urlscan.io logo urlscan.io
SecurityTrails logo

travel.employeeandmemberdiscounts.com Open in urlscan Pro
54.148.149.237  Public Scan

Go To Rescan Add Verdict Report
URL: https://travel.employeeandmemberdiscounts.com/
Submission: On October 24 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 2 countries across 6 domains to perform 24 HTTP transactions. The main IP is 54.148.149.237, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is travel.employeeandmemberdiscounts.com.
TLS certificate: Issued by Amazon on November 22nd 2019. Valid for: a year.
This is the only time travel.employeeandmemberdiscounts.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
14 54.148.149.237 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 13.224.194.8 16509 (AMAZON-02)
1 1 2600:1901:0:2... 15169 (GOOGLE)
1 35.201.112.186 15169 (GOOGLE)
1 35.186.194.58 15169 (GOOGLE)
1 1 13.224.194.37 16509 (AMAZON-02)
5 13.225.73.108 16509 (AMAZON-02)
1 75.2.88.188 16509 (AMAZON-02)
24 7
14    54.148.149.237 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-148-149-237.us-west-2.compute.amazonaws.com
travel.employeeandmemberdiscounts.com
1    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    13.224.194.8 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-8.fra2.r.cloudfront.net
static.accessdevelopment.com
1    2600:1901:0:2470:: (United States)

ASN15169 (GOOGLE, US)
fullstory.com
1    35.201.112.186 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 186.112.201.35.bc.googleusercontent.com
edge.fullstory.com
1    35.186.194.58 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 58.194.186.35.bc.googleusercontent.com
rs.fullstory.com
1    13.224.194.37 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-37.fra2.r.cloudfront.net
widget.intercom.io
5    13.225.73.108 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-73-108.fra2.r.cloudfront.net
js.intercomcdn.com
1    75.2.88.188 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: ad8b87a22ce463223.awsglobalaccelerator.com
api-iam.intercom.io
Domain Requested by
14 travel.employeeandmemberdiscounts.com travel.employeeandmemberdiscounts.com
5 js.intercomcdn.com widget.intercom.io
js.intercomcdn.com
1 api-iam.intercom.io js.intercomcdn.com
1 widget.intercom.io 1 redirects
1 rs.fullstory.com fullstory.com
1 edge.fullstory.com travel.employeeandmemberdiscounts.com
1 fullstory.com 1 redirects
1 static.accessdevelopment.com travel.employeeandmemberdiscounts.com
1 cdnjs.cloudflare.com travel.employeeandmemberdiscounts.com
24 9

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
www.facebook.com
static.adcrws.com
Subject Issuer Validity Valid
travel.employeeandmemberdiscounts.com
Amazon		 2019-11-22 -
2020-12-22		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-10-21 -
2021-10-20		 a year crt.sh
*.accessdevelopment.com
Amazon		 2020-02-10 -
2021-03-10		 a year crt.sh
edge.fullstory.com
GTS CA 1D2		 2020-08-29 -
2020-11-27		 3 months crt.sh
*.fullstory.com
Let's Encrypt Authority X3		 2020-09-30 -
2020-12-29		 3 months crt.sh
*.intercomcdn.com
Amazon		 2020-03-29 -
2021-04-29		 a year crt.sh
*.intercom.com
Amazon		 2020-05-13 -
2021-06-13		 a year crt.sh

This page contains 2 frames:

Primary Page: https://travel.employeeandmemberdiscounts.com/
Frame ID: 731AF8566B3CAF835265306B720952FE
Requests: 19 HTTP requests in this frame

Frame: https://js.intercomcdn.com/frame-modern.b41f8090.js
Frame ID: 7DAE64B520EB97B85E4F76FCBAE34091
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

24
Requests

100 %
HTTPS

22 %
IPv6

6
Domains

9
Subdomains

7
IPs

2
Countries

786 kB
Transfer

1905 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15
  • https://fullstory.com/s/fs.js HTTP 301
  • https://edge.fullstory.com/s/fs.js
Request Chain 17
  • https://widget.intercom.io/widget/h5bkusww HTTP 302
  • https://js.intercomcdn.com/shim.latest.js

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
travel.employeeandmemberdiscounts.com/ 		6 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Next.js 6.1.1
Resource Hash
04704462602461463bdec592556db3e5b3bd124993afa03928e80bff01af95f9

Request headers

:method
GET
:authority
travel.employeeandmemberdiscounts.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Sat, 24 Oct 2020 00:39:48 GMT
content-type
text/html; charset=utf-8
content-length
5970
set-cookie
AWSALB=MfCZg0DVImjIA7CxFnDB6VseHF9xY8+q4Fy09RWr7EkRr8P/1O+ZEKO1h/RarIRa+SDJQHqfVK9172jmh+8JTvTVCD/YXhoBIqAE9AFbo0vG0OzVW9q280VR8hgV; Expires=Sat, 31 Oct 2020 00:39:48 GMT; Path=/ AWSALBCORS=MfCZg0DVImjIA7CxFnDB6VseHF9xY8+q4Fy09RWr7EkRr8P/1O+ZEKO1h/RarIRa+SDJQHqfVK9172jmh+8JTvTVCD/YXhoBIqAE9AFbo0vG0OzVW9q280VR8hgV; Expires=Sat, 31 Oct 2020 00:39:48 GMT; Path=/; SameSite=None; Secure connect.sid=s%3AfatCpjJLbI7ThlpipJ9vMmr3gvUN_0tk.iZku9G2Ni7mOFUKTV9WbHwLOTlABLR0shxdS4tLvcRQ; Path=/; Expires=Sat, 24 Oct 2020 00:54:48 GMT; HttpOnly
x-powered-by
Next.js 6.1.1
etag
"1752-DFWIfjNQA+kd/+dWD0vm03FHj3g"
index.js
travel.employeeandmemberdiscounts.com/_next/310760c4-dc6b-4653-b3bc-b36890c9ed35/page/ 		9 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://travel.employeeandmemberdiscounts.com/_next/310760c4-dc6b-4653-b3bc-b36890c9ed35/page/index.js
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
604f21283b230eb21016639fcbdf9b9a14c5f929c45c77931cec988084e49b1a

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Tue, 20 Oct 2020 16:06:18 GMT
x-powered-by
Express
etag
W/"244e-17546c2e095"
content-type
application/javascript; charset=UTF-8
status
200
cache-control
public, max-age=31536000, immutable
accept-ranges
bytes
content-length
9294
_app.js
travel.employeeandmemberdiscounts.com/_next/310760c4-dc6b-4653-b3bc-b36890c9ed35/page/ 		3 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://travel.employeeandmemberdiscounts.com/_next/310760c4-dc6b-4653-b3bc-b36890c9ed35/page/_app.js
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
50e7567258fb02e4db7f54e5e37aecdc3790e7e7656f6732e5a0512946cc45ae

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Tue, 20 Oct 2020 16:06:18 GMT
x-powered-by
Express
etag
W/"cf4-17546c2e095"
content-type
application/javascript; charset=UTF-8
status
200
cache-control
public, max-age=31536000, immutable
accept-ranges
bytes
content-length
3316
_error.js
travel.employeeandmemberdiscounts.com/_next/310760c4-dc6b-4653-b3bc-b36890c9ed35/page/ 		5 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://travel.employeeandmemberdiscounts.com/_next/310760c4-dc6b-4653-b3bc-b36890c9ed35/page/_error.js
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
3b4520ba588aa39b8221cf28cd3c43a687b2d980e93ca90ff80f9a409198d269

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Tue, 20 Oct 2020 16:06:18 GMT
x-powered-by
Express
etag
W/"12f2-17546c2e095"
content-type
application/javascript; charset=UTF-8
status
200
cache-control
public, max-age=31536000, immutable
accept-ranges
bytes
content-length
4850
main-9850222b933ac46e6fcc.js
travel.employeeandmemberdiscounts.com/_next/static/commons/ 		225 KB
226 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://travel.employeeandmemberdiscounts.com/_next/static/commons/main-9850222b933ac46e6fcc.js
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
7d76bed51a9a3890f245ccf15cb8aec096f69a4a49b64ff7688cdbedc75ff397

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Tue, 20 Oct 2020 16:06:18 GMT
x-powered-by
Express
etag
W/"38586-17546c2e095"
content-type
application/javascript; charset=UTF-8
status
200
cache-control
public, max-age=31536000, immutable
accept-ranges
bytes
content-length
230790
styles.css
travel.employeeandmemberdiscounts.com/static/stylesheets/ 		12 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://travel.employeeandmemberdiscounts.com/static/stylesheets/styles.css
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
f452b0ceb25d02df2ac73197d7c97710e1e48478208b0b7e805ab74d14e0158f

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Wed, 10 Jun 2020 21:51:12 GMT
x-powered-by
Express
etag
W/"313c-172a0373480"
content-type
text/css; charset=UTF-8
status
200
cache-control
public, max-age=0
accept-ranges
bytes
content-length
12604
material-design-iconic-font.min.css
cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/ 		69 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
178557
x-via
cfworker/kv
status
200
content-length
5845
cf-request-id
05f9a52e250000dfbfb99c5000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:12:09 GMT
server
cloudflare
etag
"5eb03ed9-1149f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5CQ21k8rYN5JqdX9gAdlqv9TFqyvWFcXfcSJVHh%2BOsrLEEHccBFSSBIpaS8QzGTxee9xpBxS7JIntt%2FZnZ69xPr%2FNXTEzhcV0YpFIY21B%2BdmWaE%2FmH%2Bc7NRBuuHlhLqqbw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5e6fa4903915dfbf-FRA
expires
Thu, 14 Oct 2021 00:39:48 GMT
original.png
static.accessdevelopment.com/program/logo/64e095fe763fc62418378753f9402623bea9e227/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.accessdevelopment.com/program/logo/64e095fe763fc62418378753f9402623bea9e227/original.png
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.194.8 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-194-8.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
019646763686e88edf28269dc6f3109dec5c548c6336c06e32fac99e6ee4353a

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sat, 24 Oct 2020 00:39:50 GMT
via
1.1 d8328954e51c0912a8419c1a67cea1dc.cloudfront.net (CloudFront)
last-modified
Tue, 05 May 2020 17:51:31 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
etag
"e3bf4594dd3cc10bc45a172fb377294c"
x-cache
Miss from cloudfront
content-type
image/png
status
200
accept-ranges
bytes
content-length
4483
x-amz-cf-id
MODPqXuCQ9XcB_eIf0jlRGwqJt2bstdBWWGjQ6j4n1YzJ0IQc43zjA==
Instagram.png
travel.employeeandmemberdiscounts.com/static/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://travel.employeeandmemberdiscounts.com/static/images/Instagram.png
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
98d2931d79019674611d651855411ea72f15b7c5ecc63ac486b822a55980c789

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Wed, 10 Jun 2020 21:51:12 GMT
x-powered-by
Express
etag
W/"1e96-172a0373480"
content-type
image/png
status
200
cache-control
public, max-age=0
accept-ranges
bytes
content-length
7830
Facebook.png
travel.employeeandmemberdiscounts.com/static/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://travel.employeeandmemberdiscounts.com/static/images/Facebook.png
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
43d1621f337a0b59c252578ab204db0a847d2fbf90c41c6e8e7a694889e5a559

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Wed, 10 Jun 2020 21:51:12 GMT
x-powered-by
Express
etag
W/"714-172a0373480"
content-type
image/png
status
200
cache-control
public, max-age=0
accept-ranges
bytes
content-length
1812
lasVegas.jpg
travel.employeeandmemberdiscounts.com/static/images/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://travel.employeeandmemberdiscounts.com/static/images/lasVegas.jpg
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
1f72c2a168a274b3766e45a3b60eb1c554fe3c78a863720bf4f278d971f573d1

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Wed, 10 Jun 2020 21:51:12 GMT
x-powered-by
Express
etag
W/"4058-172a0373480"
content-type
image/jpeg
status
200
cache-control
public, max-age=0
accept-ranges
bytes
content-length
16472
newYork.jpg
travel.employeeandmemberdiscounts.com/static/images/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://travel.employeeandmemberdiscounts.com/static/images/newYork.jpg
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
5db21d280a80ba79b132a10abfbc06ad99b5bc8f05292e89819aa03600aacad3

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Wed, 10 Jun 2020 21:51:12 GMT
x-powered-by
Express
etag
W/"210d-172a0373480"
content-type
image/jpeg
status
200
cache-control
public, max-age=0
accept-ranges
bytes
content-length
8461
chicago.jpg
travel.employeeandmemberdiscounts.com/static/images/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://travel.employeeandmemberdiscounts.com/static/images/chicago.jpg
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
cb5908093cde46ee93a192febd7f78eb5a3e45cea28013c104e8f325ed5b8928

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Wed, 10 Jun 2020 21:51:12 GMT
x-powered-by
Express
etag
W/"30af-172a0373480"
content-type
image/jpeg
status
200
cache-control
public, max-age=0
accept-ranges
bytes
content-length
12463
sanDiego.jpg
travel.employeeandmemberdiscounts.com/static/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://travel.employeeandmemberdiscounts.com/static/images/sanDiego.jpg
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
a7c7ed771484639ec8ee62c9f927656111e50a6d6b2debaf61d7a44b8506d052

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Wed, 10 Jun 2020 21:51:12 GMT
x-powered-by
Express
etag
W/"265c-172a0373480"
content-type
image/jpeg
status
200
cache-control
public, max-age=0
accept-ranges
bytes
content-length
9820
waltDisneyWorld.jpg
travel.employeeandmemberdiscounts.com/static/images/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://travel.employeeandmemberdiscounts.com/static/images/waltDisneyWorld.jpg
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
c70de86b559ca9b28b9b6dd3d507654e9e32e6bed1c0f8e8b1d65601ddcc716b

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Wed, 10 Jun 2020 21:51:12 GMT
x-powered-by
Express
etag
W/"4376-172a0373480"
content-type
image/jpeg
status
200
cache-control
public, max-age=0
accept-ranges
bytes
content-length
17270
disneyland.jpg
travel.employeeandmemberdiscounts.com/static/images/ 		28 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://travel.employeeandmemberdiscounts.com/static/images/disneyland.jpg
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.149.237 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-148-149-237.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
9b43e834c7c8004591e7f84fe45275772aac601550a68293b8b34f74c3317a73

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:39:48 GMT
last-modified
Wed, 10 Jun 2020 21:51:12 GMT
x-powered-by
Express
etag
W/"708d-172a0373480"
content-type
image/jpeg
status
200
cache-control
public, max-age=0
accept-ranges
bytes
content-length
28813
fs.js
edge.fullstory.com/s/
Redirect Chain
  • https://fullstory.com/s/fs.js
  • https://edge.fullstory.com/s/fs.js
203 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://edge.fullstory.com/s/fs.js
Requested by
Host: travel.employeeandmemberdiscounts.com
URL: https://travel.employeeandmemberdiscounts.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.112.186 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
186.112.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
ac725768b8b58e82bffa62a905a3726696d00691af6235b9c398aa99e8dcb716

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:33:51 GMT
content-encoding
gzip
age
358
x-guploader-uploadid
ABg5-UxV9CjR3vC4Sn8V0RzdRTpMSETYFZTe5jY0r1Yriu-hEidfBNaMInKRwFgA-UixePgb6wsKxRfeWwPQtUxct_wDJEwUMQ
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
61413
last-modified
Tue, 13 Oct 2020 20:15:18 GMT
server
UploadServer
etag
"f1de6b7f75bb6a85f0fa0715e38a8dd8"
x-goog-hash
crc32c=Y2h+ug==, md5=8d5rf3W7aoXw+gcV44qN2A==
x-goog-generation
1602620118872434
access-control-allow-origin
*
cache-control
public, max-age=600,no-transform
x-goog-stored-content-length
61413
accept-ranges
bytes
content-type
application/javascript
expires
Sat, 24 Oct 2020 00:43:51 GMT

Redirect headers

date
Sun, 11 Oct 2020 23:37:11 GMT
via
1.1 google
age
1040558
status
301
location
https://edge.fullstory.com/s/fs.js
access-control-allow-origin
*
cache-control
public, max-age=31536000
strict-transport-security
max-age=63072000
timing-allow-origin
*
alt-svc
clear
content-length
0
page
rs.fullstory.com/rec/ 		67 B
257 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://rs.fullstory.com/rec/page
Requested by
Host: fullstory.com
URL: https://fullstory.com/s/fs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.194.58 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
58.194.186.35.bc.googleusercontent.com
Software
/
Resource Hash
99d615a76b4a56101d76dfb78e66417838f08589f5b5a681412b323c5465e56a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Sat, 24 Oct 2020 00:39:49 GMT
via
1.1 google
x-content-type-options
nosniff
status
202
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://travel.employeeandmemberdiscounts.com
access-control-allow-credentials
true
alt-svc
clear
content-length
67
shim.latest.js
js.intercomcdn.com/
Redirect Chain
  • https://widget.intercom.io/widget/h5bkusww
  • https://js.intercomcdn.com/shim.latest.js
11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.intercomcdn.com/shim.latest.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.73.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-73-108.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0cb006cbaf32ec0f7467363c709501ffd556143d8c11c81fbcea86f3db9abcd6

Request headers

Referer
https://travel.employeeandmemberdiscounts.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:35:57 GMT
content-encoding
gzip
age
233
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
content-length
4220
last-modified
Fri, 23 Oct 2020 12:05:47 GMT
server
AmazonS3
etag
"1c236ad9e4182789227a0a188dee30af"
content-type
application/javascript; charset=UTF-8
via
1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
cache-control
max-age=300, s-maxage=300, public
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
8xuQ9Kt2WEmXzNXsjRiKyn8Vl_c_oYuooXNFC9pKssqyYW_Hv8bP_A==

Redirect headers

date
Fri, 23 Oct 2020 23:12:05 GMT
via
1.1 41f60102fc29156bc5001d6646f75c02.cloudfront.net (CloudFront)
server
AmazonS3
age
5265
status
302
x-cache
Hit from cloudfront
location
https://js.intercomcdn.com/shim.latest.js
x-amz-cf-pop
FRA2-C1
content-length
0
x-amz-cf-id
qkvL3qCLdiy9KW7VtaRZ7rEYHC80k4j8TKWjv6WDu3T3ZZbpssnovA==
frame-modern.b41f8090.js
js.intercomcdn.com/ Frame 7DAE 		233 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.intercomcdn.com/frame-modern.b41f8090.js
Requested by
Host: widget.intercom.io
URL: https://widget.intercom.io/widget/h5bkusww
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.73.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-73-108.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a23c493d4503c66266703f0897e8ed56e74024a60e0962eb388659a77f9f3053

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:05:49 GMT
content-encoding
gzip
age
2041
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
content-length
64415
last-modified
Fri, 23 Oct 2020 11:56:32 GMT
server
AmazonS3
etag
"a981ff815fb4c85175d027b2b01c0cdf"
content-type
application/javascript; charset=UTF-8
via
1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
cache-control
max-age=31536000, s-maxage=7200, public
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
YQWMHiDVHA8ZdWlIwh7I_G8msre6cza1mo5rbTIrkjILGIXZYPYy1A==
vendor-modern.f585e527.js
js.intercomcdn.com/ Frame 7DAE 		123 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.intercomcdn.com/vendor-modern.f585e527.js
Requested by
Host: widget.intercom.io
URL: https://widget.intercom.io/widget/h5bkusww
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.73.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-73-108.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f2115d67889ef9ee779fd47c169d0057c076767844771a2eb6fe918f09760e61

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:05:49 GMT
content-encoding
gzip
age
2041
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
content-length
38303
last-modified
Fri, 23 Oct 2020 16:18:23 GMT
server
AmazonS3
etag
"af39b5792e8c69d67c99c9ff6155bb17"
content-type
application/javascript; charset=UTF-8
via
1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
cache-control
max-age=31536000, s-maxage=7200, public
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
PKiO4hETiqpurih_LgcPUwSl0hg4yV7mysavB1AKeVDoY-Cu_unj3A==
ping
api-iam.intercom.io/messenger/web/ Frame 7DAE 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-iam.intercom.io/messenger/web/ping
Requested by
Host: js.intercomcdn.com
URL: https://js.intercomcdn.com/frame-modern.b41f8090.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.2.88.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ad8b87a22ce463223.awsglobalaccelerator.com
Software
nginx /
Resource Hash
0c73537137d523ce0720823fbf8c917f744c91ecd8d23d8147476ec541651a36
Security Headers
Name Value
Strict-Transport-Security max-age=31556952; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Sat, 24 Oct 2020 00:39:50 GMT
content-encoding
gzip
x-ami-version
ami-0aa9e68db6689628c
status
200, 200 OK
strict-transport-security
max-age=31556952; includeSubDomains; preload
vary
Accept-Encoding
x-xss-protection
1; mode=block
x-request-id
000gb7efqnmid3jf4h50
x-runtime
0.236815
server
nginx
x-frame-options
SAMEORIGIN
etag
W/"0c73537137d523ce0720823fbf8c917f"
x-ratelimit-remaining
19999
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://travel.employeeandmemberdiscounts.com
x-intercom-version
edd8c1d27d1f98095005fa5196cf6bc3bebec727
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-ratelimit-reset
1603500000
x-ratelimit-limit
20000
access-control-allow-headers
Content-Type
x-content-type-options
nosniff
vendors~app-modern.e30834a1.js
js.intercomcdn.com/ Frame 7DAE 		322 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.intercomcdn.com/vendors~app-modern.e30834a1.js
Requested by
Host: js.intercomcdn.com
URL: https://js.intercomcdn.com/frame-modern.b41f8090.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.73.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-73-108.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
47bcab33750c69b3b7e6ea010cd43c5244deaf85ac6b6428dbaf4abb29e428b9

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 23 Oct 2020 23:29:55 GMT
content-encoding
gzip
age
4202
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
content-length
98499
last-modified
Fri, 23 Oct 2020 16:18:23 GMT
server
AmazonS3
etag
"fa6a80ed5d1777bdeefdf516c23ede3f"
content-type
application/javascript; charset=UTF-8
via
1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
cache-control
max-age=31536000, s-maxage=7200, public
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
r3cXOsbPW8VxBCOpNL_H-1-5jXQRLIFdzIJ1tlAvi0iZOJ8EYogPLA==
app-modern.1c40b156.js
js.intercomcdn.com/ Frame 7DAE 		574 KB
141 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.intercomcdn.com/app-modern.1c40b156.js
Requested by
Host: js.intercomcdn.com
URL: https://js.intercomcdn.com/frame-modern.b41f8090.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.73.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-73-108.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
73d477b7b5a89b8db9bc9b2701b26530ebe66ba4d95abd7020effd406921308f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 24 Oct 2020 00:05:52 GMT
content-encoding
gzip
age
2045
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
content-length
143922
last-modified
Fri, 23 Oct 2020 11:56:32 GMT
server
AmazonS3
etag
"bfda40af43dc8568187077b7d6c23a7b"
content-type
application/javascript; charset=UTF-8
via
1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
cache-control
max-age=31536000, s-maxage=7200, public
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
hFfMAqkO5mC3dTomFN5YYfEPH88c4fPezXIVfg3RdT8h3EurqgXKNg==

Verdicts & Comments Add Verdict or Comment

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| __NEXT_DATA__ object| module function| __NEXT_REGISTER_PAGE function| __NEXT_REGISTER_CHUNK function| webpackJsonp object| __core-js_shared__ object| next boolean| _fs_debug string| _fs_host string| _fs_org string| _fs_namespace function| FS object| intercomSettings function| Intercom string| _fs_loaded function| _fs_shutdown function| __intercomAssignLocation

2 Cookies

Domain/Path Name / Value
travel.employeeandmemberdiscounts.com/ Name: AWSALBCORS
Value: PLuiVULEzu6vvO5/boQKDDbKL1uUBA15om5udf526QmR1DTPWOVUMgtDd0pZCWPXJo84HDAXyTKspYeojS9+U9MS5Fw1hw1rANqLNUZrHFPM8dLQtB4ewEdeonPk
travel.employeeandmemberdiscounts.com/ Name: AWSALB
Value: PLuiVULEzu6vvO5/boQKDDbKL1uUBA15om5udf526QmR1DTPWOVUMgtDd0pZCWPXJo84HDAXyTKspYeojS9+U9MS5Fw1hw1rANqLNUZrHFPM8dLQtB4ewEdeonPk

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-iam.intercom.io
cdnjs.cloudflare.com
edge.fullstory.com
fullstory.com
js.intercomcdn.com
rs.fullstory.com
static.accessdevelopment.com
travel.employeeandmemberdiscounts.com
widget.intercom.io
13.224.194.37
13.224.194.8
13.225.73.108
2600:1901:0:2470::
2606:4700::6810:125e
35.186.194.58
35.201.112.186
54.148.149.237
75.2.88.188
019646763686e88edf28269dc6f3109dec5c548c6336c06e32fac99e6ee4353a
04704462602461463bdec592556db3e5b3bd124993afa03928e80bff01af95f9
0c73537137d523ce0720823fbf8c917f744c91ecd8d23d8147476ec541651a36
0cb006cbaf32ec0f7467363c709501ffd556143d8c11c81fbcea86f3db9abcd6
1f72c2a168a274b3766e45a3b60eb1c554fe3c78a863720bf4f278d971f573d1
3b4520ba588aa39b8221cf28cd3c43a687b2d980e93ca90ff80f9a409198d269
43d1621f337a0b59c252578ab204db0a847d2fbf90c41c6e8e7a694889e5a559
47bcab33750c69b3b7e6ea010cd43c5244deaf85ac6b6428dbaf4abb29e428b9
50e7567258fb02e4db7f54e5e37aecdc3790e7e7656f6732e5a0512946cc45ae
5db21d280a80ba79b132a10abfbc06ad99b5bc8f05292e89819aa03600aacad3
604f21283b230eb21016639fcbdf9b9a14c5f929c45c77931cec988084e49b1a
73d477b7b5a89b8db9bc9b2701b26530ebe66ba4d95abd7020effd406921308f
7d76bed51a9a3890f245ccf15cb8aec096f69a4a49b64ff7688cdbedc75ff397
98d2931d79019674611d651855411ea72f15b7c5ecc63ac486b822a55980c789
99d615a76b4a56101d76dfb78e66417838f08589f5b5a681412b323c5465e56a
9b43e834c7c8004591e7f84fe45275772aac601550a68293b8b34f74c3317a73
a23c493d4503c66266703f0897e8ed56e74024a60e0962eb388659a77f9f3053
a7c7ed771484639ec8ee62c9f927656111e50a6d6b2debaf61d7a44b8506d052
ac725768b8b58e82bffa62a905a3726696d00691af6235b9c398aa99e8dcb716
c70de86b559ca9b28b9b6dd3d507654e9e32e6bed1c0f8e8b1d65601ddcc716b
cb5908093cde46ee93a192febd7f78eb5a3e45cea28013c104e8f325ed5b8928
dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56
f2115d67889ef9ee779fd47c169d0057c076767844771a2eb6fe918f09760e61
f452b0ceb25d02df2ac73197d7c97710e1e48478208b0b7e805ab74d14e0158f