urlscan.io logo urlscan.io
SecurityTrails logo

fi.campaign.mrcal365.com Open in urlscan Pro
5.179.84.164  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://wuniny.com/?a=3264&c=16491&s1=
Effective URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Submission: On January 03 via manual from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 7 domains to perform 22 HTTP transactions. The main IP is 5.179.84.164, located in Copenhagen, Denmark and belongs to NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK. The main domain is fi.campaign.mrcal365.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 2nd 2019. Valid for: 3 months.
This is the only time fi.campaign.mrcal365.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 34.243.197.174 16509 (AMAZON-02)
1 1 54.72.199.154 16509 (AMAZON-02)
1 8 2606:4700:30:... 13335 (CLOUDFLAR...)
11 5.179.84.164 31027 (NIANET-AS...)
2 2606:4700:30:... 13335 (CLOUDFLAR...)
1 151.101.2.110 54113 (FASTLY)
1 162.247.242.20 23467 (NEWRELIC-...)
22 5
1    34.243.197.174 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-243-197-174.eu-west-1.compute.amazonaws.com
wuniny.com
1    54.72.199.154 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-72-199-154.eu-west-1.compute.amazonaws.com
make.thegentlesttouch.org
8    2606:4700:30::681c:1b66 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.nordicgiveaways.club
11    5.179.84.164 (Copenhagen, Denmark)

ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK)
fi.campaign.mrcal365.com
2    2606:4700:30::6818:72a8 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.nordicgiveaways.com
1    151.101.2.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com
1    162.247.242.20 (United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-8.nr-data.net
bam.nr-data.net
Domain Requested by
11 fi.campaign.mrcal365.com www.nordicgiveaways.club
fi.campaign.mrcal365.com
8 www.nordicgiveaways.club 1 redirects www.nordicgiveaways.club
2 www.nordicgiveaways.com fi.campaign.mrcal365.com
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com fi.campaign.mrcal365.com
1 make.thegentlesttouch.org 1 redirects
1 wuniny.com 1 redirects
22 7

This site contains no links.

Subject Issuer Validity Valid
sni194236.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2018-12-06 -
2019-06-14		 6 months crt.sh
campaign.mrcal365.com
Let's Encrypt Authority X3		 2019-01-02 -
2019-04-02		 3 months crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2018-12-06 -
2019-04-14		 4 months crt.sh
*.nr-data.net
GeoTrust RSA CA 2018		 2018-01-11 -
2020-03-17		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Frame ID: C15234EB7C7AAA382692DAB1F1ED70EF
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://wuniny.com/?a=3264&c=16491&s1= HTTP 302
    http://make.thegentlesttouch.org/aff_c?offer_id=127&aff_id=1019&aff_sub=3264&aff_sub2=16334-282118199 HTTP 302
    https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4 Page URL
  2. https://www.nordicgiveaways.club/urlshort_test/uid_long=13231&tracking_id=25221053&token=07rEWcK1qqCadab8q3nQ... HTTP 302
    https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
  • env /^Modernizr$/i
Overall confidence: 100%
Detected patterns
  • env /^NREUM/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

22
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

5
IPs

3
Countries

753 kB
Transfer

1492 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://wuniny.com/?a=3264&c=16491&s1= HTTP 302
    http://make.thegentlesttouch.org/aff_c?offer_id=127&aff_id=1019&aff_sub=3264&aff_sub2=16334-282118199 HTTP 302
    https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4 Page URL
  2. https://www.nordicgiveaways.club/urlshort_test/uid_long=13231&tracking_id=25221053&token=07rEWcK1qqCadab8q3nQA0RLbI48eXw5UgkzcIwg&preview=0&subid_json=eyJzdWJpZDEiOiIxMDE5Iiwic3ViaWQiOiIxMDE5Iiwic3ViaWQyIjoiMTAyMWY5MDRjODhiODMwYzQ2M2UxMDg4MzcxZWU0In0= HTTP 302
    https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://wuniny.com/?a=3264&c=16491&s1= HTTP 302
  • http://make.thegentlesttouch.org/aff_c?offer_id=127&aff_id=1019&aff_sub=3264&aff_sub2=16334-282118199 HTTP 302
  • https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4

22 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
subid=1019&subid2=1021f904c88b830c463e1088371ee4
www.nordicgiveaways.club/survey/samsdirf/source=bob/
Redirect Chain
  • http://wuniny.com/?a=3264&c=16491&s1=
  • http://make.thegentlesttouch.org/aff_c?offer_id=127&aff_id=1019&aff_sub=3264&aff_sub2=16334-282118199
  • https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1b66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.33
Resource Hash
a1b34bb405b56dd6629756888096eb27b3abb32b8157cb1ec3d0c613c9f8aa0d

Request headers

:method
GET
:authority
www.nordicgiveaways.club
:scheme
https
:path
/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Thu, 03 Jan 2019 07:35:19 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=dccedf44192ca128a3a7a1d48b13db2dc1546500919; expires=Fri, 03-Jan-20 07:35:19 GMT; path=/; domain=.nordicgiveaways.club; HttpOnly laravel_session=eyJpdiI6IlBUMVdlNFpcL1ZZK1pNSkUwS0hvQ01BPT0iLCJ2YWx1ZSI6ImlJTVwvRXBsV2ZvTnZpNnlYczVNbG4wOG1rNENTR1NVUjZEeXFwdnpRRDMrUm9tVVZRZ1BhQlpwRjA0cFIxOVN2VUtMUlwvcURBckJRYmJET0ZabnhRZVE9PSIsIm1hYyI6IjcyZjA0M2RlMjgyNzU5NWI2NzhmNGYyNmMxZDY5MjY1NzI1MWMzNWZjMzQ4MDg3YWVlNzM2ZjUzNjYxMjU0ZmYifQ%3D%3D; expires=Thu, 10-Jan-2019 06:14:19 GMT; Max-Age=599940; path=/; httponly
vary
Accept-Encoding
x-powered-by
PHP/5.6.33
cache-control
no-cache
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4933c9bc4cdcc2ec-FRA
content-encoding
br

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=iso-8859-1
Date
Thu, 03 Jan 2019 07:35:19 GMT
Expires
Sat, 26 Jul 1997 05:00:00 GMT
Location
https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4
P3P
CP="NOI CUR OUR NOR INT"
Pragma
no-cache
Server
nginx/1.13.12
Set-Cookie
enc_aff_session_127=ENC0351662ec38170a6c3c4baa85c82002c1343df6a83127b0b83e22730eb142c82387a6bbf58233d390c2ef74de9ae379d925255bb075d33b8e774a9048eef4ffae7496852ef15ca68e64f75de278a51b2cd5c23002fc9001215edc276ad8e34b4223be8339975adf52b934d0b39d2ec6227bc8cd7c0e64faafdc962f7efa8356ef40ed48f75; expires=Sun, 03 Feb 2019 07:35:19 GMT; path=/; ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiI2Ny4wIiwibW9iaWxlX2NhcnJpZXIiOiI/IiwidXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwXzEzXzUpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS82Ny4wLjMzOTYuODcgU2FmYXJpLzUzNy4zNiIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ==; expires=Sat, 27 Nov 2021 18:15:19 GMT; path=/;
tracking_id
1021f904c88b830c463e1088371ee4
X-Robots-Tag
noindex, nofollow
Content-Length
296
Connection
keep-alive
jquery.js
www.nordicgiveaways.club/js/ 		278 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/js/jquery.js
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1b66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed

Request headers

:path
/js/jquery.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.nordicgiveaways.club
cookie
__cfduid=dccedf44192ca128a3a7a1d48b13db2dc1546500919; laravel_session=eyJpdiI6IlBUMVdlNFpcL1ZZK1pNSkUwS0hvQ01BPT0iLCJ2YWx1ZSI6ImlJTVwvRXBsV2ZvTnZpNnlYczVNbG4wOG1rNENTR1NVUjZEeXFwdnpRRDMrUm9tVVZRZ1BhQlpwRjA0cFIxOVN2VUtMUlwvcURBckJRYmJET0ZabnhRZVE9PSIsIm1hYyI6IjcyZjA0M2RlMjgyNzU5NWI2NzhmNGYyNmMxZDY5MjY1NzI1MWMzNWZjMzQ4MDg3YWVlNzM2ZjUzNjYxMjU0ZmYifQ%3D%3D
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 07:35:19 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:11:54 GMT
server
cloudflare
etag
W/"5807711a-456ea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4933c9bd1f1fc2ec-FRA
expires
Thu, 03 Jan 2019 11:35:19 GMT
bootstrap.js
www.nordicgiveaways.club/js/ 		67 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/js/bootstrap.js
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1b66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef43a4d502ffb688656851d788c42869d47e8840d007b4f4b66f62530171acd4

Request headers

:path
/js/bootstrap.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.nordicgiveaways.club
cookie
__cfduid=dccedf44192ca128a3a7a1d48b13db2dc1546500919; laravel_session=eyJpdiI6IlBUMVdlNFpcL1ZZK1pNSkUwS0hvQ01BPT0iLCJ2YWx1ZSI6ImlJTVwvRXBsV2ZvTnZpNnlYczVNbG4wOG1rNENTR1NVUjZEeXFwdnpRRDMrUm9tVVZRZ1BhQlpwRjA0cFIxOVN2VUtMUlwvcURBckJRYmJET0ZabnhRZVE9PSIsIm1hYyI6IjcyZjA0M2RlMjgyNzU5NWI2NzhmNGYyNmMxZDY5MjY1NzI1MWMzNWZjMzQ4MDg3YWVlNzM2ZjUzNjYxMjU0ZmYifQ%3D%3D
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 07:35:19 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:11:56 GMT
server
cloudflare
etag
W/"5807711c-10d1a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4933c9bd1f20c2ec-FRA
expires
Thu, 03 Jan 2019 11:35:19 GMT
jquery.cookie.js
www.nordicgiveaways.club/js/plugins/jqueryCookie/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/js/plugins/jqueryCookie/jquery.cookie.js
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1b66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Request headers

:path
/js/plugins/jqueryCookie/jquery.cookie.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.nordicgiveaways.club
cookie
__cfduid=dccedf44192ca128a3a7a1d48b13db2dc1546500919; laravel_session=eyJpdiI6IlBUMVdlNFpcL1ZZK1pNSkUwS0hvQ01BPT0iLCJ2YWx1ZSI6ImlJTVwvRXBsV2ZvTnZpNnlYczVNbG4wOG1rNENTR1NVUjZEeXFwdnpRRDMrUm9tVVZRZ1BhQlpwRjA0cFIxOVN2VUtMUlwvcURBckJRYmJET0ZabnhRZVE9PSIsIm1hYyI6IjcyZjA0M2RlMjgyNzU5NWI2NzhmNGYyNmMxZDY5MjY1NzI1MWMzNWZjMzQ4MDg3YWVlNzM2ZjUzNjYxMjU0ZmYifQ%3D%3D
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 07:35:19 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:14:52 GMT
server
cloudflare
etag
W/"580771cc-c31"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4933c9bd1f23c2ec-FRA
expires
Thu, 03 Jan 2019 11:35:19 GMT
survey
www.nordicgiveaways.club/survey/ 		11 B
391 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/survey/survey
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/js/jquery.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1b66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.33
Resource Hash
b711bf106e56b54fcb06d2abd26fd61e41575ac591a82fd02a6fbae9137fb66f

Request headers

:path
/survey/survey
pragma
no-cache
cookie
__cfduid=dccedf44192ca128a3a7a1d48b13db2dc1546500919; laravel_session=eyJpdiI6IlBUMVdlNFpcL1ZZK1pNSkUwS0hvQ01BPT0iLCJ2YWx1ZSI6ImlJTVwvRXBsV2ZvTnZpNnlYczVNbG4wOG1rNENTR1NVUjZEeXFwdnpRRDMrUm9tVVZRZ1BhQlpwRjA0cFIxOVN2VUtMUlwvcURBckJRYmJET0ZabnhRZVE9PSIsIm1hYyI6IjcyZjA0M2RlMjgyNzU5NWI2NzhmNGYyNmMxZDY5MjY1NzI1MWMzNWZjMzQ4MDg3YWVlNzM2ZjUzNjYxMjU0ZmYifQ%3D%3D; b2ZmZXJXYWxs=%7B%22campaign%22%3A%2210149%22%2C%22survey%22%3A%2211853%22%2C%22source%22%3A%22bob%22%2C%22subid%22%3A%22subid%3D1019%26subid2%3D1021f904c88b830c463e1088371ee4%22%2C%22firstSession%22%3A%2207rEWcK1qqCadab8q3nQA0RLbI48eXw5UgkzcIwg_10149%22%7D; survey_id_11853=true; cHJvZHVjdENvb213231=triggerON; cHJvZHVjdENQQQ13231=triggerON
origin
https://www.nordicgiveaways.club
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/x-www-form-urlencoded; charset=UTF-8
accept
text/html, */*; q=0.01
cache-control
no-cache
:authority
www.nordicgiveaways.club
x-requested-with
XMLHttpRequest
:scheme
https
content-length
57
:method
POST
Accept
text/html, */*; q=0.01
Origin
https://www.nordicgiveaways.club
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 03 Jan 2019 07:35:19 GMT
content-encoding
br
server
cloudflare
status
200
x-powered-by
PHP/5.6.33
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://www.nordicgiveaways.club
cache-control
no-cache
set-cookie
laravel_session=eyJpdiI6InU0WFhSeUY2Nmk5ZFp3MmJ0dzByZkE9PSIsInZhbHVlIjoiMHcrNDJWN2J0Tm9uVjF6KyttU2k2UHZOVWRzN2diVkNCYVlmT0lVazFMWlFhQlFpM3dWY2xsbVRVMmd3UWdlTnhIYzE2VisxUitIcnhUbldJd0VyMmc9PSIsIm1hYyI6ImQ1YTg4MmI1ODlkODM2ZGFlMzdkYTU0N2UyYzA5ZTBjZGFiNjgzMDhlZDViMGViYWQ4M2U3NDEyZmM3Y2Y1MjEifQ%3D%3D; expires=Thu, 10-Jan-2019 06:14:19 GMT; Max-Age=599940; path=/; httponly
cf-ray
4933c9bd684fc2ec-FRA
survey
www.nordicgiveaways.club/survey/ 		14 B
370 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/survey/survey
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/js/jquery.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1b66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.33
Resource Hash
930bd3dca9f0581f01df5c4d8e9e14e555eb55a9e1e4344f95927becf7e5b158

Request headers

:path
/survey/survey
pragma
no-cache
cookie
__cfduid=dccedf44192ca128a3a7a1d48b13db2dc1546500919; laravel_session=eyJpdiI6IlBUMVdlNFpcL1ZZK1pNSkUwS0hvQ01BPT0iLCJ2YWx1ZSI6ImlJTVwvRXBsV2ZvTnZpNnlYczVNbG4wOG1rNENTR1NVUjZEeXFwdnpRRDMrUm9tVVZRZ1BhQlpwRjA0cFIxOVN2VUtMUlwvcURBckJRYmJET0ZabnhRZVE9PSIsIm1hYyI6IjcyZjA0M2RlMjgyNzU5NWI2NzhmNGYyNmMxZDY5MjY1NzI1MWMzNWZjMzQ4MDg3YWVlNzM2ZjUzNjYxMjU0ZmYifQ%3D%3D; b2ZmZXJXYWxs=%7B%22campaign%22%3A%2210149%22%2C%22survey%22%3A%2211853%22%2C%22source%22%3A%22bob%22%2C%22subid%22%3A%22subid%3D1019%26subid2%3D1021f904c88b830c463e1088371ee4%22%2C%22firstSession%22%3A%2207rEWcK1qqCadab8q3nQA0RLbI48eXw5UgkzcIwg_10149%22%7D; survey_id_11853=true; cHJvZHVjdENvb213231=triggerON; cHJvZHVjdENQQQ13231=triggerON
origin
https://www.nordicgiveaways.club
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/x-www-form-urlencoded; charset=UTF-8
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.nordicgiveaways.club
x-requested-with
XMLHttpRequest
:scheme
https
content-length
62
:method
POST
Accept
application/json, text/javascript, */*; q=0.01
Origin
https://www.nordicgiveaways.club
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 03 Jan 2019 07:35:19 GMT
content-encoding
br
server
cloudflare
status
200
x-powered-by
PHP/5.6.33
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://www.nordicgiveaways.club
cache-control
no-cache
set-cookie
laravel_session=eyJpdiI6IktIbmo4NnBNQXRnNGFXSnJhYXplTWc9PSIsInZhbHVlIjoiVmR0Sks1RWlZU3hIc0c3MUtKR1NVYkU5MWhSdWhxUlUrNUlQZncyMDB5Q29xS3VlYmp0aU55c0Q5a0NEdEtmbFwvV1ZCMXVKUURxM0lMbTBGZHRCWUpRPT0iLCJtYWMiOiIzMmMyZjdhZTM2Mzg1YWFmNGU4NTViZjY5N2VmOWRjODQ1MDU1ZWQ0NWNmMGVmMzAzNTNiMzA0NWVhOTBjOWVmIn0%3D; expires=Thu, 10-Jan-2019 06:14:19 GMT; Max-Age=599940; path=/; httponly
cf-ray
4933c9bd6861c2ec-FRA
survey
www.nordicgiveaways.club/survey/ 		18 B
373 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/survey/survey
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/js/jquery.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1b66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.33
Resource Hash
a69ea33bdaaa0d88072e69964ae80235cf96167d87b206aad76baa5d245d5360

Request headers

:path
/survey/survey
pragma
no-cache
cookie
__cfduid=dccedf44192ca128a3a7a1d48b13db2dc1546500919; laravel_session=eyJpdiI6IlBUMVdlNFpcL1ZZK1pNSkUwS0hvQ01BPT0iLCJ2YWx1ZSI6ImlJTVwvRXBsV2ZvTnZpNnlYczVNbG4wOG1rNENTR1NVUjZEeXFwdnpRRDMrUm9tVVZRZ1BhQlpwRjA0cFIxOVN2VUtMUlwvcURBckJRYmJET0ZabnhRZVE9PSIsIm1hYyI6IjcyZjA0M2RlMjgyNzU5NWI2NzhmNGYyNmMxZDY5MjY1NzI1MWMzNWZjMzQ4MDg3YWVlNzM2ZjUzNjYxMjU0ZmYifQ%3D%3D; b2ZmZXJXYWxs=%7B%22campaign%22%3A%2210149%22%2C%22survey%22%3A%2211853%22%2C%22source%22%3A%22bob%22%2C%22subid%22%3A%22subid%3D1019%26subid2%3D1021f904c88b830c463e1088371ee4%22%2C%22firstSession%22%3A%2207rEWcK1qqCadab8q3nQA0RLbI48eXw5UgkzcIwg_10149%22%7D; survey_id_11853=true; cHJvZHVjdENvb213231=triggerON; cHJvZHVjdENQQQ13231=triggerON
origin
https://www.nordicgiveaways.club
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/x-www-form-urlencoded; charset=UTF-8
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.nordicgiveaways.club
x-requested-with
XMLHttpRequest
:scheme
https
content-length
157
:method
POST
Accept
application/json, text/javascript, */*; q=0.01
Origin
https://www.nordicgiveaways.club
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 03 Jan 2019 07:35:19 GMT
content-encoding
br
server
cloudflare
status
200
x-powered-by
PHP/5.6.33
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://www.nordicgiveaways.club
cache-control
no-cache
set-cookie
laravel_session=eyJpdiI6InRPbnFSNlZDNlY1dmM0YkUwaVpuZUE9PSIsInZhbHVlIjoiVWk3UG51S0NKSllBNVJHTzJoY0UwRXhRaUlXdmNFR2E1XC9UR25valo3WXFsenk2S01wZ1FqTis5TUtWOUR0aFJ3QjI4T0NLZFFwWW1zNWszRFwvemhEQT09IiwibWFjIjoiMzkxM2MwODZjODliNTAzMGI5NmMzMzEzMzlmN2ZjMTYxZDVkMmQ1YTIwNTgwOTFhNDUxNjJlMjNjMWU3MTJhZiJ9; expires=Thu, 10-Jan-2019 06:14:19 GMT; Max-Age=599940; path=/; httponly
cf-ray
4933c9bd6862c2ec-FRA
Primary Request Cookie set signup
fi.campaign.mrcal365.com/lp/
Redirect Chain
  • https://www.nordicgiveaways.club/urlshort_test/uid_long=13231&tracking_id=25221053&token=07rEWcK1qqCadab8q3nQA0RLbI48eXw5UgkzcIwg&preview=0&subid_json=eyJzdWJpZDEiOiIxMDE5Iiwic3ViaWQiOiIxMDE5Iiwic3...
  • https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
13 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=1021f904c88b830c463e1088371ee4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
4792398ffaa19ba443dde1dbaa4d6c4ad2c5fcd7e433e1db9274a271394e9ecd

Request headers

Host
fi.campaign.mrcal365.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Server
Microsoft-IIS/7.5
Set-Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs; path=/; HttpOnly
X-AspNetMvc-Version
5.2
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Date
Thu, 03 Jan 2019 07:35:14 GMT
Content-Length
13425

Redirect headers

status
302
date
Thu, 03 Jan 2019 07:35:20 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/5.6.33
cache-control
no-cache
location
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
set-cookie
laravel_session=eyJpdiI6IitrbXhkVkdQZVVCdXRjNXU4Z3hIQ0E9PSIsInZhbHVlIjoiU2Y4UGdoakNSWTIrVGZVdTFhY3NcL2Q2aUlKQkdUTGhZNTRFUStKY3RHV1FTZEFneVpOVGFTSlFyS0Y1MnMrc01OSk1IMlR2RDQxRnc1T1wvbzhBRGViZz09IiwibWFjIjoiYjQxOWU1NjlkMDE1NTczZWFjNWI4ZWI1OGJmNTMxYzFkOWYyYTMzMDgxZDg2NTVlMDRkZTk0NmMyZTJjNTE5NSJ9; expires=Thu, 10-Jan-2019 06:14:20 GMT; Max-Age=599940; path=/; httponly
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4933c9c068d9c2ec-FRA
style-lp.css
fi.campaign.mrcal365.com/Content/ 		405 KB
83 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Content/style-lp.css
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
7d6d89b4a47c44a1c8347521b3479ff7d14223f3da4e5071d8c58d2276ac9d6f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
Content-Encoding
gzip
Last-Modified
Fri, 19 Oct 2018 08:23:59 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80f985158567d41:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
84382
font-awesome.css
fi.campaign.mrcal365.com/Content/ 		39 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Content/font-awesome.css
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
6081e5ab192226d10d4ccbb32070bd11f65a079467886afb905ee3b9440952e7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Feb 2018 11:47:59 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80c1af7ec0a4d31:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
7449
modernizr-2.8.3.js
fi.campaign.mrcal365.com/Scripts/ 		52 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Scripts/modernizr-2.8.3.js
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
012305fe18175b95942f96c5a5b89ef07e470b166679c6497712edb2dfb9e59a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Feb 2018 11:48:01 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80eee07fc0a4d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
15852
jquery-3.1.1.min.js
fi.campaign.mrcal365.com/Scripts/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Scripts/jquery-3.1.1.min.js
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Feb 2018 11:48:01 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80eee07fc0a4d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
30176
20180421041010_fisamtop.jpg
www.nordicgiveaways.com/uploads/ 		172 KB
173 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nordicgiveaways.com/uploads/20180421041010_fisamtop.jpg
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:72a8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb746a150d6a877585c418ad84b4dbf0669a1ffbeadc9cd51299eb2ca93946d7

Request headers

Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 07:35:21 GMT
cf-cache-status
HIT
last-modified
Sat, 21 Apr 2018 02:10:10 GMT
server
cloudflare
etag
"5ada9d82-2b14f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4933c9c56c1963bb-FRA
content-length
176463
expires
Sun, 31 Dec 2028 07:35:21 GMT
RapidSSL.jpg
fi.campaign.mrcal365.com/Images/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fi.campaign.mrcal365.com/Images/RapidSSL.jpg
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
4b6a7c02d388a78f8d3a3ee3ef299eec8be0776d00e1701ecd92c417105e9f13

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
Last-Modified
Tue, 13 Feb 2018 11:48:00 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"becf677fc0a4d31:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
11340
lp-pci.png
fi.campaign.mrcal365.com/Images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fi.campaign.mrcal365.com/Images/lp-pci.png
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
32ae6f8bf2095b42f39b4714115865a453617428736198c1de0bb52560c5e9cb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
Last-Modified
Tue, 13 Feb 2018 11:48:00 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"36b4687fc0a4d31:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
5492
lp-payment-cards.jpg
fi.campaign.mrcal365.com/Images/ 		47 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fi.campaign.mrcal365.com/Images/lp-payment-cards.jpg
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
f88fd5ef54b5744e8f75610fe361e3bba0ba2a3c2637f8a5bd92b05fad6b2649

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
Last-Modified
Tue, 13 Feb 2018 11:48:00 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"548e687fc0a4d31:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
48274
20180421040956_sambotfi.jpg
www.nordicgiveaways.com/uploads/ 		161 KB
162 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nordicgiveaways.com/uploads/20180421040956_sambotfi.jpg
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:72a8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf26deabdd2f8e6204a9d9ede0a889ae0562408d209cdf320405bfe7762e2cc

Request headers

Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 07:35:21 GMT
cf-cache-status
HIT
last-modified
Sat, 21 Apr 2018 02:09:56 GMT
server
cloudflare
etag
"5ada9d74-285fa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
4933c9c67c7b63bb-FRA
content-length
165370
expires
Sun, 31 Dec 2028 07:35:21 GMT
bootstrap.min.js
fi.campaign.mrcal365.com/Scripts/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Scripts/bootstrap.min.js
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
36460e494e4c628443afded40b2743b5ede9a4a76fb4f7b9ef2345cc7e59fd64

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Feb 2018 11:48:01 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80eee07fc0a4d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
9846
signup
fi.campaign.mrcal365.com/lp/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/7.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
text/html; charset=utf-8
Cache-Control
private
Content-Length
13425
fontawesome-webfont.woff2
fi.campaign.mrcal365.com/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Pragma
no-cache
Origin
https://fi.campaign.mrcal365.com
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://fi.campaign.mrcal365.com/Content/font-awesome.css
Cookie
ASP.NET_SessionId=w3nsx5z5spvd5b33p5jfcxvs
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fi.campaign.mrcal365.com/Content/font-awesome.css
Origin
https://fi.campaign.mrcal365.com

Response headers

Date
Thu, 03 Jan 2019 07:35:14 GMT
Last-Modified
Tue, 13 Feb 2018 11:48:02 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"6477a80c0a4d31:0"
Content-Type
application/font-woff2
Accept-Ranges
bytes
Content-Length
77160
nr-1099.min.js
js-agent.newrelic.com/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1099.min.js
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
685e511070d7d36ad071ea39c387547c95bf064727890a3e9abf1d0283184794

Request headers

Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 07:35:21 GMT
content-encoding
gzip
x-amz-request-id
721001A39CB7D50B
x-cache
HIT
status
200
content-length
9139
x-amz-id-2
NxMxfptyk7m72ZRtwDBFrYLt42q+zxYhs3n9RkXhwCypFX0QIhKQ++L2sfAGR6WMd083eZI9VXw=
x-served-by
cache-hhn1524-HHN
last-modified
Tue, 02 Oct 2018 02:58:53 GMT
server
AmazonS3
x-timer
S1546500922.638684,VS0,VE0
etag
"eed931ffe2a555a310715cf8678d32f5"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
43986
96f2b06cd3
bam.nr-data.net/1/ 		57 B
261 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/96f2b06cd3?a=14381908&v=1099.d27c17c&to=NlFSZxBWVhFXARULDQ8bfWUhGGsLUQwUEiEOWkRBDVtUB0RNKAwGBEw%3D&rst=1266&ref=https://fi.campaign.mrcal365.com/lp/signup&ap=311&be=749&fe=1253&dc=996&tt=F0BECD611A99AE15&perf=%7B%22timing%22:%7B%22of%22:1546500920377,%22n%22:0,%22f%22:56,%22dn%22:57,%22dne%22:213,%22c%22:213,%22s%22:240,%22ce%22:367,%22rq%22:367,%22rp%22:737,%22rpe%22:740,%22dl%22:742,%22di%22:997,%22ds%22:997,%22de%22:997,%22dc%22:1253,%22l%22:1253,%22le%22:1256%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1099.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.20 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS
bam-8.nr-data.net
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=12923&sid=1021f904c88b830c463e1088371ee4&refid=bobmedia&source=1019&sid2=4xBo3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
text/javascript;charset=ISO-8859-1
Content-Length
57
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| NREUM object| newrelic function| __nr_require object| html5 object| Modernizr function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
fi.campaign.mrcal365.com/ Name: ASP.NET_SessionId
Value: w3nsx5z5spvd5b33p5jfcxvs

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam.nr-data.net
fi.campaign.mrcal365.com
js-agent.newrelic.com
make.thegentlesttouch.org
wuniny.com
www.nordicgiveaways.club
www.nordicgiveaways.com
151.101.2.110
162.247.242.20
2606:4700:30::6818:72a8
2606:4700:30::681c:1b66
34.243.197.174
5.179.84.164
54.72.199.154
012305fe18175b95942f96c5a5b89ef07e470b166679c6497712edb2dfb9e59a
1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
32ae6f8bf2095b42f39b4714115865a453617428736198c1de0bb52560c5e9cb
36460e494e4c628443afded40b2743b5ede9a4a76fb4f7b9ef2345cc7e59fd64
4792398ffaa19ba443dde1dbaa4d6c4ad2c5fcd7e433e1db9274a271394e9ecd
4b6a7c02d388a78f8d3a3ee3ef299eec8be0776d00e1701ecd92c417105e9f13
6081e5ab192226d10d4ccbb32070bd11f65a079467886afb905ee3b9440952e7
685e511070d7d36ad071ea39c387547c95bf064727890a3e9abf1d0283184794
7d6d89b4a47c44a1c8347521b3479ff7d14223f3da4e5071d8c58d2276ac9d6f
930bd3dca9f0581f01df5c4d8e9e14e555eb55a9e1e4344f95927becf7e5b158
a1b34bb405b56dd6629756888096eb27b3abb32b8157cb1ec3d0c613c9f8aa0d
a69ea33bdaaa0d88072e69964ae80235cf96167d87b206aad76baa5d245d5360
b711bf106e56b54fcb06d2abd26fd61e41575ac591a82fd02a6fbae9137fb66f
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
cb746a150d6a877585c418ad84b4dbf0669a1ffbeadc9cd51299eb2ca93946d7
ccf26deabdd2f8e6204a9d9ede0a889ae0562408d209cdf320405bfe7762e2cc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef43a4d502ffb688656851d788c42869d47e8840d007b4f4b66f62530171acd4
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
f88fd5ef54b5744e8f75610fe361e3bba0ba2a3c2637f8a5bd92b05fad6b2649