Submitted URL: http://capitalonedatabreachsettlement.com/
Effective URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Submission: On August 03 via api from US

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 29 HTTP transactions. The main IP is 91.224.58.27, located in Czech Republic and belongs to GRANSY Gransy s.r.o. http://gransy.com, CZ. The main domain is myrewardclub.net.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 17th 2020. Valid for: 3 months.
This is the only time myrewardclub.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 103.224.182.242 133618 (TRELLIAN-...)
1 6 199.59.242.153 395082 (BODIS-NJ)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2 198.54.112.216 22612 (NAMECHEAP...)
14 91.224.58.27 60592 (GRANSY Gr...)
29 7
Domain Requested by
14 myrewardclub.net 1618.wcitianka.com
myrewardclub.net
6 ww25.capitalonedatabreachsettlement.com 1 redirects ww25.capitalonedatabreachsettlement.com
2 1618.wcitianka.com 1 redirects ww25.capitalonedatabreachsettlement.com
2 fonts.gstatic.com
1 fonts.googleapis.com ww25.capitalonedatabreachsettlement.com
1 www.google.com ww25.capitalonedatabreachsettlement.com
1 capitalonedatabreachsettlement.com 1 redirects
29 7

This site contains links to these domains. Also see Links.

Domain
opniivsac.com
tpliuvda.com
Subject Issuer Validity Valid
upload.video.google.com
GTS CA 1O1
2020-07-07 -
2020-09-29
3 months crt.sh
*.gstatic.com
GTS CA 1O1
2020-07-07 -
2020-09-29
3 months crt.sh
myrewardclub.net
Let's Encrypt Authority X3
2020-07-17 -
2020-10-15
3 months crt.sh

This page contains 1 frames:

Primary Page: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Frame ID: 296714E1FF049764B6F2C8AB153E48BF
Requests: 29 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://capitalonedatabreachsettlement.com/ HTTP 302
    http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04 Page URL
  2. http://ww25.capitalonedatabreachsettlement.com/rz?u=http%3A%2F%2F1618.wcitianka.com%2Fmatch-1618%2F52135%2F165960597%2F1596... HTTP 302
    http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7c... Page URL
  3. http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7c... HTTP 302
    https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i

Page Statistics

29
Requests

59 %
HTTPS

43 %
IPv6

6
Domains

7
Subdomains

7
IPs

4
Countries

247 kB
Transfer

373 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://capitalonedatabreachsettlement.com/ HTTP 302
    http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04 Page URL
  2. http://ww25.capitalonedatabreachsettlement.com/rz?u=http%3A%2F%2F1618.wcitianka.com%2Fmatch-1618%2F52135%2F165960597%2F1596476252%2Fmf_ef442ce8-816f-4182-9eb2-e282be8db7ca%2FYXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20%3D%2Ffeed&notadsafe&bod-31778a76-8fcb-11ea-bc55-0242ac130003 HTTP 302
    http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=/feed Page URL
  3. http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20= HTTP 302
    https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://capitalonedatabreachsettlement.com/ HTTP 302
  • http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
Request Chain 9
  • http://ww25.capitalonedatabreachsettlement.com/rz?u=http%3A%2F%2F1618.wcitianka.com%2Fmatch-1618%2F52135%2F165960597%2F1596476252%2Fmf_ef442ce8-816f-4182-9eb2-e282be8db7ca%2FYXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20%3D%2Ffeed&notadsafe&bod-31778a76-8fcb-11ea-bc55-0242ac130003 HTTP 302
  • http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=/feed

29 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
ww25.capitalonedatabreachsettlement.com/
Redirect Chain
  • http://capitalonedatabreachsettlement.com/
  • http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
4 KB
4 KB
Document
General
Full URL
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
Protocol
HTTP/1.1
Server
199.59.242.153 , United States, ASN395082 (BODIS-NJ, US),
Reverse DNS
Software
openresty /
Resource Hash
10962c4d953535690ea883815a68458c9cc0afda606b97f7311e542b055cf6c4

Request headers

Host
ww25.capitalonedatabreachsettlement.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
openresty
Date
Mon, 03 Aug 2020 17:37:31 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Adblock-Key
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_k7/EjQirNVOkSCR4fNUff4oEV/wrwqNMqQ7c15uiwLvP0D8Bf0ELHPhp4JN5GSuApqL+K3tnLg5WQeYJN7Nirg==

Redirect headers

Date
Mon, 03 Aug 2020 17:37:30 GMT
Server
Apache/2.4.25 (Debian)
Set-Cookie
__tad=1596476250.3084943; expires=Thu, 01-Aug-2030 17:37:30 GMT; Max-Age=315360000
Location
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
Content-Length
0
Connection
close
Content-Type
text/html; charset=UTF-8
caf.js
www.google.com/adsense/domains/
170 KB
60 KB
Script
General
Full URL
http://www.google.com/adsense/domains/caf.js
Requested by
Host: ww25.capitalonedatabreachsettlement.com
URL: http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
Protocol
HTTP/1.1
Server
2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
11d5dc5c6f8fe74ff705d1a6d5f82cda831703acceddd8194fb9693b5b90428c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:31 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
sffe
ETag
"118772194531122083"
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Cache-Control
private, max-age=3600
Transfer-Encoding
chunked
Accept-Ranges
bytes
X-XSS-Protection
0
Expires
Mon, 03 Aug 2020 17:37:31 GMT
px.gif
ww25.capitalonedatabreachsettlement.com/
42 B
275 B
Image
General
Full URL
http://ww25.capitalonedatabreachsettlement.com/px.gif?ch=1&rn=1.6014177103444749
Requested by
Host: ww25.capitalonedatabreachsettlement.com
URL: http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
Protocol
HTTP/1.1
Server
199.59.242.153 , United States, ASN395082 (BODIS-NJ, US),
Reverse DNS
Software
openresty /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:31 GMT
Last-Modified
Tue, 11 Feb 2020 15:26:27 GMT
Server
openresty
ETag
"5e42c7a3-2a"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
42
px.gif
ww25.capitalonedatabreachsettlement.com/
42 B
275 B
Image
General
Full URL
http://ww25.capitalonedatabreachsettlement.com/px.gif?ch=2&rn=1.6014177103444749
Requested by
Host: ww25.capitalonedatabreachsettlement.com
URL: http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
Protocol
HTTP/1.1
Server
199.59.242.153 , United States, ASN395082 (BODIS-NJ, US),
Reverse DNS
Software
openresty /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:31 GMT
Last-Modified
Tue, 11 Feb 2020 15:25:56 GMT
Server
openresty
ETag
"5e42c784-2a"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
42
glp
ww25.capitalonedatabreachsettlement.com/
8 KB
8 KB
Script
General
Full URL
http://ww25.capitalonedatabreachsettlement.com/glp?r=&u=http%3A%2F%2Fww25.capitalonedatabreachsettlement.com%2F&rw=1600&rh=1200&ww=1600&wh=1200&subid1=20200804-0337-30cd-894d-7fc46733ec04
Requested by
Host: ww25.capitalonedatabreachsettlement.com
URL: http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
Protocol
HTTP/1.1
Server
199.59.242.153 , United States, ASN395082 (BODIS-NJ, US),
Reverse DNS
Software
openresty /
Resource Hash
2e98cd598772db812ac3ec1a9b7d6ed718bc52e8ab60fa00989f43683faf2829

Request headers

Referer
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 03 Aug 2020 17:37:31 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Expires
Mon, 26 Jul 1997 05:00:00 GMT
css
fonts.googleapis.com/
5 KB
776 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,400
Requested by
Host: ww25.capitalonedatabreachsettlement.com
URL: http://ww25.capitalonedatabreachsettlement.com/glp?r=&u=http%3A%2F%2Fww25.capitalonedatabreachsettlement.com%2F&rw=1600&rh=1200&ww=1600&wh=1200&subid1=20200804-0337-30cd-894d-7fc46733ec04
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
bfa21901e87e44f386b8208764bc596acaaaa085e560bf989d40982eb0e5a7c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 03 Aug 2020 17:32:58 GMT
server
ESF
date
Mon, 03 Aug 2020 17:37:31 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 03 Aug 2020 17:37:31 GMT
gzb
ww25.capitalonedatabreachsettlement.com/
291 B
608 B
XHR
General
Full URL
http://ww25.capitalonedatabreachsettlement.com/gzb
Requested by
Host: ww25.capitalonedatabreachsettlement.com
URL: http://ww25.capitalonedatabreachsettlement.com/glp?r=&u=http%3A%2F%2Fww25.capitalonedatabreachsettlement.com%2F&rw=1600&rh=1200&ww=1600&wh=1200&subid1=20200804-0337-30cd-894d-7fc46733ec04
Protocol
HTTP/1.1
Server
199.59.242.153 , United States, ASN395082 (BODIS-NJ, US),
Reverse DNS
Software
openresty /
Resource Hash

Request headers

Referer
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Mon, 03 Aug 2020 17:37:32 GMT
Server
openresty
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Content-Length
291
Expires
Mon, 26 Jul 1997 05:00:00 GMT
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,400
Origin
http://ww25.capitalonedatabreachsettlement.com

Response headers

date
Thu, 09 Jul 2020 00:04:34 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:37 GMT
server
sffe
age
2223177
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9016
x-xss-protection
0
expires
Fri, 09 Jul 2021 00:04:34 GMT
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,400
Origin
http://ww25.capitalonedatabreachsettlement.com

Response headers

date
Mon, 27 Jul 2020 11:36:35 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:49 GMT
server
sffe
age
626456
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9132
x-xss-protection
0
expires
Tue, 27 Jul 2021 11:36:35 GMT
feed
1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=/
Redirect Chain
  • http://ww25.capitalonedatabreachsettlement.com/rz?u=http%3A%2F%2F1618.wcitianka.com%2Fmatch-1618%2F52135%2F165960597%2F1596476252%2Fmf_ef442ce8-816f-4182-9eb2-e282be8db7ca%2FYXBpeDAzLWNhcGl0YWxvbmV...
  • http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=/feed
450 B
530 B
Document
General
Full URL
http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=/feed
Requested by
Host: ww25.capitalonedatabreachsettlement.com
URL: http://ww25.capitalonedatabreachsettlement.com/glp?r=&u=http%3A%2F%2Fww25.capitalonedatabreachsettlement.com%2F&rw=1600&rh=1200&ww=1600&wh=1200&subid1=20200804-0337-30cd-894d-7fc46733ec04
Protocol
HTTP/1.1
Server
198.54.112.216 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash
2076ed4b78434c2026edeb7be98cbbabbe569b7256cadb2f65567236d4b06ce1

Request headers

Host
1618.wcitianka.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://ww25.capitalonedatabreachsettlement.com/?subid1=20200804-0337-30cd-894d-7fc46733ec04

Response headers

Server
nginx/1.14.2
Date
Mon, 03 Aug 2020 17:37:32 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
close
Content-Encoding
gzip

Redirect headers

Server
openresty
Date
Mon, 03 Aug 2020 17:37:32 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
Pragma
no-cache
Location
http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=/feed
Primary Request ch.php
myrewardclub.net/survey/isp/9/
Redirect Chain
  • http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=
  • https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
19 KB
5 KB
Document
General
Full URL
https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Requested by
Host: 1618.wcitianka.com
URL: http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=/feed
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
ea3f874ff074b142c717343d146ca7c2265fd26457a61135ade4ae360e9905d3

Request headers

Host
myrewardclub.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Referer
http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=/feed
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://1618.wcitianka.com/match-1618/52135/165960597/1596476252/mf_ef442ce8-816f-4182-9eb2-e282be8db7ca/YXBpeDAzLWNhcGl0YWxvbmVkYXRhYnJlYWNoc2V0dGxlbWVudC5jb20=/feed

Response headers

Server
nginx/1.10.3
Date
Mon, 03 Aug 2020 17:37:34 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
close
Content-Encoding
gzip

Redirect headers

Server
nginx/1.14.2
Date
Mon, 03 Aug 2020 17:37:33 GMT
Transfer-Encoding
chunked
Connection
close
Location
https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
style.css
myrewardclub.net/survey/isp/9/
3 KB
4 KB
Stylesheet
General
Full URL
https://myrewardclub.net/survey/isp/9/style.css
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
0d48bbfa3f7095002a7a81dfa2336237a64f96e2d31ef59265ea727b83db97e0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:36 GMT
Last-Modified
Fri, 08 May 2020 13:15:49 GMT
Server
nginx/1.10.3
ETag
"5eb55b85-dc2"
Content-Type
text/css
Connection
close
Accept-Ranges
bytes
Content-Length
3522
gift.png
myrewardclub.net/survey/isp/9/img/
2 KB
3 KB
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/img/gift.png
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
e60bfe16fc0913b792185d6a7a74a69b248291faa386acd4c705d7c63b141b21

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:36 GMT
Last-Modified
Tue, 29 Oct 2019 15:22:01 GMT
Server
nginx/1.10.3
ETag
"5db85919-997"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
2455
s20.png
myrewardclub.net/survey/isp/9/rewards/
52 KB
52 KB
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/rewards/s20.png
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
e331ed07cf4c757d601972923c5d8cb8f1e124e219e5a4d77a8f84e84bf6f8e4

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:38 GMT
Last-Modified
Thu, 07 May 2020 14:33:20 GMT
Server
nginx/1.10.3
ETag
"5eb41c30-cedb"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
52955
iphone11pro.png
myrewardclub.net/survey/isp/9/rewards/
50 KB
50 KB
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/rewards/iphone11pro.png
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
935790c63cf227360d4310e235ebd873e417a1920d346e0aaf6efb2d90922cc5

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:38 GMT
Last-Modified
Thu, 07 May 2020 14:33:21 GMT
Server
nginx/1.10.3
ETag
"5eb41c31-c717"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
50967
apple-watch.png
myrewardclub.net/survey/isp/9/img/
33 KB
33 KB
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/img/apple-watch.png
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
8e6a8688d9b7bd46613196dc550455cf502ae50c64da6a39ae6ee809a372837d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:38 GMT
Last-Modified
Wed, 29 Jan 2020 17:13:12 GMT
Server
nginx/1.10.3
ETag
"5e31bd28-826f"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
33391
profile-m1.jpeg
myrewardclub.net/survey/isp/9/img/
751 B
985 B
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/img/profile-m1.jpeg
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
4affaf310414f0a19991c8972d2bf5434d59edc87ba647b6944dbd43da4bbc8a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:38 GMT
Last-Modified
Tue, 29 Oct 2019 15:22:18 GMT
Server
nginx/1.10.3
ETag
"5db8592a-2ef"
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
751
profile-m2.jpeg
myrewardclub.net/survey/isp/9/img/
905 B
1 KB
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/img/profile-m2.jpeg
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
c83d941c56d23b7c5d0980d293e867d28350973e97a200138ec3b3d78695b1df

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:38 GMT
Last-Modified
Tue, 29 Oct 2019 15:22:21 GMT
Server
nginx/1.10.3
ETag
"5db8592d-389"
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
905
profile-f1.jpeg
myrewardclub.net/survey/isp/9/img/
766 B
1000 B
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/img/profile-f1.jpeg
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
8821ce39fc39eb206abedd042946f8770628b72d5cf270084ada5b3b02a81bab

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:40 GMT
Last-Modified
Tue, 29 Oct 2019 15:22:04 GMT
Server
nginx/1.10.3
ETag
"5db8591c-2fe"
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
766
profile-m3.jpeg
myrewardclub.net/survey/isp/9/img/
869 B
1 KB
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/img/profile-m3.jpeg
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
15153b7ba8003ee400d467442bcd38de93a047d7d04fa006bff003e65756c562

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:40 GMT
Last-Modified
Tue, 29 Oct 2019 15:22:24 GMT
Server
nginx/1.10.3
ETag
"5db85930-365"
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
869
profile-m4.jpeg
myrewardclub.net/survey/isp/9/img/
1006 B
1 KB
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/img/profile-m4.jpeg
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
c294e5bc19698dbd6d4d11a2d1ff44ba280fcd4678fbcdfc4a42fa859e41f86f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:40 GMT
Last-Modified
Tue, 29 Oct 2019 15:22:27 GMT
Server
nginx/1.10.3
ETag
"5db85933-3ee"
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
1006
profile-f2.jpeg
myrewardclub.net/survey/isp/9/img/
1019 B
1 KB
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/img/profile-f2.jpeg
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
242f292da79673a7b96ac06b6f4b39c1882f0c823169ba8127bcd8597e031b5d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:40 GMT
Last-Modified
Tue, 29 Oct 2019 15:22:06 GMT
Server
nginx/1.10.3
ETag
"5db8591e-3fb"
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
1019
profile-f3.jpeg
myrewardclub.net/survey/isp/9/img/
771 B
1005 B
Image
General
Full URL
https://myrewardclub.net/survey/isp/9/img/profile-f3.jpeg
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash
61407ca8945147b2a9cfe09720bd7f064d840a1f15d669932f2ed7ce3b178acf

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:41 GMT
Last-Modified
Tue, 29 Oct 2019 15:22:08 GMT
Server
nginx/1.10.3
ETag
"5db85920-303"
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
771
profile-f4.jpeg
myrewardclub.net/survey/isp/9/img/
0
0

profile-f5.jpeg
myrewardclub.net/survey/isp/9/img/
0
0

profile-m5.jpeg
myrewardclub.net/survey/isp/9/img/
0
0

profile-f6.jpeg
myrewardclub.net/survey/isp/9/img/
0
0

profile-m6.jpeg
myrewardclub.net/survey/isp/9/img/
0
0

jquery-1.12.4.min.js
myrewardclub.net/survey/isp/9/
3 KB
0
Script
General
Full URL
https://myrewardclub.net/survey/isp/9/jquery-1.12.4.min.js
Requested by
Host: myrewardclub.net
URL: https://myrewardclub.net/survey/isp/9/ch.php?click_id=1596476253.34-165960597-52135
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.224.58.27 , Czech Republic, ASN60592 (GRANSY Gransy s.r.o. http://gransy.com, CZ),
Reverse DNS
mng21.dmcahosting.com
Software
nginx/1.10.3 /
Resource Hash

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 03 Aug 2020 17:37:38 GMT
Last-Modified
Tue, 29 Oct 2019 15:24:00 GMT
Server
nginx/1.10.3
ETag
"5db85990-25f7d"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
155517

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
myrewardclub.net
URL
https://myrewardclub.net/survey/isp/9/img/profile-f4.jpeg
Domain
myrewardclub.net
URL
https://myrewardclub.net/survey/isp/9/img/profile-f5.jpeg
Domain
myrewardclub.net
URL
https://myrewardclub.net/survey/isp/9/img/profile-m5.jpeg
Domain
myrewardclub.net
URL
https://myrewardclub.net/survey/isp/9/img/profile-f6.jpeg
Domain
myrewardclub.net
URL
https://myrewardclub.net/survey/isp/9/img/profile-m6.jpeg

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| date

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1618.wcitianka.com
capitalonedatabreachsettlement.com
fonts.googleapis.com
fonts.gstatic.com
myrewardclub.net
ww25.capitalonedatabreachsettlement.com
www.google.com
myrewardclub.net
103.224.182.242
198.54.112.216
199.59.242.153
2a00:1450:4001:801::2004
2a00:1450:4001:818::2003
2a00:1450:4001:81f::200a
91.224.58.27
0d48bbfa3f7095002a7a81dfa2336237a64f96e2d31ef59265ea727b83db97e0
10962c4d953535690ea883815a68458c9cc0afda606b97f7311e542b055cf6c4
11d5dc5c6f8fe74ff705d1a6d5f82cda831703acceddd8194fb9693b5b90428c
15153b7ba8003ee400d467442bcd38de93a047d7d04fa006bff003e65756c562
2076ed4b78434c2026edeb7be98cbbabbe569b7256cadb2f65567236d4b06ce1
242f292da79673a7b96ac06b6f4b39c1882f0c823169ba8127bcd8597e031b5d
2e98cd598772db812ac3ec1a9b7d6ed718bc52e8ab60fa00989f43683faf2829
4affaf310414f0a19991c8972d2bf5434d59edc87ba647b6944dbd43da4bbc8a
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
61407ca8945147b2a9cfe09720bd7f064d840a1f15d669932f2ed7ce3b178acf
8821ce39fc39eb206abedd042946f8770628b72d5cf270084ada5b3b02a81bab
8e6a8688d9b7bd46613196dc550455cf502ae50c64da6a39ae6ee809a372837d
935790c63cf227360d4310e235ebd873e417a1920d346e0aaf6efb2d90922cc5
bfa21901e87e44f386b8208764bc596acaaaa085e560bf989d40982eb0e5a7c8
c294e5bc19698dbd6d4d11a2d1ff44ba280fcd4678fbcdfc4a42fa859e41f86f
c83d941c56d23b7c5d0980d293e867d28350973e97a200138ec3b3d78695b1df
e331ed07cf4c757d601972923c5d8cb8f1e124e219e5a4d77a8f84e84bf6f8e4
e60bfe16fc0913b792185d6a7a74a69b248291faa386acd4c705d7c63b141b21
ea3f874ff074b142c717343d146ca7c2265fd26457a61135ade4ae360e9905d3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629