Submitted URL: https://www.ansatt.lillestromflytt.no/
Effective URL: https://ansatt.lillestromflytt.no/
Submission: On January 13 via automatic, source certstream-suspicious — Scanned from NO

Summary

This website contacted 9 IPs in 3 countries across 9 domains to perform 19 HTTP transactions. The main IP is 185.126.37.31, located in Norway and belongs to SERVETHEWORLD-AS, NO. The main domain is ansatt.lillestromflytt.no.
TLS certificate: Issued by R3 on January 13th 2024. Valid for: 3 months.
This is the only time ansatt.lillestromflytt.no was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 10 185.126.37.31 34989 (SERVETHEW...)
1 2a00:1450:400... 15169 (GOOGLE)
2 172.65.208.22 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 172.65.202.201 13335 (CLOUDFLAR...)
2 172.65.192.122 13335 (CLOUDFLAR...)
1 172.65.238.60 13335 (CLOUDFLAR...)
1 172.65.240.166 13335 (CLOUDFLAR...)
1 172.65.232.43 13335 (CLOUDFLAR...)
19 9
Apex Domain
Subdomains
Transfer
10 lillestromflytt.no
www.ansatt.lillestromflytt.no
ansatt.lillestromflytt.no
141 KB
2 hscollectedforms.net
js-eu1.hscollectedforms.net — Cisco Umbrella Rank: 26133
forms-eu1.hscollectedforms.net — Cisco Umbrella Rank: 26852
26 KB
2 hs-scripts.com
js-eu1.hs-scripts.com — Cisco Umbrella Rank: 14089
2 KB
1 hsforms.com
forms-eu1.hsforms.com — Cisco Umbrella Rank: 28210
1016 B
1 hubspot.com
track-eu1.hubspot.com — Cisco Umbrella Rank: 15659
1 KB
1 hs-analytics.net
js-eu1.hs-analytics.net — Cisco Umbrella Rank: 15112
21 KB
1 hs-banner.com
js-eu1.hs-banner.com — Cisco Umbrella Rank: 14881
21 KB
1 gstatic.com
fonts.gstatic.com
48 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 28
3 KB
19 9
Domain Requested by
9 ansatt.lillestromflytt.no ansatt.lillestromflytt.no
2 js-eu1.hs-scripts.com ansatt.lillestromflytt.no
js-eu1.hs-analytics.net
1 forms-eu1.hsforms.com
1 track-eu1.hubspot.com
1 forms-eu1.hscollectedforms.net js-eu1.hscollectedforms.net
1 js-eu1.hs-analytics.net js-eu1.hs-scripts.com
1 js-eu1.hscollectedforms.net js-eu1.hs-scripts.com
1 js-eu1.hs-banner.com js-eu1.hs-scripts.com
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com ansatt.lillestromflytt.no
1 www.ansatt.lillestromflytt.no 1 redirects
19 11

This site contains links to these domains. Also see Links.

Domain
www.elegantthemes.com
www.wordpress.org
Subject Issuer Validity Valid
ansatt.lillestromflytt.no
R3
2024-01-13 -
2024-04-12
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-12-11 -
2024-03-04
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-03 -
2024-05-02
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-12-11 -
2024-03-04
3 months crt.sh
hubspot.com
Cloudflare Inc ECC CA-3
2024-01-06 -
2024-12-31
a year crt.sh

This page contains 1 frames:

Primary Page: https://ansatt.lillestromflytt.no/
Frame ID: 94044AD0A1B5CD4DD5302571F16000E2
Requests: 19 HTTP requests in this frame

Screenshot

Page Title

|

Page URL History Show full URLs

  1. https://www.ansatt.lillestromflytt.no/ HTTP 301
    https://ansatt.lillestromflytt.no/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

19
Requests

100 %
HTTPS

22 %
IPv6

9
Domains

11
Subdomains

9
IPs

3
Countries

264 kB
Transfer

900 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.ansatt.lillestromflytt.no/ HTTP 301
    https://ansatt.lillestromflytt.no/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ansatt.lillestromflytt.no/
Redirect Chain
  • https://www.ansatt.lillestromflytt.no/
  • https://ansatt.lillestromflytt.no/
108 KB
20 KB
Document
General
Full URL
https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.126.37.31 , Norway, ASN34989 (SERVETHEWORLD-AS, NO),
Reverse DNS
mime.domene.no
Software
LiteSpeed /
Resource Hash
68297820e5ba696a23d085629a4a55d83b2a68969c86f0b3f866c66b081c8090

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
no-NO,no;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 13 Jan 2024 12:39:33 GMT
link
<https://ansatt.lillestromflytt.no/wp-json/>; rel="https://api.w.org/" <https://ansatt.lillestromflytt.no/wp-json/wp/v2/pages/2>; rel="alternate"; type="application/json" <https://ansatt.lillestromflytt.no/>; rel=shortlink
server
LiteSpeed
vary
Accept-Encoding,User-Agent
x-pingback
https://ansatt.lillestromflytt.no/xmlrpc.php

Redirect headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 13 Jan 2024 12:39:33 GMT
location
https://ansatt.lillestromflytt.no/
server
LiteSpeed
vary
Accept-Encoding,User-Agent
x-pingback
https://ansatt.lillestromflytt.no/xmlrpc.php
x-redirect-by
WordPress
css
fonts.googleapis.com/
57 KB
3 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
abf308a351422c8fb7cfc7a1ecec936e744ddf02bf426bc884a0115b1c28af1a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 13 Jan 2024 12:39:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 13 Jan 2024 11:46:42 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 13 Jan 2024 12:39:34 GMT
logo.png
ansatt.lillestromflytt.no/wp-content/themes/Divi/images/
2 KB
2 KB
Image
General
Full URL
https://ansatt.lillestromflytt.no/wp-content/themes/Divi/images/logo.png
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.126.37.31 , Norway, ASN34989 (SERVETHEWORLD-AS, NO),
Reverse DNS
mime.domene.no
Software
LiteSpeed /
Resource Hash
cf520886e248a0fad2dffd2e44bd9ba546d0d8f5e750f182397be7d16680b20f

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:33 GMT
last-modified
Sat, 13 Jan 2024 12:13:04 GMT
server
LiteSpeed
vary
User-Agent
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1740
expires
Sat, 20 Jan 2024 12:39:33 GMT
143947368.js
js-eu1.hs-scripts.com/
2 KB
1 KB
Script
General
Full URL
https://js-eu1.hs-scripts.com/143947368.js?integration=WordPress&ver=10.2.17
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a097e48d6aae527e4859e8b3367b2ce71e3654a8dfa013f2d360dde46b71f91
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:34 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
EXPIRED
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
b24f0e12-e35a-4f98-bb47-8b445199d92b
x-envoy-upstream-service-time
4
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
b24f0e12-e35a-4f98-bb47-8b445199d92b
last-modified
Sat, 13 Jan 2024 12:37:09 GMT
server
cloudflare
x-trace
2B293230663DC9D62DD5142F8FD43C836BCF54F2F6000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://ansatt.lillestromflytt.no
x-evy-trace-virtual-host
all
cache-control
public, max-age=30
access-control-allow-credentials
true
x-evy-trace-served-by-pod
fra04/hubapi-td/envoy-proxy-6748d5b5db-4vx47
cf-ray
844db3ea498715f8-ARN
jquery.min.js
ansatt.lillestromflytt.no/wp-includes/js/jquery/
86 KB
29 KB
Script
General
Full URL
https://ansatt.lillestromflytt.no/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.126.37.31 , Norway, ASN34989 (SERVETHEWORLD-AS, NO),
Reverse DNS
mime.domene.no
Software
LiteSpeed /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:33 GMT
content-encoding
br
last-modified
Mon, 28 Aug 2023 21:44:24 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
29744
expires
Sat, 20 Jan 2024 12:39:33 GMT
jquery-migrate.min.js
ansatt.lillestromflytt.no/wp-includes/js/jquery/
13 KB
5 KB
Script
General
Full URL
https://ansatt.lillestromflytt.no/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.126.37.31 , Norway, ASN34989 (SERVETHEWORLD-AS, NO),
Reverse DNS
mime.domene.no
Software
LiteSpeed /
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:34 GMT
content-encoding
br
last-modified
Fri, 09 Jun 2023 10:19:24 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
4678
expires
Sat, 20 Jan 2024 12:39:34 GMT
scripts.min.js
ansatt.lillestromflytt.no/wp-content/themes/Divi/js/
268 KB
64 KB
Script
General
Full URL
https://ansatt.lillestromflytt.no/wp-content/themes/Divi/js/scripts.min.js?ver=4.23.4
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.126.37.31 , Norway, ASN34989 (SERVETHEWORLD-AS, NO),
Reverse DNS
mime.domene.no
Software
LiteSpeed /
Resource Hash
9ccbe8ceae9d2553c597d0a65f19928d14f42368ddd1118d69a968c2c9912161

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:34 GMT
content-encoding
br
last-modified
Sat, 13 Jan 2024 12:13:04 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
65159
expires
Sat, 20 Jan 2024 12:39:34 GMT
common.js
ansatt.lillestromflytt.no/wp-content/themes/Divi/core/admin/js/
1 KB
523 B
Script
General
Full URL
https://ansatt.lillestromflytt.no/wp-content/themes/Divi/core/admin/js/common.js?ver=4.23.4
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.126.37.31 , Norway, ASN34989 (SERVETHEWORLD-AS, NO),
Reverse DNS
mime.domene.no
Software
LiteSpeed /
Resource Hash
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:34 GMT
content-encoding
br
last-modified
Sat, 13 Jan 2024 12:13:04 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
490
expires
Sat, 20 Jan 2024 12:39:34 GMT
style.min.css
ansatt.lillestromflytt.no/wp-includes/css/dist/block-library/
107 KB
13 KB
Stylesheet
General
Full URL
https://ansatt.lillestromflytt.no/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.126.37.31 , Norway, ASN34989 (SERVETHEWORLD-AS, NO),
Reverse DNS
mime.domene.no
Software
LiteSpeed /
Resource Hash
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:34 GMT
content-encoding
br
last-modified
Mon, 06 Nov 2023 01:10:32 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
13607
expires
Sat, 20 Jan 2024 12:39:34 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/
47 KB
48 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://ansatt.lillestromflytt.no
accept-language
no-NO,no;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Fri, 12 Jan 2024 12:05:18 GMT
x-content-type-options
nosniff
age
88456
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48236
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 11 Jan 2025 12:05:18 GMT
modules.woff
ansatt.lillestromflytt.no/wp-content/themes/Divi/core/admin/fonts/modules/base/
6 KB
6 KB
Font
General
Full URL
https://ansatt.lillestromflytt.no/wp-content/themes/Divi/core/admin/fonts/modules/base/modules.woff
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.126.37.31 , Norway, ASN34989 (SERVETHEWORLD-AS, NO),
Reverse DNS
mime.domene.no
Software
LiteSpeed /
Resource Hash
ef71c937db7d4381cd982493ff9728723d27dd44282cc5adef9e16bc7025ad26

Request headers

Referer
https://ansatt.lillestromflytt.no/
Origin
https://ansatt.lillestromflytt.no
accept-language
no-NO,no;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:34 GMT
last-modified
Sat, 13 Jan 2024 12:13:04 GMT
server
LiteSpeed
vary
User-Agent
content-type
font/woff
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
6152
expires
Sat, 20 Jan 2024 12:39:34 GMT
banner.js
js-eu1.hs-banner.com/v2/143947368/
65 KB
21 KB
Script
General
Full URL
https://js-eu1.hs-banner.com/v2/143947368/banner.js
Requested by
Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/143947368.js?integration=WordPress&ver=10.2.17
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92e4b29bbef3fb8506e130b6924b33e359e401385e2a16354d72806b3e42d7a5

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:35 GMT
x-amz-version-id
ilDJlOnnxonH22fWX2xPvX7V1QkxjB7t
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
CFTGKM6DEN6VW021
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-hubspot-correlation-id
6de78b7f-dff0-4bd5-93ce-10399f32da51
age
181
x-envoy-upstream-service-time
53
x-amz-id-2
iNLiqW18LiS8WBmVfh3vPguJFULyP9/vM15f/pV6rlaJanELu4TJglU0qRsvBjd61O4TOF9hmpg=
x-evy-trace-listener
listener_https
x-request-id
6de78b7f-dff0-4bd5-93ce-10399f32da51
x-evy-trace-route-configuration
listener_https/all
last-modified
Sat, 13 Jan 2024 12:27:40 GMT
server
cloudflare
etag
W/"492711cd5ae16ba46dcd41fc05dd144a"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://ansatt.lillestromflytt.no
x-evy-trace-virtual-host
all
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300,public
access-control-allow-credentials
true
x-evy-trace-served-by-pod
fra04/analytics-js-proxy-td/envoy-proxy-5f696f64f6-8n4nm
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
844db3ebcb9598f4-ARN
expires
Sat, 13 Jan 2024 12:41:34 GMT
collectedforms.js
js-eu1.hscollectedforms.net/
69 KB
25 KB
Script
General
Full URL
https://js-eu1.hscollectedforms.net/collectedforms.js
Requested by
Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/143947368.js?integration=WordPress&ver=10.2.17
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c326f96b9af470b51c887a189b1f81d241d6beef4844b37c8add5144fa6f55d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://ansatt.lillestromflytt.no/
Origin
https://ansatt.lillestromflytt.no
accept-language
no-NO,no;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

content-encoding
br
age
181
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.451/bundles/project.js&cfRay=844daf837f462d75-ARN
x-amz-replication-status
COMPLETED
x-evy-trace-listener
listener_https
etag
W/"dc52d8d37d1323196ca91b50795df6c4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-evy-trace-virtual-host
all
cache-control
s-maxage=600, max-age=300
x-hs-target-asset
collected-forms-embed-js/static-1.451/bundles/project.js
date
Sat, 13 Jan 2024 12:39:35 GMT
x-amz-version-id
JAkD5shSwdxe4gNEROP8R.wQbdFvcCSE
via
1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
x-amz-cf-pop
FRA60-P6
x-hubspot-correlation-id
7f75dabf-2f3e-48ba-b98e-8c49f694894e
x-cache
Hit from cloudfront
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time
1
x-evy-trace-route-configuration
listener_https/all
x-request-id
7f75dabf-2f3e-48ba-b98e-8c49f694894e
last-modified
Wed, 03 Jan 2024 09:59:35 UTC
server
cloudflare
x-hs-cache-status
HIT
x-evy-trace-served-by-pod
fra04/app-td/envoy-proxy-6d95cd8d5-pmpww
cf-ray
844db3ebc8005ef8-ARN
x-amz-cf-id
CbUJcS7CkHxfsmoQGIRT4p9LJmlx6x9-ugTYNJ9RPIFu9jLfJ0k-JQ==
143947368.js
js-eu1.hs-analytics.net/analytics/1705149300000/
66 KB
21 KB
Script
General
Full URL
https://js-eu1.hs-analytics.net/analytics/1705149300000/143947368.js
Requested by
Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/143947368.js?integration=WordPress&ver=10.2.17
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a5b075446341d26ecce83434c19f5cc42027c1fca25211b4eb4bf8e62ddd912

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:35 GMT
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
CFTVS4W6PWREFY8A
x-evy-trace-route-service-name
envoyset-translator
x-amz-server-side-encryption
AES256
x-hubspot-correlation-id
35d53a18-8112-4245-a4c0-0eafa0f1f492
age
181
x-envoy-upstream-service-time
44
x-amz-id-2
+rNTdEE9N9ackr9E0KpOq44zkUs/aUYpclJDBIW3jabrPEhDz5X76ZSx8hB2a5cK5YoXx5oBcCE=
x-evy-trace-listener
listener_https
x-request-id
35d53a18-8112-4245-a4c0-0eafa0f1f492
x-evy-trace-route-configuration
listener_https/all
last-modified
Sat, 13 Jan 2024 12:27:45 GMT
server
cloudflare
etag
W/"8c06d1e1c88cfe6bfe5080708b8b3df3"
vary
origin, Accept-Encoding
content-type
text/javascript
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
fra04/analytics-js-proxy-td/envoy-proxy-5f696f64f6-8n4nm
cache-control
max-age=300,public
access-control-allow-credentials
false
cf-ray
844db3ebcb7715e0-ARN
expires
Sat, 13 Jan 2024 12:41:34 GMT
json
forms-eu1.hscollectedforms.net/collected-forms/v1/config/
117 B
440 B
XHR
General
Full URL
https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=143947368&utk=
Requested by
Host: js-eu1.hscollectedforms.net
URL: https://js-eu1.hscollectedforms.net/collectedforms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.65.192.122 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1bad76cc3759a006e9fec9dabe1ed1de3ac2541045162fa19df76731c4dcbdd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/plain, */*
Referer
https://ansatt.lillestromflytt.no/
accept-language
no-NO,no;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
703a59a5-99d2-46bc-b1c1-4230704374c7
x-envoy-upstream-service-time
8
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
703a59a5-99d2-46bc-b1c1-4230704374c7
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://ansatt.lillestromflytt.no
x-evy-trace-virtual-host
all
cache-control
max-age=0
x-evy-trace-served-by-pod
fra04/app-td/envoy-proxy-6d95cd8d5-cvl4r
access-control-max-age
180
x-robots-tag
none
access-control-allow-headers
*
cf-ray
844db3ec99365ef8-ARN
143947368.js
js-eu1.hs-scripts.com/
2 KB
768 B
Script
General
Full URL
https://js-eu1.hs-scripts.com/143947368.js
Requested by
Host: js-eu1.hs-analytics.net
URL: https://js-eu1.hs-analytics.net/analytics/1705149300000/143947368.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a097e48d6aae527e4859e8b3367b2ce71e3654a8dfa013f2d360dde46b71f91
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
EXPIRED
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
4bb05828-c02e-4716-8745-4f70188ce513
x-envoy-upstream-service-time
6
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
4bb05828-c02e-4716-8745-4f70188ce513
last-modified
Sat, 13 Jan 2024 12:36:34 GMT
server
cloudflare
x-trace
2BB851D4D422A6B5C38D9BD5412958E98DCD8E46D7000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://ansatt.lillestromflytt.no
x-evy-trace-virtual-host
all
cache-control
public, max-age=30
access-control-allow-credentials
true
x-evy-trace-served-by-pod
fra04/hubapi-td/envoy-proxy-6748d5b5db-87lxx
cf-ray
844db3eccbf015f8-ARN
__ptq.gif
track-eu1.hubspot.com/
45 B
1 KB
Image
General
Full URL
https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2818260241&v=1.1&a=143947368&ct=standard-page&rcu=https%3A%2F%2Fansatt.lillestromflytt.no%2F&pu=https%3A%2F%2Fansatt.lillestromflytt.no%2F&t=%7C&cts=1705149575144&vi=1e51401cd11223caebf4b9777f1ed815&nc=true&u=3678895.1e51401cd11223caebf4b9777f1ed815.1705149575142.1705149575142.1705149575142.1&b=3678895.1.1705149575142&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:35 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
cc4822e5-5c8a-4f65-937f-8ee66f761f4f
p3p
CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time
7
content-length
45
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
cc4822e5-5c8a-4f65-937f-8ee66f761f4f
last-modified
Sat, 13 Jan 2024 12:39:35 GMT
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xxipg%2BTaOzw%2FcQq57sRZd6Cc29karqFSrr3uYzb44FgX%2B6DR5TRgkK52IR0EqZXrHppg810IluzJaP18%2BeIsIB5RrMgdeukCvAR4eyYrGRY8VBhDeqC01EiR891pmo4UwujiVS3Eyw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
x-evy-trace-served-by-pod
fra04/analytics-tracking-td/envoy-proxy-64c8987675-s9xcj
x-evy-trace-virtual-host
all
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
844db3edab4b95e4-ARN
x-robots-tag
none
logo.png
ansatt.lillestromflytt.no/wp-content/themes/Divi/images/
2 KB
2 KB
Image
General
Full URL
https://ansatt.lillestromflytt.no/wp-content/themes/Divi/images/logo.png
Requested by
Host: ansatt.lillestromflytt.no
URL: https://ansatt.lillestromflytt.no/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.126.37.31 , Norway, ASN34989 (SERVETHEWORLD-AS, NO),
Reverse DNS
mime.domene.no
Software
LiteSpeed /
Resource Hash
cf520886e248a0fad2dffd2e44bd9ba546d0d8f5e750f182397be7d16680b20f

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 13 Jan 2024 12:39:34 GMT
last-modified
Sat, 13 Jan 2024 12:13:04 GMT
server
LiteSpeed
vary
User-Agent
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1740
expires
Sat, 20 Jan 2024 12:39:34 GMT
counters.gif
forms-eu1.hsforms.com/embed/v3/
35 B
1016 B
Image
General
Full URL
https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
no-NO,no;q=0.9
Referer
https://ansatt.lillestromflytt.no/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Sat, 13 Jan 2024 12:39:35 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
CF-Cache-Status
DYNAMIC
x-evy-trace-route-service-name
envoyset-translator
X-HubSpot-Correlation-Id
9f3dd1cf-5a84-4ed9-953f-3f843980af23
x-envoy-upstream-service-time
2
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
35
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
9f3dd1cf-5a84-4ed9-953f-3f843980af23
Server
cloudflare
X-Trace
2BED0F9ABF8994BED1440A1560DBF6110CFAAAA8AC000000000000000000
Vary
origin
Content-Type
image/gif
x-evy-trace-virtual-host
all
x-evy-trace-served-by-pod
fra04/star-hubspot-td/envoy-proxy-6566f6b7f7-mm68f
Access-Control-Expose-Headers
X-Origin-Hublet
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
false
X-Robots-Tag
none
CF-RAY
844db3ee2db595f7-ARN

Verdicts & Comments Add Verdict or Comment

93 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| jQuery function| $ object| _hsq object| leadin_wordpress object| _hsp object| DIVI object| et_builder_utils_params object| et_frontend_scripts object| et_pb_custom object| et_pb_box_shadow_elements function| Waypoint function| et_pb_debounce function| et_pb_smooth_scroll function| et_pb_form_placeholders_init function| et_duplicate_menu function| et_pb_remove_placeholder_text function| et_fix_fullscreen_section function| et_bar_counters_init function| et_fix_pricing_currency_position function| et_pb_set_responsive_grid function| et_pb_set_tabs_height function| et_pb_box_shadow_apply_overlay function| et_pb_init_nav_menu function| et_pb_toggle_nav_menu function| et_pb_apply_sticky_image_effect function| et_pb_menu_inject_inline_centered_logo function| et_pb_menu_inject_item function| et_pb_reposition_menu_module_dropdowns boolean| et_load_event_fired boolean| et_is_transparent_nav boolean| et_is_vertical_nav boolean| et_is_fixed_nav boolean| et_is_minified_js boolean| et_is_minified_css boolean| et_force_width_container_change function| et_pb_init_woo_star_rating function| et_pb_wrap_woo_attribute_fields_in_span function| et_calculate_fullscreen_section_size function| et_pb_init_modules function| etFixDividerSpacing function| etInitWooReviewsRatingStars boolean| et_calculating_scroll_position boolean| et_side_nav_links_initialized function| et_calculate_header_values function| et_change_primary_nav_position function| et_fix_page_container_position function| et_pb_window_side_nav_scroll_init function| et_pb_side_nav_page_init function| et_pb_slider_init function| et_countdown_timer function| et_countdown_timer_labels function| et_pb_tabs_init function| et_pb_circle_counter_update function| et_apply_parallax function| et_parallax_set_height function| et_apply_builder_css_parallax function| et_pb_play_overlayed_video function| et_pb_resize_section_video_bg function| et_pb_center_video function| et_pb_adjust_video_margin function| et_fix_slider_height function| et_pb_submit_newsletter function| et_fix_testimonial_inner_width function| et_pb_video_background_init function| et_animate_element function| et_process_animation_data function| et_has_animation_data function| et_get_animation_classes function| et_remove_animation function| et_remove_animation_data function| et_reinit_waypoint_modules function| et_calc_fullscreen_section function| debounced_et_apply_builder_css_parallax function| et_pb_parallax_init function| et_pb_fullwidth_header_scroll function| et_pb_search_init function| et_pb_search_percentage_custom_margin_fix function| et_pb_comments_init function| et_pb_shop_add_hover_class object| _paq function| sanitizeKey boolean| _hstc_loaded boolean| _hspb_loaded boolean| _hspb_ran object| __hsCollectedFormsDebug string| et_location_hash function| et_pb_init_woo_custom_button_icon string| waypointContextKey boolean| _hstc_ran string| __hsUserToken number| expireDateTime object| e

6 Cookies

Domain/Path Name / Value
.lillestromflytt.no/ Name: __hstc
Value: 3678895.1e51401cd11223caebf4b9777f1ed815.1705149575142.1705149575142.1705149575142.1
.lillestromflytt.no/ Name: hubspotutk
Value: 1e51401cd11223caebf4b9777f1ed815
.lillestromflytt.no/ Name: __hssrc
Value: 1
.lillestromflytt.no/ Name: __hssc
Value: 3678895.1.1705149575142
.hubspot.com/ Name: __cf_bm
Value: 0dKiEVgKoDavQcqcoXyRpHf.ef4iKt2jaHqRP9tvHIk-1705149575-1-ARQyFagT2EG3YaW4/YycmlW4qnM7Y+rDsQWn4FF9ZA3yPz0VQInSXTwftlQbNsmxK7Ly0CKUtfk7ZtmT/fZTnP8=
.hubspot.com/ Name: _cfuvid
Value: FxHgCLO.wcv_Nj28P0x_jUsO9.zio__BT777UP44vxo-1705149575465-0-604800000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ansatt.lillestromflytt.no
fonts.googleapis.com
fonts.gstatic.com
forms-eu1.hscollectedforms.net
forms-eu1.hsforms.com
js-eu1.hs-analytics.net
js-eu1.hs-banner.com
js-eu1.hs-scripts.com
js-eu1.hscollectedforms.net
track-eu1.hubspot.com
www.ansatt.lillestromflytt.no
172.65.192.122
172.65.202.201
172.65.208.22
172.65.232.43
172.65.238.60
172.65.240.166
185.126.37.31
2a00:1450:4001:813::200a
2a00:1450:4001:81c::2003
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
68297820e5ba696a23d085629a4a55d83b2a68969c86f0b3f866c66b081c8090
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
7c326f96b9af470b51c887a189b1f81d241d6beef4844b37c8add5144fa6f55d
8a097e48d6aae527e4859e8b3367b2ce71e3654a8dfa013f2d360dde46b71f91
8a5b075446341d26ecce83434c19f5cc42027c1fca25211b4eb4bf8e62ddd912
92e4b29bbef3fb8506e130b6924b33e359e401385e2a16354d72806b3e42d7a5
9ccbe8ceae9d2553c597d0a65f19928d14f42368ddd1118d69a968c2c9912161
abf308a351422c8fb7cfc7a1ecec936e744ddf02bf426bc884a0115b1c28af1a
b1bad76cc3759a006e9fec9dabe1ed1de3ac2541045162fa19df76731c4dcbdd
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cf520886e248a0fad2dffd2e44bd9ba546d0d8f5e750f182397be7d16680b20f
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
ef71c937db7d4381cd982493ff9728723d27dd44282cc5adef9e16bc7025ad26