJtN3hFRjBiRTArZGJ6RlRXbFhJdkVYVHlweFd0T3VIOXlEakxSVTBzWVEwQnJBVVNTUmI0NnBGTXZETkw3bGdYR2o1T2lGSXY5cDJrdmE1MkI2RHYvUjBnekFST0loVFdDbjBabi8wZ2xUcCtzQjFVZjJiK3lpb0cwK29KbGdoRHF2MFV5d2NUNEUraUtNUlBnaXBISFpVR2JXY0dkRnZBeGhjWmdJdmFtNU0yMWpoU01hNDBFK2F3RGI2MWZuZUlhQU15S0pBZGtaRG01MTZIMENKZFVqRmVwWTdwdDB1SVZBVTdWb3FtaWkvQi9aWTJvWUc1ZXU1dEpvSGRhM2lwMmRCWWFuSWJlaEs3R1J1bERYQXlVazZzaTcxa3NkNVB1UFl0dkh4NlRYSnBFczFIdmY5ZThONExUQktRcThNYnQ1NEs4YmFMdDVRMjVCRVJWSVpNS1dGOGJQVVBZWXBUbWxxT2JZalFxdC9tclF5c3czRVFYOVN5OVpaR1p0bnJjQnFDVUVjU0tURklKekhlbkl2Ri9IakF2TVJBUHZ0Vm5SY1BVZkcxOHY3VlpPQzJqZkhWeGRwMmJZc21OOVlyUGwvUW92bnh1UW9XdUVad1lxUzVkbzhrWjNlT2U3TmYzTS80eFVHR1gybERBVldNY1RWazVUZENpeTFqQjB2a0tuRW53RjYvUERidDdEeXFNVFlzWkNpek9LdmtJWUhoYlB5QnpLRVpqT0JIVVYveU1wZWhNZjc2Q2Ywck1ZQUVGemF0bW10Q21TNjFUdDZ1bkRTL2M4cHpLbkVGR1ZwTmJtQlZMM2lIOHZYeDdtRW1EcTVEZ0pxNFNpdWlyYUVQVSsvbSsyUmx2K1hCbDN6UGFzUTQ0SUhEZ2tFc3RJMjNtMi9maEtZeTVkb25qeklJNC9QOEt2aFpjem8vMDVyeXlBWkgrcHFRaUJNdlgwdUo0M3NCWCtMektGcnhISyt6dTg4aG04SnVUQ0lzcGQrdmQzNEZCZWhQNm0vY1R4U3E2K2QzRTNJMmVnMzFGNGh5NW9IRkFEd3Rsb3BTRjY4QlpmdklXa1g4RExGcktnRjl3dz09fDk5YTQ1NmU5NjhiNjY0NDM3YjRmMjMxMGFkZmY1N2JjMGI1OTM5MDgzNDIzM2NhMjBkODMzZTY1NmRlYjgyYmFkNjZlNjIwNGNhM2JlZDMzNGViYmIwMzVkZDdhZWYyNjFkNDA5YjY0M2Y2MDM2MmY0OGRhYTM1MWMxOTEwYTRjMDA2ZGZlODQyNWJlMTY5ZjJkZDM1NGU4MzMwN2M1OTAzMjUxYjBhMDU2YmNiYjBjMDk4ZDYxOWE5NTA5MWRhYjc3NDNjNjg3M2Y5ZDc2NTI1NTYyMzdkMTllYmFhYWQ2ZDBiZjQ5MDhmYTM3YjA1ZGFkYzdhOTM1NjIzOGYwNGYxYjRmMmJkNzgzZDdhZjk3NGVhZDQ3YzNlNDI1ODlkNWMzMmJhMDc1NWM5ODFkNmYzM2M4YjQ0YjdmOTc5MjdkMDQ5NjhmNjVkNWE2ZTdjNzU3Mjc1NWY0OTg2YWU1ODZmYmFiOTExM2FiNDdhMTE4NDA4OGI3NzA1YWI0N2RjNTYyMmE4MjMxZmE1YWVjMTdhMDgyNDA1ODQ1NDZmMTExY2YzM2YwNjJmODgzM2U1MWIyOTRjNThlOWMyNzIyNDFjNTQ2Y2QyMDkyOGU2MWRkYjQ0NjRjN2EzMTZiOWQ0MDNiNTA0M2FmMDkzYjI2OGFjZjVmYTZlNDMzYWExOGRmfDAwZWUwYjYyZWNhYWM4OWY%3D&cid=15%2C34&si=2&e=http%3A%2F%2Frewardscampaign.com&LSESSIONID=eyJpIjoiOFwvQVBFeGRCRHFJV2hxaVdNZEthWUE9PSIsImUiOiJWZDZPYzREYjFZNzBcL09QaENONE5JdUk0U0JLMjJNRHpvb0RUSTl0bFhlTmVsVUhoYnExb2NidUx0N01MRnBLdmV0TjVDXC9uQ0lkR2Q0VlpwWXRDSjBTczR2TnFkbW5cLzZoUVhpV1wvdDd4ZzlqQzBnZ3RycngwN0RLMTdPWHAyNHF5cWpIc3VBckZHcnQ2c0cxNDY4allBPT0ifQ%3D%3D.8432e8d31b144e40.MjdlNmRjY2NkYzhhNWZiNjgwMDBhNWRjYmJjMjMwZWJmYTlhMTM3MzE0MWIwMzBkZGI5Mjg5ZDBlNzUxNGQyNQ%3D%3D&t=jsonp&c=fqfdtdedtvwefgzt&eu=http%3A%2F%2Frewardscampaign.com%2Finetbank.html
Requested by
Host: ctmdx.anz.com
URL: https://ctmdx.anz.com/947684/QAW.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.105.68.94 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-68-94.ap-southeast-2.compute.amazonaws.com
Software
haile /
Resource Hash
1e6db37a788f2273331ecc6f7f467e1f02316c4e4a4e8f592979383d04a2f061
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
is-IS,is;q=0.9
Referer
http://rewardscampaign.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 Oct 2023 00:43:23 GMT
strict-transport-security
max-age=86400
server
haile
content-type
text/javascript
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
cache-control
no-cache, no-store, must-revalidate
content-length
90
pics-label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ANZ Bank (Banking)

67 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 string| pagePrefix object| digitalData object| launchLib object| sC object| nT string| sP function| fireViewStart function| fireViewEnd function| fireActionTrigger function| fireViewBottom object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in string| logTime object| analytics_lib object| superT object| pidRegistry object| targetGlobalSettings object| __target_telemetry object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate object| ___sc947684 object| ___so947684 number| CLIWHIT string| PSESSIONID string| SSESSIONID string| LSESSIONID object| __tp number| __gt function| validation function| valusername function| valpass string| ibLoginOrchHost string| ibLoginFinacleV65Host string| ibLoginHandoverHost string| loginSuccessPath string| loginSuccessDomain string| loginSuccessSecure string| loginSuccessMaxAge string| loginSuccessRedirectURL string| ibCroURL string| registrationSpaURL string| plannedMaintenanceFlag string| plannedMaintenanceDateTime string| ctiSnippetServerName string| isKillSwitchEnabled object| webpackJsonp function| index function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq string| tmp function| AppMeasurement_Module_AudienceManagement function| DIL object| s string| s_account

12 Cookies

Domain/Path Name / Value
.rewardscampaign.com/ Name: at_check
Value: true
rewardscampaign.com/ Name: LSESSIONID
Value: eyJpIjoiOFwvQVBFeGRCRHFJV2hxaVdNZEthWUE9PSIsImUiOiJWZDZPYzREYjFZNzBcL09QaENONE5JdUk0U0JLMjJNRHpvb0RUSTl0bFhlTmVsVUhoYnExb2NidUx0N01MRnBLdmV0TjVDXC9uQ0lkR2Q0VlpwWXRDSjBTczR2TnFkbW5cLzZoUVhpV1wvdDd4ZzlqQzBnZ3RycngwN0RLMTdPWHAyNHF5cWpIc3VBckZHcnQ2c0cxNDY4allBPT0ifQ%3D%3D.8432e8d31b144e40.MjdlNmRjY2NkYzhhNWZiNjgwMDBhNWRjYmJjMjMwZWJmYTlhMTM3MzE0MWIwMzBkZGI5Mjg5ZDBlNzUxNGQyNQ%3D%3D
.demdex.net/ Name: demdex
Value: 21723496585347926224199944356479690189
.anz.com/ Name: visid_incap_1967394
Value: 49jdffZyR6aidTMfRFSLNqgHO2UAAAAAQUIPAAAAAADt8c/giTyqRrrVo4C0+O4d
.anz.com/ Name: incap_ses_7227_1967394
Value: YELDXtpnt3ZNtJTkGXdLZKgHO2UAAAAAnN60URUnVXYPmrylLA8NFw==
.rewardscampaign.com/ Name: AMCVS_67A216D751E567B20A490D4C%40AdobeOrg
Value: 1
.rewardscampaign.com/ Name: mbox
Value: session#c5eb28221d9f489cadb8f592609c8ae7#1698369262
.rewardscampaign.com/ Name: s_plt
Value: NaN
.rewardscampaign.com/ Name: s_pltp
Value: undefined
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZTsHqQAAAFsfTQNn
.dpm.demdex.net/ Name: dpm
Value: 21723496585347926224199944356479690189
.rewardscampaign.com/ Name: AMCV_67A216D751E567B20A490D4C%40AdobeOrg
Value: 179643557%7CMCIDTS%7C19658%7CMCMID%7C21917988285243702644181129148792000827%7CMCAAMLH-1698972201%7C6%7CMCAAMB-1698972201%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1698374601s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19665%7CvVersion%7C5.5.0

7 Console Messages

Source Level URL
Text
network error URL: http://rewardscampaign.com/assets/config/vendors~main.e2edb374.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://rewardscampaign.com/assets/config/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=978994992
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
security error URL: https://anz.demdex.net/dest5.html?d_nsid=0(Line 12)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://login.anz.com') does not match the recipient window's origin ('http://rewardscampaign.com').
network error URL: https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/8a4e2a3d1cd7/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/8a4e2a3d1cd7/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_AudienceManagement.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.anz.com/auxiliary/supertag/auth/d6b7152cea5a/eb7fcbb87efe/8a4e2a3d1cd7/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: http://australianewzealandb.tt.omtrdc.net/rest/v1/delivery?client=australianewzealandb&sessionId=c5eb28221d9f489cadb8f592609c8ae7&version=2.10.0
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anz.com
anz.demdex.net
australianewzealandb.tt.omtrdc.net
cm.everesttech.net
ctmdx.anz.com
dpm.demdex.net
infos.anz.com
mstcl3.anz.com
rewardscampaign.com
waf1x.anz.com
www.anz.com
202.2.56.40
3.105.68.94
3.106.103.218
34.241.182.209
34.251.64.143
45.60.124.46
52.64.145.47
63.140.62.22
63.33.173.25
66.235.152.152
82.221.136.1
0a70b1f1447dfbe39e2e6676130f923a2431a3bc3be790d091e00188ee31bfb0
0f12656a38947cd455c1591b01c31a7925a2fce4c1303bba49a52eebe0e84765
1e6db37a788f2273331ecc6f7f467e1f02316c4e4a4e8f592979383d04a2f061
251549d96b5ba250b7d302c5b486955238be8f79d7e504631d49dacc04f34584
2eb58bbf68062c3a2e106fb67b42e11a2a57bea08bf122e9725d96b399fda85e
3115caa1c6d528ff24bd1fa1f93198f7f972fecd3f3a462aafadc5f2651e11db
331f28032df167773ab3b08e84fa75ac94330bf8740e60b7a5980749ba2a4c8b
34b7540d8e3acd1b76c54a4887f66e343d3f0779bff8056b1a7e5cd8fca735e5
38dfc726e1aa331feed5c9053a37992da13c77087fc7c4c7b3939a8f5f4dc1c1
43f8f122cd9bab694f84e243314165416455612a567c9970d62654d9d23f2f1d
47411138d872bec9bea4c2724ae5a68f508f537244bd2f8545f358cd6c9301b4
6be6b5358d307a7c2b61a8c8302fa76ac09e38fabb77499e4ea243c991ea809b
6e1c538de8c7d1019c485e1acea878c2861c4f97b51a1c36e2209c4cab08808e
70ac34d176f59098e867cd1008c65de5e945ae2ee702444a4e6e9ee10ae314dd
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7f3299a03780c427125b2498d139ee97c5f04780a40d1bb9590787b3aeb11731
803efdb5e4693d4cc82afc1ff3799a363d3dffeb0e2393049513043df0925515
847e396fcdbaabf1c7d08f1633c9790b864dcbef0f63a8082e18bd27cf5fb710
9af4df3b7f044525975716b175351fa75553070734627cf3b1325332284208c5
a3080630cedf7c6bb87229c4b11d206b3adb83753ced5558c7fea114bc0fd87a
b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05
b6bf163550dd994ccb01b937f1210281ec8681bfea58b38cf92b266a3d257cfc
bdcedcc0085acc0e4d5a4489b2d73c2aae3f918b17f31bafcf4d8e8b1cc772be
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629