Submitted URL: https://banner.purplebear.co/
Effective URL: https://sso.plumpopup.com/sign-up/app/custom
Submission: On November 13 via api from US — Scanned from DE

Summary

This website contacted 12 IPs in 3 countries across 8 domains to perform 21 HTTP transactions. The main IP is 24.199.126.95, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is sso.plumpopup.com.
TLS certificate: Issued by E5 on November 2nd 2024. Valid for: 3 months.
This is the only time sso.plumpopup.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2 2606:4700:303... 13335 (CLOUDFLAR...)
1 8 24.199.126.95 14061 (DIGITALOC...)
2 138.199.37.231 60068 (CDN77 _)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 18.66.102.53 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 13.33.187.74 16509 (AMAZON-02)
1 18.66.112.15 16509 (AMAZON-02)
1 52.49.68.235 16509 (AMAZON-02)
21 12
Apex Domain
Subdomains
Transfer
9 plumpopup.com
sso.plumpopup.com
app.plumpopup.com
234 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 1083
script.hotjar.com — Cisco Umbrella Rank: 1463
63 KB
2 hotjar.io
vc.hotjar.io — Cisco Umbrella Rank: 3728
metrics.hotjar.io — Cisco Umbrella Rank: 10814
315 B
2 gstatic.com
www.gstatic.com
fonts.gstatic.com
249 KB
2 google.com
www.google.com — Cisco Umbrella Rank: 4
969 B
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 55
ajax.googleapis.com — Cisco Umbrella Rank: 478
34 KB
2 bunny.net
fonts.bunny.net — Cisco Umbrella Rank: 11595
18 KB
2 purplebear.co
banner.purplebear.co
3 KB
21 8
Domain Requested by
8 sso.plumpopup.com 1 redirects sso.plumpopup.com
2 script.hotjar.com static.hotjar.com
script.hotjar.com
2 www.google.com sso.plumpopup.com
www.gstatic.com
2 fonts.bunny.net sso.plumpopup.com
fonts.bunny.net
2 banner.purplebear.co 2 redirects
1 metrics.hotjar.io static.hotjar.com
1 vc.hotjar.io script.hotjar.com
1 fonts.gstatic.com fonts.googleapis.com
1 static.hotjar.com sso.plumpopup.com
1 www.gstatic.com www.google.com
1 app.plumpopup.com sso.plumpopup.com
1 ajax.googleapis.com sso.plumpopup.com
1 fonts.googleapis.com sso.plumpopup.com
21 13

This site contains links to these domains. Also see Links.

Domain
plumpopup.com
Subject Issuer Validity Valid
sso.plumpopup.com
E5
2024-11-02 -
2025-01-31
3 months crt.sh
fonts.bunny.net
R10
2024-10-02 -
2024-12-31
3 months crt.sh
upload.video.google.com
WR2
2024-10-21 -
2025-01-13
3 months crt.sh
*.google.com
WR2
2024-10-21 -
2025-01-13
3 months crt.sh
plumpopup.com
WE1
2024-10-25 -
2025-01-23
3 months crt.sh
*.gstatic.com
WR2
2024-10-21 -
2025-01-13
3 months crt.sh
*.hotjar.com
Amazon RSA 2048 M03
2024-05-22 -
2025-06-20
a year crt.sh
*.hotjar.io
Amazon ECDSA 256 M02
2024-02-07 -
2025-03-08
a year crt.sh

This page contains 2 frames:

Primary Page: https://sso.plumpopup.com/sign-up/app/custom
Frame ID: EDC1621C2969E7F20E344618FBAC3F5C
Requests: 20 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcFPPwpAAAAALLctj40hMhTFRlGFrpR-sl5JlrK&co=aHR0cHM6Ly9zc28ucGx1bXBvcHVwLmNvbTo0NDM.&hl=de&v=-ZG7BC9TxCVEbzIO2m429usb&size=invisible&cb=4d1jvdurcpyb
Frame ID: 849969F15F4FAAEFC60A56751201D0D1
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Sign Up Page

Page URL History Show full URLs

  1. https://banner.purplebear.co/ HTTP 302
    https://banner.purplebear.co/login/form HTTP 302
    https://sso.plumpopup.com/sign-up/plumpopup/custom HTTP 302
    https://sso.plumpopup.com/sign-up/app/custom Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • <div[^>]+class="g-recaptcha"
  • /recaptcha/api\.js

Page Statistics

21
Requests

100 %
HTTPS

54 %
IPv6

8
Domains

13
Subdomains

12
IPs

3
Countries

598 kB
Transfer

1164 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://banner.purplebear.co/ HTTP 302
    https://banner.purplebear.co/login/form HTTP 302
    https://sso.plumpopup.com/sign-up/plumpopup/custom HTTP 302
    https://sso.plumpopup.com/sign-up/app/custom Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request custom
sso.plumpopup.com/sign-up/app/
Redirect Chain
  • https://banner.purplebear.co/
  • https://banner.purplebear.co/login/form
  • https://sso.plumpopup.com/sign-up/plumpopup/custom
  • https://sso.plumpopup.com/sign-up/app/custom
21 KB
22 KB
Document
General
Full URL
https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
24.199.126.95 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.20.1 / PHP/8.1.8
Resource Hash
e9581351456472be5efbca7e269889aa54d990d73a83c5cc51e24a7e504bbf81

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control
no-cache, private
content-type
text/html; charset=UTF-8
date
Wed, 13 Nov 2024 05:38:53 GMT
server
nginx/1.20.1
x-powered-by
PHP/8.1.8

Redirect headers

cache-control
no-cache, private
content-type
text/html; charset=utf-8
date
Wed, 13 Nov 2024 05:38:53 GMT
location
https://sso.plumpopup.com/sign-up/app/custom
server
nginx/1.20.1
x-powered-by
PHP/8.1.8
css
fonts.bunny.net/
2 KB
1 KB
Stylesheet
General
Full URL
https://fonts.bunny.net/css?family=Nunito
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.199.37.231 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
138-199-37-231.bunnyinfra.net
Software
BunnyCDN-DE1-863 /
Resource Hash
8d84078f40e0527222e4d8a62d0a5baeaa120cc777ad4a3111449770af9b7088

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/

Response headers

cdn-status
200
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding
br
alt-svc
h3=":443"
date
Wed, 13 Nov 2024 05:38:54 GMT
last-modified
Sat, 19 Oct 2024 12:34:52 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-requestpullcode
200
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-cachedat
10/19/2024 12:34:52
cache-control
public, max-age=2592000
cdn-requestpullsuccess
True
cdn-requesttime
9
cdn-uid
3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f
cdn-requestid
2a6656c3c5cff94b3ea0611583494e49
cdn-pullzone
781720
cdn-proxyver
1.04
access-control-allow-origin
*
cdn-edgestorageid
863
server
BunnyCDN-DE1-863
cdn-requestcountrycode
DE
css2
fonts.googleapis.com/
2 KB
892 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Outfit:wght@400;500;600&display=swap
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6820663943186119d382972f0be4fc28c518467fdb6e8bb1d563eba5cd4c9b80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 05:38:54 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 05:38:54 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 13 Nov 2024 05:38:54 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.11.3/
94 KB
33 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/

Response headers

content-encoding
gzip
age
38774
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Wed, 12 Nov 2025 18:52:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 12 Nov 2024 18:52:40 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
33507
x-xss-protection
0
server
sffe
style.css
sso.plumpopup.com/assets/
16 KB
16 KB
Stylesheet
General
Full URL
https://sso.plumpopup.com/assets/style.css?ver=1731476333
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
24.199.126.95 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
2a0721d6b036d8ad5ed149b38e7ce9f5c3fb8daf34ed9f1ae17936997a71ef2c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/sign-up/app/custom

Response headers

accept-ranges
bytes
content-length
16195
date
Wed, 13 Nov 2024 05:38:54 GMT
etag
"66fe63ec-3f43"
content-type
text/css
last-modified
Thu, 03 Oct 2024 09:29:16 GMT
server
nginx/1.20.1
api.js
www.google.com/recaptcha/
1 KB
969 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2108ac60bc352011468c22c5405ad3d88912de0a4d76200e8869e7a4d7ff0e07
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/

Response headers

cache-control
private, max-age=300
content-encoding
gzip
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 05:38:54 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date
Wed, 13 Nov 2024 05:38:54 GMT
x-xss-protection
0
content-type
text/javascript; charset=utf-8
server
ESF
x-frame-options
SAMEORIGIN
app-67dcdfd2.css
sso.plumpopup.com/build/assets/
188 KB
188 KB
Stylesheet
General
Full URL
https://sso.plumpopup.com/build/assets/app-67dcdfd2.css
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
24.199.126.95 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
67dcdfd27816d620001a74c99f7dd572a1736b6348686a55a72202a82af4a480

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/sign-up/app/custom

Response headers

accept-ranges
bytes
content-length
192281
date
Wed, 13 Nov 2024 05:38:54 GMT
etag
"671a4bc3-2ef19"
content-type
text/css
last-modified
Thu, 24 Oct 2024 13:29:39 GMT
server
nginx/1.20.1
password_validation-3e2fe295.js
sso.plumpopup.com/build/assets/
3 KB
3 KB
Script
General
Full URL
https://sso.plumpopup.com/build/assets/password_validation-3e2fe295.js
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
24.199.126.95 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
2d6af2744f6236e68977e638220cf3ba66a1735194fd3a3a0b926c8888d9fe85

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://sso.plumpopup.com
Referer
https://sso.plumpopup.com/sign-up/app/custom

Response headers

accept-ranges
bytes
content-length
2746
date
Wed, 13 Nov 2024 05:38:54 GMT
etag
"671a4bc3-aba"
content-type
application/javascript; charset=utf-8
last-modified
Thu, 24 Oct 2024 13:29:39 GMT
server
nginx/1.20.1
partners-ca2d34d4.js
sso.plumpopup.com/build/assets/
599 B
744 B
Script
General
Full URL
https://sso.plumpopup.com/build/assets/partners-ca2d34d4.js
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
24.199.126.95 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
e9930d514c6eee2ece6ec73946c447f68f416bbcab273a8e230a5b409e06a57d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://sso.plumpopup.com
Referer
https://sso.plumpopup.com/sign-up/app/custom

Response headers

accept-ranges
bytes
content-length
599
date
Wed, 13 Nov 2024 05:38:54 GMT
etag
"671a4bc3-257"
content-type
application/javascript; charset=utf-8
last-modified
Thu, 24 Oct 2024 13:29:39 GMT
server
nginx/1.20.1
rating-star.svg
sso.plumpopup.com/assets/img/
2 KB
2 KB
Image
General
Full URL
https://sso.plumpopup.com/assets/img/rating-star.svg
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
24.199.126.95 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
134b7a040348e9b097390a19cd52dd0919c3874505b57be065fbac35ab5e49b0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/sign-up/app/custom

Response headers

accept-ranges
bytes
content-length
1543
date
Wed, 13 Nov 2024 05:38:54 GMT
etag
"66cd915f-607"
content-type
image/svg+xml
last-modified
Tue, 27 Aug 2024 08:42:07 GMT
server
nginx/1.20.1
xjJUaTK39Os4reQXiTexLZpgGmWP8yAsYD8p5hAc.svg
app.plumpopup.com/storage/
416 B
941 B
Image
General
Full URL
https://app.plumpopup.com/storage/xjJUaTK39Os4reQXiTexLZpgGmWP8yAsYD8p5hAc.svg
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::ac43:a141 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0884bcd0d34672b0556ba634c4f259ef5f6e5d6217d2d01f262ed28201d55e6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
REVALIDATED
etag
W/"66449e8b-1a0"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V0G5wYJ1tUcvuujzNFb7XMXn5KFnqBYciWIFPjPtyXkyvQ5Cu1e81Cji3Ix4zb1EH72CM63Pv8Ue%2FleXyjoZdFmy2m2LUnApVHYqLVOfUyCUSVFPe8KlVLUnMH1CZ%2FDGb1FX98yxkrZBisylAwXo%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e1c6b182b632ba3-FRA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=8025&sent=11&recv=12&lost=0&retrans=4&sent_bytes=8303&recv_bytes=2327&delivery_rate=349060&cwnd=252&unsent_bytes=0&cid=1260368ec3482233&ts=796&x=0"
date
Wed, 13 Nov 2024 05:38:55 GMT
content-type
image/svg+xml
last-modified
Wed, 15 May 2024 11:37:47 GMT
vary
Accept-Encoding
server
cloudflare
recaptcha__de.js
www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/
547 KB
217 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5abe2a12140edf2387d5be35225df3caa4f0f0a05d8f5614008c8cc90af4a156
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://sso.plumpopup.com
Referer
https://sso.plumpopup.com/

Response headers

content-encoding
gzip
age
33134
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options
nosniff
expires
Wed, 12 Nov 2025 20:26:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 12 Nov 2024 20:26:41 GMT
last-modified
Tue, 22 Oct 2024 00:01:33 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges
bytes
access-control-allow-origin
*
content-length
222594
x-xss-protection
0
server
sffe
hotjar-3840045.js
static.hotjar.com/c/
13 KB
6 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-3840045.js?sv=6
Requested by
Host: sso.plumpopup.com
URL: https://sso.plumpopup.com/sign-up/app/custom
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-53.fra56.r.cloudfront.net
Software
/
Resource Hash
25f924349a6600ba648162906c08b331fb27438e1dce1f48be98d6347c63b189
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/

Response headers

content-encoding
br
etag
W/d1816769da3b65c3719bd741a86e56db
age
25
x-content-type-options
nosniff
x-cache-hit
1
x-cache
Hit from cloudfront
x-amz-cf-id
T5N6vnT660GJCInooY1wqUkQlYIrbKm49176rN05kkLVcVLHiDBzlA==
date
Wed, 13 Nov 2024 05:38:30 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
max-age=60
cross-origin-resource-policy
cross-origin
via
1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
FRA56-P2
QGYvz_MVcBeNP4NJtEtq.woff2
fonts.gstatic.com/s/outfit/v11/
32 KB
32 KB
Font
General
Full URL
https://fonts.gstatic.com/s/outfit/v11/QGYvz_MVcBeNP4NJtEtq.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Outfit:wght@400;500;600&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
45447a2b45991ea4e67ff0866444ca07fcf62c28dbfd5fa072ab76d3d0c46390
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://sso.plumpopup.com
Referer
https://fonts.googleapis.com/

Response headers

age
569921
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 06 Nov 2025 15:20:14 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Nov 2024 15:20:14 GMT
last-modified
Wed, 26 Apr 2023 23:30:07 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
32272
x-xss-protection
0
server
sffe
nunito-latin-400-normal.woff2
fonts.bunny.net/nunito/files/
16 KB
17 KB
Font
General
Full URL
https://fonts.bunny.net/nunito/files/nunito-latin-400-normal.woff2
Requested by
Host: fonts.bunny.net
URL: https://fonts.bunny.net/css?family=Nunito
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.199.37.231 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
138-199-37-231.bunnyinfra.net
Software
BunnyCDN-DE1-863 /
Resource Hash
923963e0a56b84c4438f2359121e855e147a01a78a2591c471179cfc9bf0e784

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://sso.plumpopup.com
Referer
https://fonts.bunny.net/css?family=Nunito

Response headers

cdn-status
200
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
etag
"66f0705d-3fa4"
cdn-fileserver
652
date
Wed, 13 Nov 2024 05:38:55 GMT
cdn-storageserver
DE-599
content-type
font/woff2
last-modified
Sun, 22 Sep 2024 19:30:37 GMT
cdn-cachedat
10/19/2024 15:52:02
cdn-cache
HIT
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode
200
cache-control
public, max-age=2592000
cdn-requestpullsuccess
True
cdn-requesttime
0
cdn-uid
3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f
cdn-requestid
6f318021c209e5578facdb1abda3e639
cdn-pullzone
781720
cdn-proxyver
1.04
accept-ranges
bytes
access-control-allow-origin
*
content-length
16292
cdn-edgestorageid
863
server
BunnyCDN-DE1-863
cdn-requestcountrycode
DE
modules.6f60e575cf8ad7cb10f7.js
script.hotjar.com/
222 KB
55 KB
Script
General
Full URL
https://script.hotjar.com/modules.6f60e575cf8ad7cb10f7.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3840045.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.187.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-187-74.fra60.r.cloudfront.net
Software
/
Resource Hash
f0a9b19d1615e0e2afdca507d4c7cbe384b0bdfad5cbaf63c14a386df33a62d7
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/

Response headers

x-robots-tag
none
content-encoding
br
etag
"56b1b49a4bdc4c874445907df778d045"
age
746337
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-amz-cf-id
OwHmp0NV7MWC36hwo2-C12kto0CWQPf3tY6nMLvS1_JRzM5wypMlJg==
date
Mon, 04 Nov 2024 14:19:58 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 Nov 2024 14:19:24 GMT
vary
Accept-Encoding
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
max-age=31536000
cross-origin-resource-policy
cross-origin
via
1.1 f8e909d80b83cb9eeaf200975944eb56.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
56128
x-amz-cf-pop
FRA60-P9
3840045
vc.hotjar.io/sessions/
0
234 B
XHR
General
Full URL
https://vc.hotjar.io/sessions/3840045?s=0.25&r=0.1802728278498018
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.6f60e575cf8ad7cb10f7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-15.fra56.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/

Response headers

via
1.1 cf2071a2896a4f71dbfdbc521d554362.cloudfront.net (CloudFront)
access-control-allow-origin
*
cache-control
no-store
x-cache
Miss from cloudfront
x-amz-cf-id
cJT-ALvuYnqFayIWQ9ZE4HhHYVGoIErcbruy3nwnV51lWM0PTxClRw==
date
Wed, 13 Nov 2024 05:38:55 GMT
x-amz-cf-pop
FRA56-P5
browser-perf.8417c6bba72228fa2e29.js
script.hotjar.com/
5 KB
2 KB
Script
General
Full URL
https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.6f60e575cf8ad7cb10f7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.187.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-187-74.fra60.r.cloudfront.net
Software
/
Resource Hash
70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/

Response headers

x-robots-tag
none
content-encoding
br
etag
"b83b61bc5871e9a23a0434e2c539f4f3"
age
4776574
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-amz-cf-id
vBP1Z0CJZPSlKY0YROrfvN65IjKdj3eWKYOfY9M4x_BE1q555Jw1ig==
date
Wed, 18 Sep 2024 22:49:21 GMT
content-type
application/javascript; charset=utf-8
last-modified
Tue, 17 Sep 2024 15:41:53 GMT
vary
Accept-Encoding
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
max-age=31536000
cross-origin-resource-policy
cross-origin
via
1.1 f8e909d80b83cb9eeaf200975944eb56.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
1782
x-amz-cf-pop
FRA60-P9
anchor
www.google.com/recaptcha/api2/ Frame 8499
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcFPPwpAAAAALLctj40hMhTFRlGFrpR-sl5JlrK&co=aHR0cHM6Ly9zc28ucGx1bXBvcHVwLmNvbTo0NDM.&hl=de&v=-ZG7BC9TxCVEbzIO2m429usb&size=invisible&cb=4d1jvdurcpyb
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-IY3YxDFNFV7PzVKqjyDZYg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sso.plumpopup.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-IY3YxDFNFV7PzVKqjyDZYg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy
cross-origin
date
Wed, 13 Nov 2024 05:38:55 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server
ESF
x-content-type-options
nosniff
x-xss-protection
0
favicon.svg
sso.plumpopup.com/assets/img/
434 B
564 B
Other
General
Full URL
https://sso.plumpopup.com/assets/img/favicon.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
24.199.126.95 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
8e867a4e928846b819dbc44457a73c253f70f2f81cba723df5ff948893213d5c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://sso.plumpopup.com/sign-up/app/custom

Response headers

accept-ranges
bytes
content-length
434
date
Wed, 13 Nov 2024 05:38:56 GMT
etag
"66cd915f-1b2"
content-type
image/svg+xml
last-modified
Tue, 27 Aug 2024 08:42:07 GMT
server
nginx/1.20.1
/
metrics.hotjar.io/
0
81 B
Ping
General
Full URL
https://metrics.hotjar.io/?v=6&site_id=3840045
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3840045.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.49.68.235 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-49-68-235.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://sso.plumpopup.com/

Response headers

date
Wed, 13 Nov 2024 05:38:58 GMT
access-control-max-age
86400
access-control-allow-origin
*

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 function| $ function| jQuery function| onSubmit function| validate object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| hj object| _hjSettings object| hjSiteSettings object| hjLazyModules function| hjBootstrap object| hjBootstrapCalled object| closure_lm_291627

6 Cookies

Domain/Path Name / Value
banner.purplebear.co/ Name: XSRF-TOKEN
Value: eyJpdiI6InUrd1U5QWJsMEM4NXh0dXB2YXZBU1E9PSIsInZhbHVlIjoibHlTR3pnd0hibmlGWm54VnpzQStPRXVLc2UyanRJTFIvRGhOTnFlTVN5MnJKdnpnamhhQ0Y3MVp1dFBlZ2x2Z0Z1VnYwWEEzRThoK1lqZU1DK2Iwajd1RVZieWhZNHlYSDNQY3o3SXBKT1NxSFRsRHgrei9NdUF4U3hZNGdKOTQiLCJtYWMiOiIxYTk5OWFhZTIyMWNmZWVkNzRiMDI5MDM3MjlhOGMxMWUzMWIzMjQ3MzMzMDRkNjIwMGQxNDk3MThiYTRjMDgwIiwidGFnIjoiIn0%3D
banner.purplebear.co/ Name: banner_session
Value: eyJpdiI6IkhUekV6ODJseTBVNi84YWVCdUEvVVE9PSIsInZhbHVlIjoiYThPcElIaFNrTVFXNndvWUIvVm03Qy81T1oxdXNvUTNNWmMzb01hZFhYR0o0ZkZTcmwwOVNmVTc5QVNvNHNndUkzamJDNnR1L25uZkQ4QmN1VmM0a0FmY1JlOEJhck80dVRZU2JqdG1uU3RJSkRuTmdGeUdQMVczVjRNcjNicnMiLCJtYWMiOiIwNzVjMDE1OTgyNzU1M2RmNGFhYTUyNGM1MTg3NGE2OGIwNjU1MjhiNmZiNTExZjZiOTBmZTc1ZjNhNjI0YTM0IiwidGFnIjoiIn0%3D
sso.plumpopup.com/ Name: XSRF-TOKEN
Value: eyJpdiI6IkhINHBTK1VtYUZVaXgyTjdVaHlmUVE9PSIsInZhbHVlIjoib1RFNkhGMTl1YXBFMmozY1B1bFpxa2p6OTE1TW00eENXMWhVbGFNcGM4cVcrZy83dTlmT25LWlh3SHpGNnltRWljTXVqWFI2VjNrbUFFN0NKb0dPYld2TXlhZTJTU29jWGsyc29WaFF3MjZtSlZPeUFPN25qTHdFaHJSK0d2ZFoiLCJtYWMiOiI1NWJmYTcwOGU5MDZkYzY0YzlmYTFmNGViZWEyNmM0MmVmMDY5ZmY5MjAwMTgxM2FlODA3ZGNmNzgyNzM3NjgzIiwidGFnIjoiIn0%3D
sso.plumpopup.com/ Name: kaktusgoodappsplum_session
Value: eyJpdiI6IkJjRzN0ZXBoMlJ4SzdiQ0lZMDA3QXc9PSIsInZhbHVlIjoiQytTRUpxZDF2VUtpN1o0V1lnZ2VYU1dYcE9IVWU3eFhxQVNaMHhwZGFMM3ZvWTRoSXJiNFFobWxmMGNQUkdqTXBhOVJtNm4ycHFIQkw2U0l2S0dYdHBubnN0TWF2TUVyZDh6QVpIZDRiQ0tLV1Q0K0pNWngyaTQwY0ZobTBwWTIiLCJtYWMiOiJkNjAyZjJkYzUyNzU0NzgzYTEwZGM2OGI1YTVmODdiMjE0MmQyMWY0YWZiM2ExNDNiNDdhYjhiNmEyNTFlMjJhIiwidGFnIjoiIn0%3D
.plumpopup.com/ Name: _hjSessionUser_3840045
Value: eyJpZCI6Ijk4YzBlODExLTc1OTctNWYzYy04NjY4LTYzMWU0OWZhZTk4NiIsImNyZWF0ZWQiOjE3MzE0NzYzMzU2MTEsImV4aXN0aW5nIjpmYWxzZX0=
.plumpopup.com/ Name: _hjSession_3840045
Value: eyJpZCI6ImI3YjM2ZjgyLTY2YjEtNDJkYi04NDM0LTI2YTk4MmJhNzY0NSIsImMiOjE3MzE0NzYzMzU2MTIsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=

2 Console Messages

Source Level URL
Text
recommendation verbose URL: https://sso.plumpopup.com/sign-up/app/custom
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation verbose URL: https://sso.plumpopup.com/sign-up/app/custom
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
app.plumpopup.com
banner.purplebear.co
fonts.bunny.net
fonts.googleapis.com
fonts.gstatic.com
metrics.hotjar.io
script.hotjar.com
sso.plumpopup.com
static.hotjar.com
vc.hotjar.io
www.google.com
www.gstatic.com
13.33.187.74
138.199.37.231
18.66.102.53
18.66.112.15
24.199.126.95
2606:4700:3033::6815:b02
2606:4700:3037::ac43:a141
2a00:1450:4001:800::200a
2a00:1450:4001:812::2004
2a00:1450:4001:81c::2003
2a00:1450:4001:829::2003
2a00:1450:4001:82f::200a
52.49.68.235
134b7a040348e9b097390a19cd52dd0919c3874505b57be065fbac35ab5e49b0
2108ac60bc352011468c22c5405ad3d88912de0a4d76200e8869e7a4d7ff0e07
25f924349a6600ba648162906c08b331fb27438e1dce1f48be98d6347c63b189
2a0721d6b036d8ad5ed149b38e7ce9f5c3fb8daf34ed9f1ae17936997a71ef2c
2d6af2744f6236e68977e638220cf3ba66a1735194fd3a3a0b926c8888d9fe85
45447a2b45991ea4e67ff0866444ca07fcf62c28dbfd5fa072ab76d3d0c46390
5abe2a12140edf2387d5be35225df3caa4f0f0a05d8f5614008c8cc90af4a156
67dcdfd27816d620001a74c99f7dd572a1736b6348686a55a72202a82af4a480
6820663943186119d382972f0be4fc28c518467fdb6e8bb1d563eba5cd4c9b80
70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf
8d84078f40e0527222e4d8a62d0a5baeaa120cc777ad4a3111449770af9b7088
8e867a4e928846b819dbc44457a73c253f70f2f81cba723df5ff948893213d5c
923963e0a56b84c4438f2359121e855e147a01a78a2591c471179cfc9bf0e784
a0884bcd0d34672b0556ba634c4f259ef5f6e5d6217d2d01f262ed28201d55e6
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9581351456472be5efbca7e269889aa54d990d73a83c5cc51e24a7e504bbf81
e9930d514c6eee2ece6ec73946c447f68f416bbcab273a8e230a5b409e06a57d
f0a9b19d1615e0e2afdca507d4c7cbe384b0bdfad5cbaf63c14a386df33a62d7