app.cleverwaiver.com Open in urlscan Pro
54.196.16.164  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

34 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 62b48828735f729d448770e0 Show response app.cleverwaiver.com/render/templateByRefId/	4 KB 5 KB	857ms 110ms	Document text/html	54.196.16.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.196.16.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-196-16-164.compute-1.amazonaws.com Software gunicorn / Resource Hash 973ff4ce8d97dfaa8130c2f70f98ff99e8f5e924893635e9e3f6eab8dc6a2c38 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control public, max-age=43200 Connection keep-alive Content-Length 4587 Content-Type text/html; charset=utf-8 Date Thu, 23 Jun 2022 17:05:39 GMT Etag "1655872677.0-4587-3937602885" Expires Fri, 24 Jun 2022 05:05:39 GMT Last-Modified Wed, 22 Jun 2022 04:37:57 GMT Server gunicorn Via 1.1 vegur
GET H2	200	/ Show response js.stripe.com/v3/	313 KB 83 KB	183ms 27ms	Script application/javascript	108.138.7.100 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.stripe.com/v3/ Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.7.100 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-7-100.fra56.r.cloudfront.net Software Cloudfront / Resource Hash 45b1d75552bbbe2bad3b3a0ceac301e1a86076e5213792919c26335b5d9630b6 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=31556926; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff x-amz-cf-pop FRA56-P6 x-cache Hit from cloudfront date Thu, 23 Jun 2022 17:05:40 GMT via 1.1 dd09b3b5f5b8dc626e1ba6804a73af40.cloudfront.net (CloudFront) last-modified Thu, 23 Jun 2022 16:03:34 GMT server Cloudfront etag W/"4d1c439ea4df527769600d8a30403ea0" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=60 timing-allow-origin * x-amz-cf-id t5TJgp6FJz484cblXe5GR17UJeTmofNa07gLV8rj_RzC_wzi_lIRbw==
GET H2	200	paymentform Show response js.squareup.com/v2/	161 KB 45 KB	738ms 344ms	Script application/javascript	74.122.190.85 SQUARE
General Check archive.org Show headers Download Go to Full URL https://js.squareup.com/v2/paymentform Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 74.122.190.85 San Francisco, United States, ASN15211 (SQUARE, US), Reverse DNS Software / Resource Hash 6a0b6b79b4f8afe5801a48261da73974aaafc6d2dc19281476653df5081afbd7 Security Headers Name Value Strict-Transport-Security max-age=631152000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers pragma no-cache date Thu, 23 Jun 2022 17:05:39 GMT content-encoding gzip x-content-type-options nosniff x-permitted-cross-domain-policies none x-download-options noopen x-frame-options SAMEORIGIN content-type application/javascript cache-control no-cache, no-store, must-revalidate strict-transport-security max-age=631152000; includeSubDomains; preload vary Origin, Accept-Encoding x-xss-protection 1; mode=block expires Thu, 01 Jan 1970 00:00:00 UTC
GET H/1.1	200 OK	vendor.eb458c39.css app.cleverwaiver.com/styles/	232 KB 232 KB	113ms 112ms	Stylesheet text/css	54.196.16.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.cleverwaiver.com/styles/vendor.eb458c39.css Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.196.16.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-196-16-164.compute-1.amazonaws.com Software gunicorn / Resource Hash 7c521e499237a9ff936617555d93d48961ef006e443b560c283ed66143ee22d2 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:39 GMT Via 1.1 vegur Last-Modified Wed, 22 Jun 2022 04:37:57 GMT Server gunicorn Etag "1655872677.0-237415-4005040775" Content-Type text/css; charset=utf-8 Cache-Control public, max-age=43200 Connection keep-alive Content-Length 237415 Expires Fri, 24 Jun 2022 05:05:39 GMT
GET H/1.1	200 OK	main.22145354.css app.cleverwaiver.com/styles/	252 KB 252 KB	327ms 109ms	Stylesheet text/css	54.196.16.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.cleverwaiver.com/styles/main.22145354.css Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.196.16.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-196-16-164.compute-1.amazonaws.com Software gunicorn / Resource Hash 32ee5fc9bc8410c5e1dd0d85a70623bd1b1d4d704b352c6e723cd2d49a22a9eb Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:39 GMT Via 1.1 vegur Last-Modified Wed, 22 Jun 2022 04:37:57 GMT Server gunicorn Etag "1655872677.0-257885-3216969985" Content-Type text/css; charset=utf-8 Cache-Control public, max-age=43200 Connection keep-alive Content-Length 257885 Expires Fri, 24 Jun 2022 05:05:39 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	108 KB 43 KB	117ms 63ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-766331869 Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b568265050d2719a4f13c267c7c8a1a85f4c073421a04f08f70c10c4aed298d5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Thu, 23 Jun 2022 17:05:40 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43448 x-xss-protection 0 last-modified Thu, 23 Jun 2022 16:17:31 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 23 Jun 2022 17:05:40 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	101 KB 39 KB	89ms 35ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-125390496-1 Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 3932ba863f373d02b872f4a735867b625a588e6aabf3a73dacad6825623b03e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Thu, 23 Jun 2022 17:05:40 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39808 x-xss-protection 0 last-modified Thu, 23 Jun 2022 16:17:31 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 23 Jun 2022 17:05:40 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	39 KB 15 KB	113ms 54ms	Script text/javascript	172.217.18.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.18.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s42-in-f2.1e100.net Software cafe / Resource Hash 33272713d84ffdaab3a61030b3c4cecca56a0f00485bd02767a96e61bc45452d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Thu, 23 Jun 2022 17:05:39 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15000 x-xss-protection 0 server cafe etag 6069194915506431635 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Thu, 23 Jun 2022 17:05:39 GMT
GET H/1.1	200 OK	vendor.0bd4d9ad.js Show response app.cleverwaiver.com/scripts/	1008 KB 1008 KB	327ms 109ms	Script application/javascript	54.196.16.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.cleverwaiver.com/scripts/vendor.0bd4d9ad.js Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.196.16.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-196-16-164.compute-1.amazonaws.com Software gunicorn / Resource Hash e1657cd5534086979f770216cdcfd760424e85684df35fdde4521770f954beb5 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:39 GMT Via 1.1 vegur Last-Modified Wed, 22 Jun 2022 04:37:57 GMT Server gunicorn Etag "1655872677.0-1031978-4039447252" Content-Type application/javascript; charset=utf-8 Cache-Control public, max-age=43200 Connection keep-alive Content-Length 1031978 Expires Fri, 24 Jun 2022 05:05:39 GMT
GET H/1.1	200 OK	scripts.2269c6d4.js Show response app.cleverwaiver.com/scripts/	2 MB 2 MB	328ms 110ms	Script application/javascript	54.196.16.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.cleverwaiver.com/scripts/scripts.2269c6d4.js Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.196.16.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-196-16-164.compute-1.amazonaws.com Software gunicorn / Resource Hash afcd7970fdf0f132591fcd9d5307a2a889fc7c3ad8a88d2b46a15964a2640ed9 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:39 GMT Via 1.1 vegur Last-Modified Wed, 22 Jun 2022 04:37:57 GMT Server gunicorn Etag "1655872677.0-2165669-34738886" Content-Type application/javascript; charset=utf-8 Cache-Control public, max-age=43200 Connection keep-alive Content-Length 2165669 Expires Fri, 24 Jun 2022 05:05:39 GMT
GET H2	200	sdk.js Show response connect.facebook.net/en_US/	3 KB 2 KB	69ms 22ms	Script application/x-javascript	2a03:2880:f02d:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 56dee4badb79b07b7dd6effbe8d8b9ee09f1f4d7f2f89154eab17ff1bace742d Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 3fXz8FVNsPnOKJgLay61Xw== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 1687 x-fb-rlafr 0 x-fb-debug 2CHP0oy0kmq8b7X9S2cHBLJ56/ML/gn/7rqNAIQNzKZsKg4XiIdrq+CSfdGRjGdNJeSM5WZnSG0bHQcGob/eVg== x-fb-trip-id 917726464 x-fb-content-md5 8c29f71c55606ce490267b47b5c1fddf cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Thu, 23 Jun 2022 17:05:40 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=1200,stale-while-revalidate=3600 etag "a772e3dd71fd1489605d493bc3faec04" timing-allow-origin * expires Thu, 23 Jun 2022 17:06:40 GMT
GET H3	200	sdk.js Show response connect.facebook.net/en_US/	294 KB 84 KB	48ms 23ms	Script application/x-javascript	2a03:2880:f02d:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js?hash=97eccd328c45c6a933220841f1ab6767 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/sdk.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 8e3f0998cf24a40ddf024829492cd0e1cd3bc9597b649619eaa341aae7cd02f3 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://app.cleverwaiver.com/ Origin https://app.cleverwaiver.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 mSublNh24Ep+N/oT9GHK/Q== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 85985 x-fb-rlafr 0 x-fb-debug iAOX0qUs4EPfYjP9nQPGeNOykNsHIf7h1vjR7URYqt29CTCl3qvcKd7tQihSYlwKFejgdwu1V2QEvcahh2N6Iw== x-fb-content-md5 dc6375f8068c818ebff90fc4fa2d58a4 cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Thu, 23 Jun 2022 17:05:40 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=31536000,stale-while-revalidate=3600,immutable etag "c7360d1b22723cf08fa52901311e8d36" timing-allow-origin * priority u=3,i expires Fri, 23 Jun 2023 16:00:22 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	108 KB 42 KB	85ms 37ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-766331869&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-125390496-1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 90fa9b0b48eb4af1f43c882abb92e18fb171bdc279377fcd92fac28136434c30 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Thu, 23 Jun 2022 17:05:40 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43473 x-xss-protection 0 last-modified Thu, 23 Jun 2022 16:17:31 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 23 Jun 2022 17:05:40 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	76ms 22ms	Script text/javascript	2a00:1450:4001:810::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-125390496-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 13 Apr 2022 21:02:38 GMT server Golfe2 age 993 date Thu, 23 Jun 2022 16:49:07 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Thu, 23 Jun 2022 18:49:07 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/766331869/	2 KB 2 KB	90ms 35ms	Script text/javascript	2a00:1450:4001:831::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/766331869/?random=1656003939064&cv=9&fst=1656003939064&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa6f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapp.cleverwaiver.com%2Frender%2FtemplateByRefId%2F62b48828735f729d448770e0&tiba=Online%20waiver%20%7C%20Waiver%20app%20-%20Top%20Digital%20Waiver%20Application&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash b325088fc3192dd7f1fa5c280b48675ecc6eb26217989295aabcaf2d7f7bfb61 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers pragma no-cache date Thu, 23 Jun 2022 17:05:40 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1100 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 297 B	78ms 24ms	Image image/gif	2a03:2880:f12d:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=265729564728842&ev=fb_page_view&dl=https%3A%2F%2Fapp.cleverwaiver.com%2Frender%2FtemplateByRefId%2F62b48828735f729d448770e0&rl=&if=false&ts=1656003939091&sw=1600&sh=1200&at= Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Thu, 23 Jun 2022 17:05:40 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 44 expires Thu, 23 Jun 2022 17:05:40 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	1 B 21 B	79ms 32ms	XHR text/plain	2a00:1450:4001:810::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1724452646&t=pageview&_s=1&dl=https%3A%2F%2Fapp.cleverwaiver.com%2Frender%2FtemplateByRefId%2F62b48828735f729d448770e0&ul=en-us&de=UTF-8&dt=Online%20waiver%20%7C%20Waiver%20app%20-%20Top%20Digital%20Waiver%20Application&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1769936336&gjid=1197407121&cid=308425422.1656003939&tid=UA-125390496-1&_gid=1740665433.1656003939&_r=1&gtm=2ou6f0&z=70145160 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://app.cleverwaiver.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 23 Jun 2022 17:05:40 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://app.cleverwaiver.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/766331869/	42 B 548 B	90ms 34ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/766331869/?random=1656003939064&cv=9&fst=1656003600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa6f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapp.cleverwaiver.com%2Frender%2FtemplateByRefId%2F62b48828735f729d448770e0&tiba=Online%20waiver%20%7C%20Waiver%20app%20-%20Top%20Digital%20Waiver%20Application&async=1&fmt=3&is_vtc=1&random=3809165450&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers pragma no-cache date Thu, 23 Jun 2022 17:05:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/766331869/	42 B 548 B	91ms 35ms	Image image/gif	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/766331869/?random=1656003939064&cv=9&fst=1656003600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa6f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapp.cleverwaiver.com%2Frender%2FtemplateByRefId%2F62b48828735f729d448770e0&tiba=Online%20waiver%20%7C%20Waiver%20app%20-%20Top%20Digital%20Waiver%20Application&async=1&fmt=3&is_vtc=1&random=3809165450&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers pragma no-cache date Thu, 23 Jun 2022 17:05:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	m-outer-6262077c14f753400d607dc30e70f1af.html Show response js.stripe.com/v3/ Frame 5390	240 B 980 B	24ms 23ms	Document text/html	108.138.7.100 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.stripe.com/v3/m-outer-6262077c14f753400d607dc30e70f1af.html Requested by Host: js.stripe.com URL: https://js.stripe.com/v3/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.7.100 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-7-100.fra56.r.cloudfront.net Software Cloudfront / Resource Hash 09b1eb79661c24d863b56180424505e555e15fd18df6d72fc5718fa21f319bf5 Security Headers Name Value Content-Security-Policy default-src 'self'; base-uri 'none'; form-action 'none'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report Strict-Transport-Security max-age=31556926; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://app.cleverwaiver.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-origin * age 243 cache-control max-age=31536000 content-length 240 content-security-policy default-src 'self'; base-uri 'none'; form-action 'none'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report content-type text/html; charset=utf-8 date Thu, 23 Jun 2022 17:01:42 GMT etag "6262077c14f753400d607dc30e70f1af" last-modified Fri, 10 Jun 2022 18:43:47 GMT server Cloudfront strict-transport-security max-age=31556926; includeSubDomains; preload timing-allow-origin * vary Accept-Encoding via 1.1 dd09b3b5f5b8dc626e1ba6804a73af40.cloudfront.net (CloudFront) x-amz-cf-id uJa9J5HQzbPZZTG5mca72h-u3EDWy7kxn_KiEI16Ubw1hmDGyiwrZA== x-amz-cf-pop FRA56-P6 x-cache Hit from cloudfront x-content-type-options nosniff
GET H/1.1	200 OK	62b48828735f729d448770e0 Show response app.cleverwaiver.com/api/templates/templates/getUserIdByTemplateId/	191 B 358 B	128ms 128ms	XHR application/json	54.196.16.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.cleverwaiver.com/api/templates/templates/getUserIdByTemplateId/62b48828735f729d448770e0 Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/scripts/vendor.0bd4d9ad.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.196.16.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-196-16-164.compute-1.amazonaws.com Software gunicorn / Resource Hash 8c033f4222ca058a590db42a07ecc13dfd6c44250efd8a49a9e17dc8c8a87140 Request headers Accept application/json, text/plain, */* Referer https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:43 GMT Via 1.1 vegur Server gunicorn Connection keep-alive Content-Length 191 Content-Type application/json
GET H/1.1	200 OK	62b48828735f729d448770e0 Show response app.cleverwaiver.com/api/templates/templates/	1 KB 2 KB	127ms 126ms	XHR application/json	54.196.16.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.cleverwaiver.com/api/templates/templates/62b48828735f729d448770e0 Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/scripts/vendor.0bd4d9ad.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.196.16.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-196-16-164.compute-1.amazonaws.com Software gunicorn / Resource Hash 4047446288c094cd9d62155ee14169d10ea278650a4efefaafaaaad4242e2fe4 Request headers Accept application/json, text/plain, */* Referer https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:43 GMT Via 1.1 vegur Server gunicorn Connection keep-alive Content-Length 1421 Content-Type application/json
GET H/1.1	200 OK	scrollDown.png app.cleverwaiver.com/images/	2 KB 3 KB	109ms 109ms	Image image/png	54.196.16.164 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://app.cleverwaiver.com/images/scrollDown.png Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.196.16.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-196-16-164.compute-1.amazonaws.com Software gunicorn / Resource Hash 757901e9e0dc97c8c91bc79b407e7c104a63d8e91d91b4439cef6da36ee916be Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:43 GMT Via 1.1 vegur Last-Modified Wed, 22 Jun 2022 04:37:57 GMT Server gunicorn Etag "1655872677.0-2308-2519404937" Content-Type image/png Cache-Control public, max-age=43200 Connection keep-alive Content-Length 2308 Expires Fri, 24 Jun 2022 05:05:43 GMT
GET H/1.1	200 OK	zLY6V7-powered_by_stripe@2x.png waiverphoto.s3.amazonaws.com/images/	2 KB 3 KB	500ms 138ms	Image binary/octet-stream	52.216.145.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://waiverphoto.s3.amazonaws.com/images/zLY6V7-powered_by_stripe@2x.png Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.11 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash 523c0a8851a27195afc32452186cc1a02a323d71301e31f879aff61a786d29b4 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:45 GMT Last-Modified Wed, 29 Aug 2018 06:19:11 GMT Server AmazonS3 x-amz-request-id YK5TY77B270BGKF8 ETag "3de2c72d054707991ab78568a11d8bb6" Content-Type binary/octet-stream Accept-Ranges bytes Content-Length 2431 x-amz-id-2 lzGJtq1NzhRwFZqKD+nh2+C7By9WRgeGifRzySUkk2/oo3KA5ukKHMymTLykT5lxFlVk8PPo0+Y=
GET H/1.1	200 OK	whCYZe-square.jpg waiverphoto.s3.amazonaws.com/images/	13 KB 14 KB	499ms 134ms	Image binary/octet-stream	52.216.145.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://waiverphoto.s3.amazonaws.com/images/whCYZe-square.jpg Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.11 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash adc31f8daab39e32f2a7f892b8a67c7b9002d7e99e8f612f99326c596f72a754 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:45 GMT Last-Modified Fri, 06 Dec 2019 06:50:09 GMT Server AmazonS3 x-amz-request-id YK5JCTG7QP7CDRSB ETag "98c29899e5200d1efd1142d69f0216c4" Content-Type binary/octet-stream Accept-Ranges bytes Content-Length 13772 x-amz-id-2 KNxpBXEG9u/xCx7ZpeEZkftDMcLeZMiiIYREdDa4qBh/CRe6z3N6c/SXYedtA3hZO4iqhAKWy4U=
GET H/1.1	200 OK	AXlZ06-newlogo.png waiverphoto.s3.amazonaws.com/images/	24 KB 24 KB	507ms 141ms	Image binary/octet-stream	52.216.145.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://waiverphoto.s3.amazonaws.com/images/AXlZ06-newlogo.png Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.11 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash 8c8e69797e1b4dfba6205653dc7151700cde88c3a81f5dc49a67ce0be5eb768a Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:45 GMT Last-Modified Thu, 13 Sep 2018 09:29:54 GMT Server AmazonS3 x-amz-request-id YK5M3YHR56GNV0JV ETag "ba43f15f2f48da7affc524d17769823f" Content-Type binary/octet-stream Accept-Ranges bytes Content-Length 24196 x-amz-id-2 F5qvN5PTCOgko3C5BjPvgHzrLnY4JuZLhRu84qiv8Irob3axAFTwK1BX2ck8mU9if8C3YAaTo3E=
POST H2	200	csp-report q.stripe.com/ Frame 5390	0 570 B	600ms 194ms	Other text/plain	54.186.23.98 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://q.stripe.com/csp-report Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ip-54-186-23-98.stripe.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://js.stripe.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Content-Type application/csp-report Response headers date Thu, 23 Jun 2022 17:05:44 GMT x-content-type-options nosniff x-envoy-upstream-service-time 3 strict-transport-security max-age=63072000; includeSubDomains; preload content-length 0 pragma no-cache referrer-policy strict-origin-when-cross-origin server nginx cross-origin-opener-policy same-origin access-control-max-age 3600 access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://js.stripe.com access-control-expose-headers Server, Range, Content-Type cache-control max-age=0, no-cache, no-store, must-revalidate x-robots-tag none access-control-allow-headers Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token expires 0
GET H2	200	m-outer-1de4e7d28801c4ac0e66bebcee7d3303.js Show response js.stripe.com/v3/fingerprinted/js/ Frame 5390	1 KB 1 KB	23ms 23ms	Script application/javascript	108.138.7.100 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.stripe.com/v3/fingerprinted/js/m-outer-1de4e7d28801c4ac0e66bebcee7d3303.js Requested by Host: js.stripe.com URL: https://js.stripe.com/v3/m-outer-6262077c14f753400d607dc30e70f1af.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.7.100 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-7-100.fra56.r.cloudfront.net Software Cloudfront / Resource Hash d40ff7d5ced4bb683114a6624a40e61d3142c78a175401b9bfbd37531bc8fa4b Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://js.stripe.com/v3/m-outer-6262077c14f753400d607dc30e70f1af.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=31556926; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 39 x-cache Hit from cloudfront date Thu, 23 Jun 2022 17:05:04 GMT via 1.1 dd09b3b5f5b8dc626e1ba6804a73af40.cloudfront.net (CloudFront) last-modified Fri, 10 Jun 2022 18:43:57 GMT server Cloudfront etag W/"77711798ecf99b8bb8207cf88a10d73c" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=60 x-amz-cf-pop FRA56-P6 timing-allow-origin * x-amz-cf-id ds9WSbSOgyeqnzxJiNnluoeBgVwKzxFNObp7gBBOuvOFCUUTEoj59w==
GET H2	200	inner.html Show response m.stripe.network/ Frame 205F	930 B 2 KB	122ms 27ms	Document text/html	2600:9000:2156:9e00:19:7d10:bd80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.stripe.network/inner.html Requested by Host: js.stripe.com URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-1de4e7d28801c4ac0e66bebcee7d3303.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:9e00:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Cloudfront / Resource Hash a5f27af9c0c6f37979ebafcac22eb3a613841a3d4e728f4577baf94e64d42f35 Security Headers Name Value Content-Security-Policy base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report Strict-Transport-Security max-age=31556926; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://js.stripe.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes age 285 cache-control max-age=300, public content-length 930 content-security-policy base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report content-type text/html; charset=utf-8 date Thu, 23 Jun 2022 17:01:05 GMT etag "fc2e029628f163bb59adc6fa5a31161c" last-modified Thu, 17 Mar 2022 19:03:12 GMT server Cloudfront strict-transport-security max-age=31556926; includeSubDomains; preload vary Accept-Encoding via 1.1 e64eb476d8f76c461d21278e018e194e.cloudfront.net (CloudFront) x-amz-cf-id S4w9ToKPAdxs1r6sHr6ubS55KEv3wudnwBzz_V_C58LVS9FF4slEug== x-amz-cf-pop FRA50-C1 x-cache Hit from cloudfront x-content-type-options nosniff
GET H/1.1	200 OK	rgE303-5k1Fy9-office-365-business-logo.png waiverphoto.s3.amazonaws.com/images/	11 KB 11 KB	488ms 147ms	Image binary/octet-stream	52.216.145.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://waiverphoto.s3.amazonaws.com/images/rgE303-5k1Fy9-office-365-business-logo.png Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.11 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash 3b68cb05982d2988a2a2266770b9dd74017400596399820f38ed616c0e263487 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:45 GMT Last-Modified Thu, 23 Jun 2022 15:35:25 GMT Server AmazonS3 x-amz-request-id YK5TQH1EC1K3J3XD ETag "dc89896a5f14c9c4c6d267661b84fa93" Content-Type binary/octet-stream Accept-Ranges bytes Content-Length 10975 x-amz-id-2 9kBXu4YCjYFOTxNG5QauHF6WglfvTd8eOiCkT2TWw0jgT5y57kfNgccu9atkU6KUUNdoV1z3jEQ=
GET H/1.1	200 OK	yERF17-214d89a26f0ac918a09f216a1b0f97b4.png waiverphoto.s3.amazonaws.com/images/	364 KB 364 KB	510ms 165ms	Image binary/octet-stream	52.216.145.11 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://waiverphoto.s3.amazonaws.com/images/yERF17-214d89a26f0ac918a09f216a1b0f97b4.png Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.11 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash 318e36178af3cbc9c9fceb6fce191d42483ec70c528b1c600e2c38c72a111637 Request headers accept-language de-DE,de;q=0.9 Referer https://app.cleverwaiver.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 23 Jun 2022 17:05:45 GMT Last-Modified Thu, 23 Jun 2022 15:37:52 GMT Server AmazonS3 x-amz-request-id YK5ZB4FQ2FDPG1A0 ETag "214d89a26f0ac918a09f216a1b0f97b4" Content-Type binary/octet-stream Accept-Ranges bytes Content-Length 372780 x-amz-id-2 MgIWZAS3DUl2f4Tk94pijyctErFzcSSigWH165i8M3T3HOd5cJUNc1ik/aX7HCh4VPizxBIFlBg=
POST H2	200	csp-report q.stripe.com/ Frame 205F	0 345 B	436ms 192ms	Other text/plain	54.186.23.98 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://q.stripe.com/csp-report Requested by Host: app.cleverwaiver.com URL: https://app.cleverwaiver.com/render/templateByRefId/62b48828735f729d448770e0 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ip-54-186-23-98.stripe.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://m.stripe.network/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Content-Type application/csp-report Response headers pragma no-cache date Thu, 23 Jun 2022 17:05:44 GMT referrer-policy strict-origin-when-cross-origin server nginx cross-origin-opener-policy same-origin strict-transport-security max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload cache-control max-age=0, no-cache, no-store, must-revalidate x-envoy-upstream-service-time 1 x-robots-tag none content-length 0 x-content-type-options nosniff expires 0
GET H2	200	out-4.5.42.js Show response m.stripe.network/ Frame 205F	86 KB 14 KB	28ms 27ms	Script text/javascript	2600:9000:2156:9e00:19:7d10:bd80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.stripe.network/out-4.5.42.js Requested by Host: m.stripe.network URL: https://m.stripe.network/inner.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:9e00:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Cloudfront / Resource Hash f445ee14f2454d974293d28677213ae002e9ac17721fc04b2fdeb037e083b083 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://m.stripe.network/inner.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=31556926; includeSubDomains; preload content-encoding br x-content-type-options nosniff last-modified Thu, 17 Mar 2022 19:03:12 GMT server Cloudfront age 7 date Thu, 23 Jun 2022 17:05:39 GMT vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript; charset=utf-8 via 1.1 e64eb476d8f76c461d21278e018e194e.cloudfront.net (CloudFront) cache-control max-age=300, public x-amz-cf-pop FRA50-C1 x-amz-cf-id b5-OWVshAkVKCeNjd8rBcIx-SUjsrVkUreFn4D_dKsnjDEswMZ6xyA== etag W/"21df7244385e5c0bdf32da01d0dad6c0"
POST H2	200	6 Show response m.stripe.com/ Frame 205F	156 B 523 B	1326ms 949ms	XHR application/json	52.88.245.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.stripe.com/6 Requested by Host: m.stripe.network URL: https://m.stripe.network/out-4.5.42.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.88.245.200 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-88-245-200.us-west-2.compute.amazonaws.com Software nginx / Resource Hash 6d84e28454afd33c4c5a9577cab0b108a3e4fd43b5b3aa5da26139241e291a78 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://m.stripe.network/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 23 Jun 2022 17:05:45 GMT x-content-type-options nosniff server nginx strict-transport-security max-age=31556926; includeSubDomains; preload content-type application/json;charset=utf-8 access-control-allow-origin https://m.stripe.network access-control-allow-credentials true access-control-allow-headers Content-Type content-length 156

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

89 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| __webpackStripeJSv3Jsonp function| Stripe object| __core-js_shared__ object| core function| SqPaymentForm function| gtag object| dataLayer function| gtag_report_conversion function| fbAsyncInit function| goog_snippet_vars function| goog_report_conversion function| GooglemKTybQhCsO function| google_trackConversion object| FB object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| GooglebQhCsO object| gaplugins object| gaGlobal object| gaData function| validElementString function| registerTextAngularTool function| stripHtmlToText function| getDomFromHtml function| saveAs object| taTools string| textAngularVersion object| _browserDetect object| BLOCKELEMENTS object| LISTELEMENTS object| VALIDELEMENTS object| sheet function| addCSSRule function| removeCSSRule function| _addCSSRule function| _removeCSSRule function| _getRuleIndex object| _sheets boolean| dropFired object| textAngular object| dp function| $ function| jQuery object| angular object| rangy object| reTree object| beside function| Spinner function| ClipboardJS function| base64ToBuffer function| bufferToHex function| hexToBuffer function| utf8ToBinaryString function| utf8ToBuffer function| utf8ToBase64 function| binaryStringToUtf8 function| bufferToUtf8 function| base64ToUtf8 function| bufferToBinaryString function| bufferToBase64 function| binaryStringToBuffer function| in$ object| xepOnline string| current_mimetype string| current_stylesheet number| current_height function| qrcode function| SignaturePad function| alasql object| Unibabel object| Highcharts function| Color function| Chart function| Quill string| Requester function| initStripe function| initSquare function| onGetCardNonce

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.squareup.com/	1970-01-21 06:16:51	Name: _savt Value: 66764cb9-ad77-4fae-9b07-9ccebb7fc9bc
			.cleverwaiver.com/	1970-01-20 06:09:39	Name: _gcl_au Value: 1.1.232883932.1656003939
			.cleverwaiver.com/	1970-01-20 21:31:15	Name: _ga Value: GA1.2.308425422.1656003939
			.cleverwaiver.com/	1970-01-20 04:01:30	Name: _gid Value: GA1.2.1740665433.1656003939
			.cleverwaiver.com/	1970-01-20 04:00:03	Name: _gat_gtag_UA_125390496_1 Value: 1
			.doubleclick.net/	1970-01-20 04:00:04	Name: test_cookie Value: CheckForPermission
			m.stripe.com/	1970-01-20 21:31:15	Name: m Value: a681984e-d6bf-4ef1-897e-7d8cc7b34719864529
			.app.cleverwaiver.com/	1970-01-20 12:45:39	Name: __stripe_mid Value: 8dee9783-0c07-4e49-9a14-d450c56517a02fcc2a
			.app.cleverwaiver.com/	1970-01-20 04:00:05	Name: __stripe_sid Value: 4496a8ba-094e-494a-b38f-392a3e36d1e6d3d529

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.cleverwaiver.com
connect.facebook.net
googleads.g.doubleclick.net
js.squareup.com
js.stripe.com
m.stripe.com
m.stripe.network
q.stripe.com
waiverphoto.s3.amazonaws.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
108.138.7.100
172.217.18.98
2600:9000:2156:9e00:19:7d10:bd80:93a1
2a00:1450:4001:802::2003
2a00:1450:4001:810::200e
2a00:1450:4001:830::2008
2a00:1450:4001:831::2002
2a00:1450:4001:831::2004
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
52.216.145.11
52.88.245.200
54.186.23.98
54.196.16.164
74.122.190.85
09b1eb79661c24d863b56180424505e555e15fd18df6d72fc5718fa21f319bf5
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
318e36178af3cbc9c9fceb6fce191d42483ec70c528b1c600e2c38c72a111637
32ee5fc9bc8410c5e1dd0d85a70623bd1b1d4d704b352c6e723cd2d49a22a9eb
33272713d84ffdaab3a61030b3c4cecca56a0f00485bd02767a96e61bc45452d
3932ba863f373d02b872f4a735867b625a588e6aabf3a73dacad6825623b03e0
3b68cb05982d2988a2a2266770b9dd74017400596399820f38ed616c0e263487
4047446288c094cd9d62155ee14169d10ea278650a4efefaafaaaad4242e2fe4
45b1d75552bbbe2bad3b3a0ceac301e1a86076e5213792919c26335b5d9630b6
523c0a8851a27195afc32452186cc1a02a323d71301e31f879aff61a786d29b4
56dee4badb79b07b7dd6effbe8d8b9ee09f1f4d7f2f89154eab17ff1bace742d
6a0b6b79b4f8afe5801a48261da73974aaafc6d2dc19281476653df5081afbd7
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d84e28454afd33c4c5a9577cab0b108a3e4fd43b5b3aa5da26139241e291a78
757901e9e0dc97c8c91bc79b407e7c104a63d8e91d91b4439cef6da36ee916be
7c521e499237a9ff936617555d93d48961ef006e443b560c283ed66143ee22d2
8c033f4222ca058a590db42a07ecc13dfd6c44250efd8a49a9e17dc8c8a87140
8c8e69797e1b4dfba6205653dc7151700cde88c3a81f5dc49a67ce0be5eb768a
8e3f0998cf24a40ddf024829492cd0e1cd3bc9597b649619eaa341aae7cd02f3
90fa9b0b48eb4af1f43c882abb92e18fb171bdc279377fcd92fac28136434c30
973ff4ce8d97dfaa8130c2f70f98ff99e8f5e924893635e9e3f6eab8dc6a2c38
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a5f27af9c0c6f37979ebafcac22eb3a613841a3d4e728f4577baf94e64d42f35
adc31f8daab39e32f2a7f892b8a67c7b9002d7e99e8f612f99326c596f72a754
afcd7970fdf0f132591fcd9d5307a2a889fc7c3ad8a88d2b46a15964a2640ed9
b325088fc3192dd7f1fa5c280b48675ecc6eb26217989295aabcaf2d7f7bfb61
b568265050d2719a4f13c267c7c8a1a85f4c073421a04f08f70c10c4aed298d5
d40ff7d5ced4bb683114a6624a40e61d3142c78a175401b9bfbd37531bc8fa4b
e1657cd5534086979f770216cdcfd760424e85684df35fdde4521770f954beb5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f445ee14f2454d974293d28677213ae002e9ac17721fc04b2fdeb037e083b083