urlscan.io logo urlscan.io
SecurityTrails logo

fi.campaign.mrcal365.com Open in urlscan Pro
5.179.84.164  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://wuniny.com/?a=3264&c=16491&s1=
Effective URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Submission: On January 03 via manual from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 7 domains to perform 22 HTTP transactions. The main IP is 5.179.84.164, located in Copenhagen, Denmark and belongs to NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK. The main domain is fi.campaign.mrcal365.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 2nd 2019. Valid for: 3 months.
This is the only time fi.campaign.mrcal365.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 34.243.197.174 16509 (AMAZON-02)
1 1 52.50.109.222 16509 (AMAZON-02)
1 8 2606:4700:30:... 13335 (CLOUDFLAR...)
11 5.179.84.164 31027 (NIANET-AS...)
2 2606:4700:30:... 13335 (CLOUDFLAR...)
1 151.101.2.110 54113 (FASTLY)
1 162.247.242.21 23467 (NEWRELIC-...)
22 5
1    34.243.197.174 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-243-197-174.eu-west-1.compute.amazonaws.com
wuniny.com
1    52.50.109.222 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-50-109-222.eu-west-1.compute.amazonaws.com
make.thegentlesttouch.org
8    2606:4700:30::681c:1a66 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.nordicgiveaways.club
11    5.179.84.164 (Copenhagen, Denmark)

ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK)
fi.campaign.mrcal365.com
2    2606:4700:30::6818:73a8 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.nordicgiveaways.com
1    151.101.2.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com
1    162.247.242.21 (United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-9.nr-data.net
bam.nr-data.net
Domain Requested by
11 fi.campaign.mrcal365.com www.nordicgiveaways.club
fi.campaign.mrcal365.com
8 www.nordicgiveaways.club 1 redirects www.nordicgiveaways.club
2 www.nordicgiveaways.com fi.campaign.mrcal365.com
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com fi.campaign.mrcal365.com
1 make.thegentlesttouch.org 1 redirects
1 wuniny.com 1 redirects
22 7

This site contains no links.

Subject Issuer Validity Valid
sni194236.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2018-12-06 -
2019-06-14		 6 months crt.sh
campaign.mrcal365.com
Let's Encrypt Authority X3		 2019-01-02 -
2019-04-02		 3 months crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2018-12-06 -
2019-04-14		 4 months crt.sh
*.nr-data.net
GeoTrust RSA CA 2018		 2018-01-11 -
2020-03-17		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Frame ID: FC1CC6F20D6BA5D4FAE2FDF053745826
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://wuniny.com/?a=3264&c=16491&s1= HTTP 302
    http://make.thegentlesttouch.org/aff_c?offer_id=127&aff_id=1019&aff_sub=3264&aff_sub2=16334-282274525 HTTP 302
    https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d Page URL
  2. https://www.nordicgiveaways.club/urlshort_test/uid_long=8049&tracking_id=25243395&token=WEJQ6CxHwyAq7QXGFX9jT... HTTP 302
    https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
  • env /^Modernizr$/i
Overall confidence: 100%
Detected patterns
  • env /^NREUM/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

22
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

5
IPs

3
Countries

753 kB
Transfer

1492 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://wuniny.com/?a=3264&c=16491&s1= HTTP 302
    http://make.thegentlesttouch.org/aff_c?offer_id=127&aff_id=1019&aff_sub=3264&aff_sub2=16334-282274525 HTTP 302
    https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d Page URL
  2. https://www.nordicgiveaways.club/urlshort_test/uid_long=8049&tracking_id=25243395&token=WEJQ6CxHwyAq7QXGFX9jTmRoJHjgmpDjmNsyyv8h&preview=0&subid_json=eyJzdWJpZDEiOiIxMDE5Iiwic3ViaWQiOiIxMDE5Iiwic3ViaWQyIjoiMTAyOTVjMjAxZjkwMjQwNTQ3YTdmYzgwMmU0YzlkIn0= HTTP 302
    https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://wuniny.com/?a=3264&c=16491&s1= HTTP 302
  • http://make.thegentlesttouch.org/aff_c?offer_id=127&aff_id=1019&aff_sub=3264&aff_sub2=16334-282274525 HTTP 302
  • https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d

22 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
subid=1019&subid2=10295c201f90240547a7fc802e4c9d
www.nordicgiveaways.club/survey/samsdirf/source=bob/
Redirect Chain
  • http://wuniny.com/?a=3264&c=16491&s1=
  • http://make.thegentlesttouch.org/aff_c?offer_id=127&aff_id=1019&aff_sub=3264&aff_sub2=16334-282274525
  • https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1a66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.33
Resource Hash
94839e4414b0eeff168e292f2d963f66f165c3c804430e84072319a2ce82359b

Request headers

:method
GET
:authority
www.nordicgiveaways.club
:scheme
https
:path
/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Thu, 03 Jan 2019 17:16:00 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=de1c78c3b59d0d4281e97c9a8eb9a8fdc1546535760; expires=Fri, 03-Jan-20 17:16:00 GMT; path=/; domain=.nordicgiveaways.club; HttpOnly laravel_session=eyJpdiI6ImtoR0p3NEZqUkF5K3NDTE9KcTd5TlE9PSIsInZhbHVlIjoicTRuUGN0RFpXUnFrREgxcWp5WUJ6MU1TbG5vVGJ4bW9teUVZT3JPcFBncXZzXC9STTJIWVpmYTFpS1daeWoyeU9Hbkp1N1RRUW5ieGZYQUVFWWZvVGFBPT0iLCJtYWMiOiI0MmY5NmYwMTZlNzkwMzY0M2VjMGVlMTQ5OTg5NGIwMmIxODhiYWJlOTJlY2IyYTZjMjJlYzA5YzZjYTM0MzExIn0%3D; expires=Thu, 10-Jan-2019 15:55:00 GMT; Max-Age=599940; path=/; httponly
vary
Accept-Encoding
x-powered-by
PHP/5.6.33
cache-control
no-cache
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
49371c5409d9c2e7-FRA
content-encoding
br

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=iso-8859-1
Date
Thu, 03 Jan 2019 17:15:59 GMT
Expires
Sat, 26 Jul 1997 05:00:00 GMT
Location
https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d
P3P
CP="NOI CUR OUR NOR INT"
Pragma
no-cache
Server
nginx/1.13.12
Set-Cookie
enc_aff_session_127=ENC039d1fb6a4e09de0534e834e2afd4b39b56300acf63601ddca19b252e810b8aeac9a71653b5c0761dcf3c989bd7d837220904b236ff647f677048ca4e15d53d00e192b4267da705a3a9b7c17b45124976241a6bce32bea354996b959ce6b0ff900b1e1190be36cc6b94810588cbf8cd166415d74af0ae23ec027888520013cce191f9b0915; expires=Sun, 03 Feb 2019 17:15:59 GMT; path=/; ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiI2Ny4wIiwibW9iaWxlX2NhcnJpZXIiOiI/IiwidXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwXzEzXzUpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS82Ny4wLjMzOTYuODcgU2FmYXJpLzUzNy4zNiIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ==; expires=Sun, 28 Nov 2021 03:55:59 GMT; path=/;
tracking_id
10295c201f90240547a7fc802e4c9d
X-Robots-Tag
noindex, nofollow
Content-Length
296
Connection
keep-alive
jquery.js
www.nordicgiveaways.club/js/ 		278 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/js/jquery.js
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1a66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed

Request headers

:path
/js/jquery.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.nordicgiveaways.club
cookie
__cfduid=de1c78c3b59d0d4281e97c9a8eb9a8fdc1546535760; laravel_session=eyJpdiI6ImtoR0p3NEZqUkF5K3NDTE9KcTd5TlE9PSIsInZhbHVlIjoicTRuUGN0RFpXUnFrREgxcWp5WUJ6MU1TbG5vVGJ4bW9teUVZT3JPcFBncXZzXC9STTJIWVpmYTFpS1daeWoyeU9Hbkp1N1RRUW5ieGZYQUVFWWZvVGFBPT0iLCJtYWMiOiI0MmY5NmYwMTZlNzkwMzY0M2VjMGVlMTQ5OTg5NGIwMmIxODhiYWJlOTJlY2IyYTZjMjJlYzA5YzZjYTM0MzExIn0%3D
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 17:16:00 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:11:54 GMT
server
cloudflare
etag
W/"5807711a-456ea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
49371c550ddcc2e7-FRA
expires
Thu, 03 Jan 2019 21:16:00 GMT
bootstrap.js
www.nordicgiveaways.club/js/ 		67 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/js/bootstrap.js
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1a66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef43a4d502ffb688656851d788c42869d47e8840d007b4f4b66f62530171acd4

Request headers

:path
/js/bootstrap.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.nordicgiveaways.club
cookie
__cfduid=de1c78c3b59d0d4281e97c9a8eb9a8fdc1546535760; laravel_session=eyJpdiI6ImtoR0p3NEZqUkF5K3NDTE9KcTd5TlE9PSIsInZhbHVlIjoicTRuUGN0RFpXUnFrREgxcWp5WUJ6MU1TbG5vVGJ4bW9teUVZT3JPcFBncXZzXC9STTJIWVpmYTFpS1daeWoyeU9Hbkp1N1RRUW5ieGZYQUVFWWZvVGFBPT0iLCJtYWMiOiI0MmY5NmYwMTZlNzkwMzY0M2VjMGVlMTQ5OTg5NGIwMmIxODhiYWJlOTJlY2IyYTZjMjJlYzA5YzZjYTM0MzExIn0%3D
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 17:16:00 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:11:56 GMT
server
cloudflare
etag
W/"5807711c-10d1a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
49371c550ddfc2e7-FRA
expires
Thu, 03 Jan 2019 21:16:00 GMT
jquery.cookie.js
www.nordicgiveaways.club/js/plugins/jqueryCookie/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/js/plugins/jqueryCookie/jquery.cookie.js
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1a66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Request headers

:path
/js/plugins/jqueryCookie/jquery.cookie.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.nordicgiveaways.club
cookie
__cfduid=de1c78c3b59d0d4281e97c9a8eb9a8fdc1546535760; laravel_session=eyJpdiI6ImtoR0p3NEZqUkF5K3NDTE9KcTd5TlE9PSIsInZhbHVlIjoicTRuUGN0RFpXUnFrREgxcWp5WUJ6MU1TbG5vVGJ4bW9teUVZT3JPcFBncXZzXC9STTJIWVpmYTFpS1daeWoyeU9Hbkp1N1RRUW5ieGZYQUVFWWZvVGFBPT0iLCJtYWMiOiI0MmY5NmYwMTZlNzkwMzY0M2VjMGVlMTQ5OTg5NGIwMmIxODhiYWJlOTJlY2IyYTZjMjJlYzA5YzZjYTM0MzExIn0%3D
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 17:16:00 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 19 Oct 2016 13:14:52 GMT
server
cloudflare
etag
W/"580771cc-c31"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
49371c550de1c2e7-FRA
expires
Thu, 03 Jan 2019 21:16:00 GMT
survey
www.nordicgiveaways.club/survey/ 		11 B
389 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/survey/survey
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/js/jquery.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1a66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.33
Resource Hash
b711bf106e56b54fcb06d2abd26fd61e41575ac591a82fd02a6fbae9137fb66f

Request headers

:path
/survey/survey
pragma
no-cache
cookie
__cfduid=de1c78c3b59d0d4281e97c9a8eb9a8fdc1546535760; laravel_session=eyJpdiI6ImtoR0p3NEZqUkF5K3NDTE9KcTd5TlE9PSIsInZhbHVlIjoicTRuUGN0RFpXUnFrREgxcWp5WUJ6MU1TbG5vVGJ4bW9teUVZT3JPcFBncXZzXC9STTJIWVpmYTFpS1daeWoyeU9Hbkp1N1RRUW5ieGZYQUVFWWZvVGFBPT0iLCJtYWMiOiI0MmY5NmYwMTZlNzkwMzY0M2VjMGVlMTQ5OTg5NGIwMmIxODhiYWJlOTJlY2IyYTZjMjJlYzA5YzZjYTM0MzExIn0%3D; b2ZmZXJXYWxs=%7B%22campaign%22%3A%2210149%22%2C%22survey%22%3A%2211853%22%2C%22source%22%3A%22bob%22%2C%22subid%22%3A%22subid%3D1019%26subid2%3D10295c201f90240547a7fc802e4c9d%22%2C%22firstSession%22%3A%22WEJQ6CxHwyAq7QXGFX9jTmRoJHjgmpDjmNsyyv8h_10149%22%7D; survey_id_11853=true; cHJvZHVjdENvb28049=triggerON; cHJvZHVjdENQQQ8049=triggerON
origin
https://www.nordicgiveaways.club
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/x-www-form-urlencoded; charset=UTF-8
accept
text/html, */*; q=0.01
cache-control
no-cache
:authority
www.nordicgiveaways.club
x-requested-with
XMLHttpRequest
:scheme
https
content-length
56
:method
POST
Accept
text/html, */*; q=0.01
Origin
https://www.nordicgiveaways.club
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 03 Jan 2019 17:16:00 GMT
content-encoding
br
server
cloudflare
status
200
x-powered-by
PHP/5.6.33
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://www.nordicgiveaways.club
cache-control
no-cache
set-cookie
laravel_session=eyJpdiI6IktONUlUUW9yelg1U29MbHpGY0NPYVE9PSIsInZhbHVlIjoibVwvNk00cnFDN3J5TldNMUhyK2tcL2h5d25ocW9UN0cyS2pubmtHQ1NVRG13UWh6Y1JvMTJxRjZDY3hIRHNvampONEZzRzErWkxWckFCZjJ1Q2VTb09yQT09IiwibWFjIjoiZjBmMjJjZDBjYTkyODhmZWJhZjJjYTAyM2Q2NjAwNjI3MWU2Mzk0OWM4NmNiNTRlOWQ5NTc3ODY2MTdjNDFhOCJ9; expires=Thu, 10-Jan-2019 15:55:00 GMT; Max-Age=599940; path=/; httponly
cf-ray
49371c556f61c2e7-FRA
survey
www.nordicgiveaways.club/survey/ 		19 B
378 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/survey/survey
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/js/jquery.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1a66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.33
Resource Hash
e69e632fd455bb94aa01816ae5530a7eb04e5ac5bc0a63d5f96d7d12f8a3f7b3

Request headers

:path
/survey/survey
pragma
no-cache
cookie
__cfduid=de1c78c3b59d0d4281e97c9a8eb9a8fdc1546535760; laravel_session=eyJpdiI6ImtoR0p3NEZqUkF5K3NDTE9KcTd5TlE9PSIsInZhbHVlIjoicTRuUGN0RFpXUnFrREgxcWp5WUJ6MU1TbG5vVGJ4bW9teUVZT3JPcFBncXZzXC9STTJIWVpmYTFpS1daeWoyeU9Hbkp1N1RRUW5ieGZYQUVFWWZvVGFBPT0iLCJtYWMiOiI0MmY5NmYwMTZlNzkwMzY0M2VjMGVlMTQ5OTg5NGIwMmIxODhiYWJlOTJlY2IyYTZjMjJlYzA5YzZjYTM0MzExIn0%3D; b2ZmZXJXYWxs=%7B%22campaign%22%3A%2210149%22%2C%22survey%22%3A%2211853%22%2C%22source%22%3A%22bob%22%2C%22subid%22%3A%22subid%3D1019%26subid2%3D10295c201f90240547a7fc802e4c9d%22%2C%22firstSession%22%3A%22WEJQ6CxHwyAq7QXGFX9jTmRoJHjgmpDjmNsyyv8h_10149%22%7D; survey_id_11853=true; cHJvZHVjdENvb28049=triggerON; cHJvZHVjdENQQQ8049=triggerON
origin
https://www.nordicgiveaways.club
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/x-www-form-urlencoded; charset=UTF-8
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.nordicgiveaways.club
x-requested-with
XMLHttpRequest
:scheme
https
content-length
61
:method
POST
Accept
application/json, text/javascript, */*; q=0.01
Origin
https://www.nordicgiveaways.club
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 03 Jan 2019 17:16:00 GMT
content-encoding
br
server
cloudflare
status
200
x-powered-by
PHP/5.6.33
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://www.nordicgiveaways.club
cache-control
no-cache
set-cookie
laravel_session=eyJpdiI6IjlOcDI5d1lzditzYTFjSVVRVmlwXC9RPT0iLCJ2YWx1ZSI6Ik8rd211UUZzMVBBaDJHbUlGSG43eXRyajI0Nk85azlaK0h3MVpMTjVscDVqcHdLa0hcL09YRUl3TzY2RllCYkRTSmJuOHh3a29oYWRDVWU4UGpPYVlcL2c9PSIsIm1hYyI6ImNjN2M5ZDYwNTIxNjU2Y2M0NTU3ZDM4YWE0ZDg0YjYxM2VjOGQzNzNlMzg1YTcyNGVhNDhjMzcyOWUzMjk5YzIifQ%3D%3D; expires=Thu, 10-Jan-2019 15:55:00 GMT; Max-Age=599940; path=/; httponly
cf-ray
49371c556f7cc2e7-FRA
survey
www.nordicgiveaways.club/survey/ 		18 B
373 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.nordicgiveaways.club/survey/survey
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/js/jquery.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:1a66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.6.33
Resource Hash
a69ea33bdaaa0d88072e69964ae80235cf96167d87b206aad76baa5d245d5360

Request headers

:path
/survey/survey
pragma
no-cache
cookie
__cfduid=de1c78c3b59d0d4281e97c9a8eb9a8fdc1546535760; laravel_session=eyJpdiI6ImtoR0p3NEZqUkF5K3NDTE9KcTd5TlE9PSIsInZhbHVlIjoicTRuUGN0RFpXUnFrREgxcWp5WUJ6MU1TbG5vVGJ4bW9teUVZT3JPcFBncXZzXC9STTJIWVpmYTFpS1daeWoyeU9Hbkp1N1RRUW5ieGZYQUVFWWZvVGFBPT0iLCJtYWMiOiI0MmY5NmYwMTZlNzkwMzY0M2VjMGVlMTQ5OTg5NGIwMmIxODhiYWJlOTJlY2IyYTZjMjJlYzA5YzZjYTM0MzExIn0%3D; b2ZmZXJXYWxs=%7B%22campaign%22%3A%2210149%22%2C%22survey%22%3A%2211853%22%2C%22source%22%3A%22bob%22%2C%22subid%22%3A%22subid%3D1019%26subid2%3D10295c201f90240547a7fc802e4c9d%22%2C%22firstSession%22%3A%22WEJQ6CxHwyAq7QXGFX9jTmRoJHjgmpDjmNsyyv8h_10149%22%7D; survey_id_11853=true; cHJvZHVjdENvb28049=triggerON; cHJvZHVjdENQQQ8049=triggerON
origin
https://www.nordicgiveaways.club
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/x-www-form-urlencoded; charset=UTF-8
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.nordicgiveaways.club
x-requested-with
XMLHttpRequest
:scheme
https
content-length
159
:method
POST
Accept
application/json, text/javascript, */*; q=0.01
Origin
https://www.nordicgiveaways.club
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 03 Jan 2019 17:16:00 GMT
content-encoding
br
server
cloudflare
status
200
x-powered-by
PHP/5.6.33
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://www.nordicgiveaways.club
cache-control
no-cache
set-cookie
laravel_session=eyJpdiI6InlvdXBxK2hBMHgwaEdORWpBQmdPXC9BPT0iLCJ2YWx1ZSI6IkorUlBndkh3SWQyQVVpYWhqNWVnNEJwSmowOStkZCt1K3kwM040c295N1JjSUtsc281SmNZZU9nUmRDSjdXcXl0NjFoeXpacFJvc2MyQnRLQ00zYlwvUT09IiwibWFjIjoiNGJlM2U3MTMyZGU3MzYwYWNhNmFiNGVhYTRiYjJkZmMzNDBiYzFkNGNjNTg1OTExNGI4NjJhMjhmYjU3MTRlZCJ9; expires=Thu, 10-Jan-2019 15:55:00 GMT; Max-Age=599940; path=/; httponly
cf-ray
49371c556f83c2e7-FRA
Primary Request Cookie set signup
fi.campaign.mrcal365.com/lp/
Redirect Chain
  • https://www.nordicgiveaways.club/urlshort_test/uid_long=8049&tracking_id=25243395&token=WEJQ6CxHwyAq7QXGFX9jTmRoJHjgmpDjmNsyyv8h&preview=0&subid_json=eyJzdWJpZDEiOiIxMDE5Iiwic3ViaWQiOiIxMDE5Iiwic3V...
  • https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
13 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Requested by
Host: www.nordicgiveaways.club
URL: https://www.nordicgiveaways.club/survey/samsdirf/source=bob/subid=1019&subid2=10295c201f90240547a7fc802e4c9d
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
d1a24c986a541f680c12f197734c421927a367e0ffcc7e6cfa90f1c0111e37df

Request headers

Host
fi.campaign.mrcal365.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Server
Microsoft-IIS/7.5
Set-Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx; path=/; HttpOnly
X-AspNetMvc-Version
5.2
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Date
Thu, 03 Jan 2019 17:15:53 GMT
Content-Length
13433

Redirect headers

status
302
date
Thu, 03 Jan 2019 17:16:00 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/5.6.33
cache-control
no-cache
location
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
set-cookie
laravel_session=eyJpdiI6IjRiVzVBQW1XWlNhaHF2ZnRkSGk1VHc9PSIsInZhbHVlIjoiNHJwa21wU1VROG5WTlhtZ28rR3ZLYnptQ2tua0taKzNGbzdaXC9IMXZ1Z0VrRWcwazNLcGtsTUFYejVNN25PcjMxMjcxZFRqcjJUXC9WNXBVVVwvR2w5dkE9PSIsIm1hYyI6IjA4YTUwNzYyODQ5ODBkODg1ODI4YzM1MGU4MDMzMzJjMjJiM2ExZjI0MjE4MzNjOThhNGY5MWJiNzY5ZDdkY2MifQ%3D%3D; expires=Thu, 10-Jan-2019 15:55:00 GMT; Max-Age=599940; path=/; httponly
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
49371c58bc51c2e7-FRA
style-lp.css
fi.campaign.mrcal365.com/Content/ 		405 KB
83 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Content/style-lp.css
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
7d6d89b4a47c44a1c8347521b3479ff7d14223f3da4e5071d8c58d2276ac9d6f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 17:15:53 GMT
Content-Encoding
gzip
Last-Modified
Fri, 19 Oct 2018 08:23:59 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80f985158567d41:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
84382
font-awesome.css
fi.campaign.mrcal365.com/Content/ 		39 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Content/font-awesome.css
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
6081e5ab192226d10d4ccbb32070bd11f65a079467886afb905ee3b9440952e7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 17:15:53 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Feb 2018 11:47:59 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80c1af7ec0a4d31:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
7449
modernizr-2.8.3.js
fi.campaign.mrcal365.com/Scripts/ 		52 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Scripts/modernizr-2.8.3.js
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
012305fe18175b95942f96c5a5b89ef07e470b166679c6497712edb2dfb9e59a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 17:15:53 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Feb 2018 11:48:01 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80eee07fc0a4d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
15852
jquery-3.1.1.min.js
fi.campaign.mrcal365.com/Scripts/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Scripts/jquery-3.1.1.min.js
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 17:15:53 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Feb 2018 11:48:01 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80eee07fc0a4d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
30176
20180421041010_fisamtop.jpg
www.nordicgiveaways.com/uploads/ 		172 KB
173 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nordicgiveaways.com/uploads/20180421041010_fisamtop.jpg
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:73a8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb746a150d6a877585c418ad84b4dbf0669a1ffbeadc9cd51299eb2ca93946d7

Request headers

Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 17:16:01 GMT
cf-cache-status
HIT
last-modified
Sat, 21 Apr 2018 02:10:10 GMT
server
cloudflare
etag
"5ada9d82-2b14f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
49371c5e48d5c2c4-FRA
content-length
176463
expires
Sun, 31 Dec 2028 17:16:01 GMT
RapidSSL.jpg
fi.campaign.mrcal365.com/Images/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fi.campaign.mrcal365.com/Images/RapidSSL.jpg
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
4b6a7c02d388a78f8d3a3ee3ef299eec8be0776d00e1701ecd92c417105e9f13

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 17:15:53 GMT
Last-Modified
Tue, 13 Feb 2018 11:48:00 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"becf677fc0a4d31:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
11340
lp-pci.png
fi.campaign.mrcal365.com/Images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fi.campaign.mrcal365.com/Images/lp-pci.png
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
32ae6f8bf2095b42f39b4714115865a453617428736198c1de0bb52560c5e9cb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 17:15:53 GMT
Last-Modified
Tue, 13 Feb 2018 11:48:00 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"36b4687fc0a4d31:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
5492
lp-payment-cards.jpg
fi.campaign.mrcal365.com/Images/ 		47 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fi.campaign.mrcal365.com/Images/lp-payment-cards.jpg
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
f88fd5ef54b5744e8f75610fe361e3bba0ba2a3c2637f8a5bd92b05fad6b2649

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 17:15:53 GMT
Last-Modified
Tue, 13 Feb 2018 11:48:00 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"548e687fc0a4d31:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
48274
20180421040956_sambotfi.jpg
www.nordicgiveaways.com/uploads/ 		161 KB
162 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nordicgiveaways.com/uploads/20180421040956_sambotfi.jpg
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:73a8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf26deabdd2f8e6204a9d9ede0a889ae0562408d209cdf320405bfe7762e2cc

Request headers

Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 17:16:01 GMT
cf-cache-status
HIT
last-modified
Sat, 21 Apr 2018 02:09:56 GMT
server
cloudflare
etag
"5ada9d74-285fa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
49371c5e48d9c2c4-FRA
content-length
165370
expires
Sun, 31 Dec 2028 17:16:01 GMT
bootstrap.min.js
fi.campaign.mrcal365.com/Scripts/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/Scripts/bootstrap.min.js
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
36460e494e4c628443afded40b2743b5ede9a4a76fb4f7b9ef2345cc7e59fd64

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 17:15:53 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Feb 2018 11:48:01 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80eee07fc0a4d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
9846
signup
fi.campaign.mrcal365.com/lp/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 03 Jan 2019 17:15:54 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/7.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
text/html; charset=utf-8
Cache-Control
private
Content-Length
13433
fontawesome-webfont.woff2
fi.campaign.mrcal365.com/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fi.campaign.mrcal365.com/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
5.179.84.164 Copenhagen, Denmark, ASN31027 (NIANET-AS Nianet is a Danish carrier and Internet Service Provider, DK),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Pragma
no-cache
Origin
https://fi.campaign.mrcal365.com
Accept-Encoding
gzip, deflate, br
Host
fi.campaign.mrcal365.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://fi.campaign.mrcal365.com/Content/font-awesome.css
Cookie
ASP.NET_SessionId=ycxazrdy3fnfmu4nsylgc2cx
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fi.campaign.mrcal365.com/Content/font-awesome.css
Origin
https://fi.campaign.mrcal365.com

Response headers

Date
Thu, 03 Jan 2019 17:15:54 GMT
Last-Modified
Tue, 13 Feb 2018 11:48:02 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"6477a80c0a4d31:0"
Content-Type
application/font-woff2
Accept-Ranges
bytes
Content-Length
77160
nr-1099.min.js
js-agent.newrelic.com/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1099.min.js
Requested by
Host: fi.campaign.mrcal365.com
URL: https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
685e511070d7d36ad071ea39c387547c95bf064727890a3e9abf1d0283184794

Request headers

Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 17:16:01 GMT
content-encoding
gzip
x-amz-request-id
721001A39CB7D50B
x-cache
HIT
status
200
content-length
9139
x-amz-id-2
NxMxfptyk7m72ZRtwDBFrYLt42q+zxYhs3n9RkXhwCypFX0QIhKQ++L2sfAGR6WMd083eZI9VXw=
x-served-by
cache-hhn1535-HHN
last-modified
Tue, 02 Oct 2018 02:58:53 GMT
server
AmazonS3
x-timer
S1546535762.915076,VS0,VE0
etag
"eed931ffe2a555a310715cf8678d32f5"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
31006
96f2b06cd3
bam.nr-data.net/1/ 		57 B
261 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/96f2b06cd3?a=14381908&v=1099.d27c17c&to=NlFSZxBWVhFXARULDQ8bfWUhGGsLUQwUEiEOWkRBDVtUB0RNKAwGBEw%3D&rst=1187&ref=https://fi.campaign.mrcal365.com/lp/signup&qt=1&ap=252&be=607&fe=1170&dc=866&tt=52FD320903E7616D&perf=%7B%22timing%22:%7B%22of%22:1546535760740,%22n%22:0,%22f%22:119,%22dn%22:120,%22dne%22:154,%22c%22:154,%22s%22:181,%22ce%22:282,%22rq%22:282,%22rp%22:592,%22rpe%22:594,%22dl%22:597,%22di%22:866,%22ds%22:866,%22de%22:867,%22dc%22:1170,%22l%22:1170,%22le%22:1172%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1099.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.21 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS
bam-9.nr-data.net
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer
https://fi.campaign.mrcal365.com/lp/signup?fid=8745&sid=10295c201f90240547a7fc802e4c9d&refid=bobmedia&source=1019&sid2=4xNxM
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
text/javascript;charset=ISO-8859-1
Content-Length
57
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| NREUM object| newrelic function| __nr_require object| html5 object| Modernizr function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
fi.campaign.mrcal365.com/ Name: ASP.NET_SessionId
Value: ycxazrdy3fnfmu4nsylgc2cx

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam.nr-data.net
fi.campaign.mrcal365.com
js-agent.newrelic.com
make.thegentlesttouch.org
wuniny.com
www.nordicgiveaways.club
www.nordicgiveaways.com
151.101.2.110
162.247.242.21
2606:4700:30::6818:73a8
2606:4700:30::681c:1a66
34.243.197.174
5.179.84.164
52.50.109.222
012305fe18175b95942f96c5a5b89ef07e470b166679c6497712edb2dfb9e59a
1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
32ae6f8bf2095b42f39b4714115865a453617428736198c1de0bb52560c5e9cb
36460e494e4c628443afded40b2743b5ede9a4a76fb4f7b9ef2345cc7e59fd64
4b6a7c02d388a78f8d3a3ee3ef299eec8be0776d00e1701ecd92c417105e9f13
6081e5ab192226d10d4ccbb32070bd11f65a079467886afb905ee3b9440952e7
685e511070d7d36ad071ea39c387547c95bf064727890a3e9abf1d0283184794
7d6d89b4a47c44a1c8347521b3479ff7d14223f3da4e5071d8c58d2276ac9d6f
94839e4414b0eeff168e292f2d963f66f165c3c804430e84072319a2ce82359b
a69ea33bdaaa0d88072e69964ae80235cf96167d87b206aad76baa5d245d5360
b711bf106e56b54fcb06d2abd26fd61e41575ac591a82fd02a6fbae9137fb66f
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
cb746a150d6a877585c418ad84b4dbf0669a1ffbeadc9cd51299eb2ca93946d7
ccf26deabdd2f8e6204a9d9ede0a889ae0562408d209cdf320405bfe7762e2cc
d1a24c986a541f680c12f197734c421927a367e0ffcc7e6cfa90f1c0111e37df
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e69e632fd455bb94aa01816ae5530a7eb04e5ac5bc0a63d5f96d7d12f8a3f7b3
ef43a4d502ffb688656851d788c42869d47e8840d007b4f4b66f62530171acd4
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
f88fd5ef54b5744e8f75610fe361e3bba0ba2a3c2637f8a5bd92b05fad6b2649