URL: https://client.uat2.healthequity.com/
Submission: On February 02 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 24 HTTP transactions. The main IP is 52.252.18.104, located in Boydton, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is client.uat2.healthequity.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on July 29th 2021. Valid for: a year.
This is the only time client.uat2.healthequity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 52.252.18.104 8075 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 54.192.86.36 16509 (AMAZON-02)
3 18.64.79.43 16509 (AMAZON-02)
1 75.2.88.188 16509 (AMAZON-02)
6 13.69.106.215 8075 (MICROSOFT...)
24 7
Apex Domain
Subdomains
Transfer
11 healthequity.com
client.uat2.healthequity.com
api.uat2.healthequity.com
uat2.healthequity.com Failed
616 KB
6 visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 887
630 B
3 intercomcdn.com
js.intercomcdn.com — Cisco Umbrella Rank: 2553
125 KB
2 intercom.io
widget.intercom.io — Cisco Umbrella Rank: 2532
api-iam.intercom.io — Cisco Umbrella Rank: 2952
2 KB
1 gstatic.com
fonts.gstatic.com
14 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 78
68 KB
24 6
Domain Requested by
9 client.uat2.healthequity.com client.uat2.healthequity.com
6 dc.services.visualstudio.com client.uat2.healthequity.com
3 js.intercomcdn.com client.uat2.healthequity.com
widget.intercom.io
2 api.uat2.healthequity.com client.uat2.healthequity.com
1 api-iam.intercom.io js.intercomcdn.com
1 widget.intercom.io 1 redirects
1 fonts.gstatic.com client.uat2.healthequity.com
1 www.googletagmanager.com client.uat2.healthequity.com
0 uat2.healthequity.com Failed client.uat2.healthequity.com
24 9

This site contains no links.

Subject Issuer Validity Valid
*.healthequity.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-29 -
2022-07-29
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2021-12-27 -
2022-03-21
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-01-10 -
2022-04-04
3 months crt.sh
*.intercomcdn.com
Amazon
2022-01-30 -
2023-02-28
a year crt.sh
*.intercom.com
Amazon
2021-04-15 -
2022-05-14
a year crt.sh
in.applicationinsights.azure.com
Microsoft RSA TLS CA 01
2021-07-22 -
2022-07-22
a year crt.sh

This page contains 2 frames:

Frame: https://uat2.healthequity.com/ClientLogin.aspx?returnUrl=https%3A%2F%2Fapi.uat2.healthequity.com%2Fidentity%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dapps-employer-portal-stg%26redirect_uri%3Dhttps%253A%252F%252Fclient.uat2.healthequity.com%252Fsignin-callback%26response_type%3Dcode%26scope%3Dopenid%2520profile%2520apps-employer-befe%2520apps-peas-runtime-api%2520plum-application-apis%26state%3D494895bf91e14f2ca438382b88fe694a%26code_challenge%3DogyjUkktlWCdkizxM6rV3aQz6Jd0SPDUNDIc18hJcVg%26code_challenge_method%3DS256%26response_mode%3Dquery
Frame ID: 7A242FAF5CC3D2991E33859816E1DFBA
Requests: 17 HTTP requests in this frame

Frame: https://js.intercomcdn.com/frame-modern.0f5f6491.js
Frame ID: C8ACA8764EDBFEEA54365B91EB509DBF
Requests: 3 HTTP requests in this frame

Screenshot


Page Statistics

24
Requests

92 %
HTTPS

29 %
IPv6

6
Domains

9
Subdomains

7
IPs

3
Countries

825 kB
Transfer

3831 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://widget.intercom.io/widget/ag71ofgm HTTP 302
  • https://js.intercomcdn.com/shim.latest.js
Request Chain 22
  • https://api.uat2.healthequity.com/identity/connect/authorize?client_id=apps-employer-portal-stg&redirect_uri=https%3A%2F%2Fclient.uat2.healthequity.com%2Fsignin-callback&response_type=code&scope=openid%20profile%20apps-employer-befe%20apps-peas-runtime-api%20plum-application-apis&state=494895bf91e14f2ca438382b88fe694a&code_challenge=ogyjUkktlWCdkizxM6rV3aQz6Jd0SPDUNDIc18hJcVg&code_challenge_method=S256&response_mode=query HTTP 302
  • https://api.uat2.healthequity.com/identity/Account/Login?ReturnUrl=%2Fidentity%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dapps-employer-portal-stg%26redirect_uri%3Dhttps%253A%252F%252Fclient.uat2.healthequity.com%252Fsignin-callback%26response_type%3Dcode%26scope%3Dopenid%2520profile%2520apps-employer-befe%2520apps-peas-runtime-api%2520plum-application-apis%26state%3D494895bf91e14f2ca438382b88fe694a%26code_challenge%3DogyjUkktlWCdkizxM6rV3aQz6Jd0SPDUNDIc18hJcVg%26code_challenge_method%3DS256%26response_mode%3Dquery HTTP 302
  • https://uat2.healthequity.com/ClientLogin.aspx?returnUrl=https%3A%2F%2Fapi.uat2.healthequity.com%2Fidentity%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dapps-employer-portal-stg%26redirect_uri%3Dhttps%253A%252F%252Fclient.uat2.healthequity.com%252Fsignin-callback%26response_type%3Dcode%26scope%3Dopenid%2520profile%2520apps-employer-befe%2520apps-peas-runtime-api%2520plum-application-apis%26state%3D494895bf91e14f2ca438382b88fe694a%26code_challenge%3DogyjUkktlWCdkizxM6rV3aQz6Jd0SPDUNDIc18hJcVg%26code_challenge_method%3DS256%26response_mode%3Dquery

24 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
client.uat2.healthequity.com/
12 KB
3 KB
Document
General
Full URL
https://client.uat2.healthequity.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
9750949fc064fde33d4c731facb0f8b2caf23229e87653b648012b5228c44646
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Wed, 02 Feb 2022 15:46:12 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Server
nginx/1.19.1
Vary
Accept-Encoding
last-modified
Mon, 24 Jan 2022 21:02:00 GMT
etag
W/"61ef13c8-2e22"
x-envoy-upstream-service-time
3
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Encoding
gzip
env.js
client.uat2.healthequity.com/config/
2 KB
1 KB
Script
General
Full URL
https://client.uat2.healthequity.com/config/env.js
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
15f97e56d6c165d7f24dcb59d0eafd7a7cc6bdc76a47b696500842587dceb359
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://client.uat2.healthequity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 02 Feb 2022 15:46:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
last-modified
Wed, 26 Jan 2022 19:43:34 GMT
Server
nginx/1.19.1
etag
W/"61f1a466-690"
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Type
application/javascript
cache-control
no-cache
Transfer-Encoding
chunked
x-envoy-upstream-service-time
4
Connection
keep-alive
google-tag-manager.js
client.uat2.healthequity.com/assets/js/
427 B
717 B
Script
General
Full URL
https://client.uat2.healthequity.com/assets/js/google-tag-manager.js
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
8ef9fae2b1023e50af23f9501aa3d851f295ad6daf6e40d5991a3c0b845e6ba4
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://client.uat2.healthequity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 02 Feb 2022 15:46:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
last-modified
Mon, 24 Jan 2022 21:01:59 GMT
Server
nginx/1.19.1
etag
W/"61ef13c7-1ab"
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Type
application/javascript
Transfer-Encoding
chunked
x-envoy-upstream-service-time
2
Connection
keep-alive
google-analytics.js
client.uat2.healthequity.com/assets/js/
164 B
512 B
Script
General
Full URL
https://client.uat2.healthequity.com/assets/js/google-analytics.js
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
523c30238cbac6edeaf49fc25b106ce8cc46a94190d9f30eaee4ed1e8fd503d4
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://client.uat2.healthequity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 02 Feb 2022 15:46:12 GMT
last-modified
Mon, 24 Jan 2022 21:01:59 GMT
Server
nginx/1.19.1
etag
"61ef13c7-a4"
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Type
application/javascript
x-envoy-upstream-service-time
2
Connection
keep-alive
accept-ranges
bytes
Content-Length
164
runtime-es2015.3ed07805ec8aa846206a.js
client.uat2.healthequity.com/
3 KB
2 KB
Script
General
Full URL
https://client.uat2.healthequity.com/runtime-es2015.3ed07805ec8aa846206a.js
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
0030b3a3585849d03626dc86b10fa2d96eccb9c843c1359fa597ae78cb96c57c
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://client.uat2.healthequity.com/
Origin
https://client.uat2.healthequity.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 02 Feb 2022 15:46:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
last-modified
Mon, 24 Jan 2022 21:01:29 GMT
Server
nginx/1.19.1
etag
W/"61ef13a9-c62"
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Type
application/javascript
Transfer-Encoding
chunked
x-envoy-upstream-service-time
1
Connection
keep-alive
polyfills-es2015.6bde7e11871d84b2a8d4.js
client.uat2.healthequity.com/
204 KB
64 KB
Script
General
Full URL
https://client.uat2.healthequity.com/polyfills-es2015.6bde7e11871d84b2a8d4.js
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
9949c13c574f4975b0b19b838981a67479c6fc7a2096b2f92d0ccf59fc5d76a0
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://client.uat2.healthequity.com/
Origin
https://client.uat2.healthequity.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 02 Feb 2022 15:46:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
last-modified
Mon, 24 Jan 2022 21:01:31 GMT
Server
nginx/1.19.1
etag
W/"61ef13ab-330e6"
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Type
application/javascript
Transfer-Encoding
chunked
x-envoy-upstream-service-time
0
Connection
keep-alive
main-es2015.3126788f376678d117da.js
client.uat2.healthequity.com/
2 MB
398 KB
Script
General
Full URL
https://client.uat2.healthequity.com/main-es2015.3126788f376678d117da.js
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
982eae525224d759386e1f8ea8ca1ea4c53feaa3186c5c8e2f8a3f0924a88579
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://client.uat2.healthequity.com/
Origin
https://client.uat2.healthequity.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 02 Feb 2022 15:46:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
last-modified
Mon, 24 Jan 2022 21:01:59 GMT
Server
nginx/1.19.1
etag
W/"61ef13c7-18511e"
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Type
application/javascript
Transfer-Encoding
chunked
x-envoy-upstream-service-time
1
Connection
keep-alive
gtm.js
www.googletagmanager.com/
204 KB
68 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NQ4WKF8
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/assets/js/google-tag-manager.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3dafd730ed7e34232b02afbc3dee0d896d34a46d4aec4970cf3f54ce69dd6162
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://client.uat2.healthequity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Wed, 02 Feb 2022 15:46:12 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
68819
x-xss-protection
0
last-modified
Wed, 02 Feb 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 02 Feb 2022 15:46:12 GMT
styles.aaa5e7e3a5f0b8f7fd4d.css
client.uat2.healthequity.com/
254 KB
45 KB
Stylesheet
General
Full URL
https://client.uat2.healthequity.com/styles.aaa5e7e3a5f0b8f7fd4d.css
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
3a4fc1a96bc83b45e012b81574a7578de08ae5284f020f29737342635480e65a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://client.uat2.healthequity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 02 Feb 2022 15:46:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
last-modified
Mon, 24 Jan 2022 21:01:29 GMT
Server
nginx/1.19.1
etag
W/"61ef13a9-3f8fc"
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Type
text/css
Transfer-Encoding
chunked
x-envoy-upstream-service-time
0
Connection
keep-alive
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v20/
14 KB
14 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXiWtFCc.woff2
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://client.uat2.healthequity.com/
Origin
https://client.uat2.healthequity.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 01 Feb 2022 17:24:12 GMT
x-content-type-options
nosniff
age
80520
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14044
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:19:07 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 01 Feb 2023 17:24:12 GMT
shim.latest.js
js.intercomcdn.com/
Redirect Chain
  • https://widget.intercom.io/widget/ag71ofgm
  • https://js.intercomcdn.com/shim.latest.js
18 KB
6 KB
Script
General
Full URL
https://js.intercomcdn.com/shim.latest.js
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/
Protocol
H2
Server
18.64.79.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-64-79-43.txl50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
72c9fdc4dca7d550a0a05d3ddb00a540a5b58c44f7f110ad73d5219fe494d497

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://client.uat2.healthequity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Wed, 02 Feb 2022 15:45:05 GMT
content-encoding
gzip
last-modified
Wed, 02 Feb 2022 11:04:57 GMT
server
AmazonS3
age
68
etag
"2184de354fe663fe3b3f164fa98505f2"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
via
1.1 fdea8c36228dc968e7ca648afb7fdafa.cloudfront.net (CloudFront)
cache-control
max-age=300, s-maxage=300, public
x-amz-cf-pop
TXL50-P2
accept-ranges
bytes
content-length
6063
x-amz-cf-id
_lP8MaUqUJnqZ_Le5uL5Uk_LLDvVDg2gUf-qpvOaSB-kyP2SleYeUA==

Redirect headers

date
Wed, 02 Feb 2022 14:18:31 GMT
via
1.1 d8c5e23736c47a3e5184b0a78042898e.cloudfront.net (CloudFront)
server
AmazonS3
age
5263
x-cache
Hit from cloudfront
location
https://js.intercomcdn.com/shim.latest.js
x-amz-cf-pop
AMS50-C1
content-length
0
x-amz-cf-id
wU5hF4PLQEGcfq2D_zwG17yzlLh3NMWQ6U7UjpVo7bOyoU4Bq8iraQ==
927-es2015.0a1d47cb9d8e9e27b5d5.js
client.uat2.healthequity.com/
1 MB
101 KB
Script
General
Full URL
https://client.uat2.healthequity.com/927-es2015.0a1d47cb9d8e9e27b5d5.js
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/runtime-es2015.3ed07805ec8aa846206a.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
7c3c042d602543c92a544c6c4742ca1665663b43d618616a71df764875bdc807
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://client.uat2.healthequity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 02 Feb 2022 15:46:13 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
last-modified
Mon, 24 Jan 2022 21:01:40 GMT
Server
nginx/1.19.1
etag
W/"61ef13b4-11c18c"
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Type
application/javascript
Transfer-Encoding
chunked
x-envoy-upstream-service-time
0
Connection
keep-alive
frame-modern.0f5f6491.js
js.intercomcdn.com/ Frame C8AC
295 KB
79 KB
Script
General
Full URL
https://js.intercomcdn.com/frame-modern.0f5f6491.js
Requested by
Host: widget.intercom.io
URL: https://widget.intercom.io/widget/ag71ofgm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.64.79.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-64-79-43.txl50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
16bd7f29045fd2a733c635fa7af5b56c9fb312547b7eb6d2a78e965b33b57db0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Wed, 02 Feb 2022 15:05:01 GMT
content-encoding
gzip
last-modified
Wed, 02 Feb 2022 11:03:50 GMT
server
AmazonS3
age
2473
etag
"328da422eabcb920a27268f823eec6c6"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
via
1.1 fdea8c36228dc968e7ca648afb7fdafa.cloudfront.net (CloudFront)
cache-control
max-age=31536000, s-maxage=7200, public
x-amz-cf-pop
TXL50-P2
accept-ranges
bytes
content-length
80738
x-amz-cf-id
kvPb1ojT3ErkqaXZl95nTN69sb0Ty5ZBJ4uJFv4ORn3tcnSCvK2soA==
vendor-modern.06ea3d36.js
js.intercomcdn.com/ Frame C8AC
127 KB
39 KB
Script
General
Full URL
https://js.intercomcdn.com/vendor-modern.06ea3d36.js
Requested by
Host: widget.intercom.io
URL: https://widget.intercom.io/widget/ag71ofgm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.64.79.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-64-79-43.txl50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
14a17b0c010eae061036be4042baf0cae90918833d262e4228459d6c464f2e9b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Wed, 02 Feb 2022 15:08:46 GMT
content-encoding
gzip
last-modified
Tue, 01 Feb 2022 11:07:36 GMT
server
AmazonS3
age
2248
etag
"00f4e5b6cefe427f6f280f58852cfe74"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
via
1.1 fdea8c36228dc968e7ca648afb7fdafa.cloudfront.net (CloudFront)
cache-control
max-age=31536000, s-maxage=7200, public
x-amz-cf-pop
TXL50-P2
accept-ranges
bytes
content-length
39468
x-amz-cf-id
Is1fVAe2AwmZ5XJT3dbxRkJ-Jy4aOUw-X4UETS-IvGXY_2zWAIJ_Fg==
ping
api-iam.intercom.io/messenger/web/ Frame C8AC
3 KB
2 KB
XHR
General
Full URL
https://api-iam.intercom.io/messenger/web/ping
Requested by
Host: js.intercomcdn.com
URL: https://js.intercomcdn.com/frame-modern.0f5f6491.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.2.88.188 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ad8b87a22ce463223.awsglobalaccelerator.com
Software
nginx /
Resource Hash
bdeaa8e140bcc9aa9addaab491fce90b64213aeeb06e5093aa137f1508818300
Security Headers
Name Value
Strict-Transport-Security max-age=31556952; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Wed, 02 Feb 2022 15:46:14 GMT
content-encoding
gzip
x-ami-version
ami-0193189dbe736df96
status
200 OK
strict-transport-security
max-age=31556952; includeSubDomains; preload
vary
Accept,Accept-Encoding
x-xss-protection
1; mode=block
x-request-id
0001dl3jmp4o4la0ev1g
x-runtime
0.512962
server
nginx
x-frame-options
SAMEORIGIN
etag
W/"bdeaa8e140bcc9aa9addaab491fce90b"
x-ratelimit-remaining
13330
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://client.uat2.healthequity.com
x-intercom-version
391615c4b5369af326cfb4fd5a55900a32bf582f
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-ratelimit-reset
1643816780
x-ratelimit-limit
13333
access-control-allow-headers
Content-Type
x-content-type-options
nosniff
openid-configuration
api.uat2.healthequity.com/identity/.well-known/ Frame
0
0
Preflight
General
Full URL
https://api.uat2.healthequity.com/identity/.well-known/openid-configuration
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
request-id,traceparent
Origin
https://client.uat2.healthequity.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Wed, 02 Feb 2022 15:46:14 GMT
Connection
keep-alive
Server
nginx/1.19.1
access-control-allow-headers
request-id,traceparent
access-control-allow-methods
GET
access-control-allow-origin
https://client.uat2.healthequity.com
request-context
appId=cid-v1:70a2115f-967d-4857-a36c-ed5de76475eb
x-envoy-upstream-service-time
1
Strict-Transport-Security
max-age=15724800; includeSubDomains
openid-configuration
api.uat2.healthequity.com/identity/.well-known/
2 KB
1 KB
XHR
General
Full URL
https://api.uat2.healthequity.com/identity/.well-known/openid-configuration
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/polyfills-es2015.6bde7e11871d84b2a8d4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.252.18.104 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx/1.19.1 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://client.uat2.healthequity.com/
Request-Id
|e6a5ee2fc3b847a6a781595bcdd7a5aa.7183b48980d74c59
traceparent
00-e6a5ee2fc3b847a6a781595bcdd7a5aa-7183b48980d74c59-01
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Wed, 02 Feb 2022 15:46:14 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Server
nginx/1.19.1
Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
https://client.uat2.healthequity.com
Transfer-Encoding
chunked
x-envoy-upstream-service-time
3
Connection
keep-alive
request-context
appId=cid-v1:70a2115f-967d-4857-a36c-ed5de76475eb
track
dc.services.visualstudio.com/v2/ Frame
0
0
Preflight
General
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.215 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,sdk-context
Origin
https://client.uat2.healthequity.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-methods
POST
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin
*
access-control-max-age
3600
x-content-type-options
nosniff
date
Wed, 02 Feb 2022 15:46:13 GMT
content-length
0
track
dc.services.visualstudio.com/v2/
96 B
304 B
XHR
General
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/polyfills-es2015.6bde7e11871d84b2a8d4.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.215 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ce40971ebe7058fd22b95a1b9af21cf306918e94470b696a929550eaf901333d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://client.uat2.healthequity.com/
Accept-Language
de-DE,de;q=0.9
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
306F7CCB-3B92-4C3A-965C-F45E3441526C
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
date
Wed, 02 Feb 2022 15:46:14 GMT
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length
96
track
dc.services.visualstudio.com/v2/ Frame
0
0
Preflight
General
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.215 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,sdk-context
Origin
https://client.uat2.healthequity.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-methods
POST
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin
*
access-control-max-age
3600
x-content-type-options
nosniff
date
Wed, 02 Feb 2022 15:46:13 GMT
content-length
0
track
dc.services.visualstudio.com/v2/
96 B
163 B
XHR
General
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/polyfills-es2015.6bde7e11871d84b2a8d4.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.215 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2f88c7a0be3d81972deb740264380662fcace3cb3c8e8fe45eb3dbc4cdbe579f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://client.uat2.healthequity.com/
Accept-Language
de-DE,de;q=0.9
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
1B509680-C98E-46C7-A521-D039E87FCC90
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
date
Wed, 02 Feb 2022 15:46:14 GMT
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length
96
track
dc.services.visualstudio.com/v2/ Frame
0
0
Preflight
General
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.215 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,sdk-context
Origin
https://client.uat2.healthequity.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-methods
POST
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin
*
access-control-max-age
3600
x-content-type-options
nosniff
date
Wed, 02 Feb 2022 15:46:14 GMT
content-length
0
track
dc.services.visualstudio.com/v2/
96 B
163 B
Fetch
General
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: client.uat2.healthequity.com
URL: https://client.uat2.healthequity.com/polyfills-es2015.6bde7e11871d84b2a8d4.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.215 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://client.uat2.healthequity.com/
Accept-Language
de-DE,de;q=0.9
sdk-context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
application/json

Response headers

x-ms-session-id
9FE8E1F2-5142-431E-AD2C-D4D989B5F523
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
date
Wed, 02 Feb 2022 15:46:14 GMT
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length
96
ClientLogin.aspx
uat2.healthequity.com/
Redirect Chain
  • https://api.uat2.healthequity.com/identity/connect/authorize?client_id=apps-employer-portal-stg&redirect_uri=https%3A%2F%2Fclient.uat2.healthequity.com%2Fsignin-callback&response_type=code&scope=op...
  • https://api.uat2.healthequity.com/identity/Account/Login?ReturnUrl=%2Fidentity%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dapps-employer-portal-stg%26redirect_uri%3Dhttps%253A%252F%252Fclient.ua...
  • https://uat2.healthequity.com/ClientLogin.aspx?returnUrl=https%3A%2F%2Fapi.uat2.healthequity.com%2Fidentity%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dapps-employer-portal-stg%26redirect_uri%3D...
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
uat2.healthequity.com
URL
https://uat2.healthequity.com/ClientLogin.aspx?returnUrl=https%3A%2F%2Fapi.uat2.healthequity.com%2Fidentity%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dapps-employer-portal-stg%26redirect_uri%3Dhttps%253A%252F%252Fclient.uat2.healthequity.com%252Fsignin-callback%26response_type%3Dcode%26scope%3Dopenid%2520profile%2520apps-employer-befe%2520apps-peas-runtime-api%2520plum-application-apis%26state%3D494895bf91e14f2ca438382b88fe694a%26code_challenge%3DogyjUkktlWCdkizxM6rV3aQz6Jd0SPDUNDIc18hJcVg%26code_challenge_method%3DS256%26response_mode%3Dquery

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Domain/Path Name / Value
client.uat2.healthequity.com/ Name: ai_user
Value: rtAkJbW/b2vFryJ6Z/W2zC|2022-02-02T15:46:12.614Z
client.uat2.healthequity.com/ Name: ai_session
Value: DZv7j8Dv0S/+qm0/GRdPJE|1643816772633|1643816772922
.healthequity.com/ Name: intercom-id-ag71ofgm
Value: 7daac2d6-1efe-45b4-9bda-9829d8a532ac
.healthequity.com/ Name: intercom-session-ag71ofgm
Value:

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-iam.intercom.io
api.uat2.healthequity.com
client.uat2.healthequity.com
dc.services.visualstudio.com
fonts.gstatic.com
js.intercomcdn.com
uat2.healthequity.com
widget.intercom.io
www.googletagmanager.com
uat2.healthequity.com
13.69.106.215
18.64.79.43
2a00:1450:4001:827::2003
2a00:1450:4001:830::2008
52.252.18.104
54.192.86.36
75.2.88.188
0030b3a3585849d03626dc86b10fa2d96eccb9c843c1359fa597ae78cb96c57c
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
14a17b0c010eae061036be4042baf0cae90918833d262e4228459d6c464f2e9b
15f97e56d6c165d7f24dcb59d0eafd7a7cc6bdc76a47b696500842587dceb359
16bd7f29045fd2a733c635fa7af5b56c9fb312547b7eb6d2a78e965b33b57db0
2f88c7a0be3d81972deb740264380662fcace3cb3c8e8fe45eb3dbc4cdbe579f
3a4fc1a96bc83b45e012b81574a7578de08ae5284f020f29737342635480e65a
3dafd730ed7e34232b02afbc3dee0d896d34a46d4aec4970cf3f54ce69dd6162
523c30238cbac6edeaf49fc25b106ce8cc46a94190d9f30eaee4ed1e8fd503d4
72c9fdc4dca7d550a0a05d3ddb00a540a5b58c44f7f110ad73d5219fe494d497
7c3c042d602543c92a544c6c4742ca1665663b43d618616a71df764875bdc807
8ef9fae2b1023e50af23f9501aa3d851f295ad6daf6e40d5991a3c0b845e6ba4
9750949fc064fde33d4c731facb0f8b2caf23229e87653b648012b5228c44646
982eae525224d759386e1f8ea8ca1ea4c53feaa3186c5c8e2f8a3f0924a88579
9949c13c574f4975b0b19b838981a67479c6fc7a2096b2f92d0ccf59fc5d76a0
bdeaa8e140bcc9aa9addaab491fce90b64213aeeb06e5093aa137f1508818300
ce40971ebe7058fd22b95a1b9af21cf306918e94470b696a929550eaf901333d