Submitted URL: https://link.news.watercamp-ep.de/unsubscribe.php?M=61453230&C=6449894bfa487269ab05c3888431f152&L=872&N=33053
Effective URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Submission: On April 20 via manual from IN — Scanned from DE

Summary

This website contacted 16 IPs in 7 countries across 17 domains to perform 32 HTTP transactions. The main IP is 52.76.7.111, located in Singapore, Singapore and belongs to AMAZON-02, US. The main domain is a4.unsub.click.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 10th 2022. Valid for: a year.
This is the only time a4.unsub.click was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 83.137.117.114 47692 (NESSUS)
2 52.76.7.111 16509 (AMAZON-02)
3 2a02:6ea0:c70... 60068 (CDN77 ^_^)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
3 139.45.197.239 9002 (RETN-AS)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
9 85.215.2.54 6724 (STRATO ST...)
1 2606:50c0:800... 54113 (FASTLY)
1 139.45.197.234 9002 (RETN-AS)
1 139.45.195.8 9002 (RETN-AS)
2 18.140.98.203 16509 (AMAZON-02)
1 139.45.197.243 9002 (RETN-AS)
1 1 2a05:d014:943... 16509 (AMAZON-02)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
2 139.45.197.151 9002 (RETN-AS)
2 2a02:6ea0:c70... 60068 (CDN77 ^_^)
32 16
Apex Domain
Subdomains
Transfer
10 mradmind.com
cdn.mradmind.com
c.mradmind.com
57 KB
4 bratashine.com
s7.bratashine.com
cdn.bratashine.com
14 KB
3 agaenteitor.com
agaenteitor.com — Cisco Umbrella Rank: 474074
29 KB
2 adup-tech.com
d.adup-tech.com — Cisco Umbrella Rank: 27293
m.adup-tech.com — Cisco Umbrella Rank: 65226
27 KB
2 litrif.com
litrif.com
495 B
2 unpkg.com
unpkg.com — Cisco Umbrella Rank: 897
7 KB
2 unsub.click
a4.unsub.click
6 KB
1 cdnativepush.com
static.cdnativepush.com — Cisco Umbrella Rank: 17629
3 KB
1 ourhotfeed.com
ourhotfeed.com
1 onmarshtompor.com
onmarshtompor.com — Cisco Umbrella Rank: 43035
2 KB
1 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 9763
543 B
1 bedrapiona.com
bedrapiona.com — Cisco Umbrella Rank: 33020
2 KB
1 githubusercontent.com
raw.githubusercontent.com — Cisco Umbrella Rank: 4346
589 KB
1 iclickcdn.com
iclickcdn.com — Cisco Umbrella Rank: 40320
24 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 647
30 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 436
7 KB
1 watercamp-ep.de
link.news.watercamp-ep.de
473 B
32 17
Domain Requested by
7 c.mradmind.com cdn.mradmind.com
a4.unsub.click
3 agaenteitor.com a4.unsub.click
agaenteitor.com
3 cdn.mradmind.com a4.unsub.click
cdn.mradmind.com
2 cdn.bratashine.com s7.bratashine.com
2 litrif.com cdn.jsdelivr.net
2 s7.bratashine.com a4.unsub.click
cdn.bratashine.com
2 unpkg.com 1 redirects a4.unsub.click
2 a4.unsub.click a4.unsub.click
1 static.cdnativepush.com a4.unsub.click
1 ourhotfeed.com iclickcdn.com
1 m.adup-tech.com a4.unsub.click
1 d.adup-tech.com 1 redirects
1 onmarshtompor.com iclickcdn.com
1 my.rtmark.net iclickcdn.com
1 bedrapiona.com iclickcdn.com
1 raw.githubusercontent.com a4.unsub.click
1 iclickcdn.com a4.unsub.click
1 code.jquery.com a4.unsub.click
1 cdn.jsdelivr.net a4.unsub.click
1 link.news.watercamp-ep.de 1 redirects
32 20

This site contains links to these domains. Also see Links.

Domain
c.mradmind.com
Subject Issuer Validity Valid
a4.unsub.click
Sectigo RSA Domain Validation Secure Server CA
2022-02-10 -
2023-02-10
a year crt.sh
*.mradmind.com
Thawte RSA CA 2018
2021-08-03 -
2022-08-03
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-07-03 -
2022-07-02
a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2021-07-14 -
2022-08-14
a year crt.sh
agaenteitor.com
R3
2022-04-18 -
2022-07-17
3 months crt.sh
s7.bratashine.com
Sectigo RSA Domain Validation Secure Server CA
2020-10-07 -
2021-10-07
a year crt.sh
*.github.com
DigiCert TLS RSA SHA256 2020 CA1
2022-04-07 -
2023-04-07
a year crt.sh
bedrapiona.com
R3
2022-03-30 -
2022-06-28
3 months crt.sh
*.rtmark.net
Sectigo RSA Domain Validation Secure Server CA
2021-11-20 -
2022-11-26
a year crt.sh
litrif.com
Sectigo RSA Domain Validation Secure Server CA
2021-08-04 -
2022-08-04
a year crt.sh
onmarshtompor.com
R3
2022-03-31 -
2022-06-29
3 months crt.sh
ourhotfeed.com
R3
2022-03-23 -
2022-06-21
3 months crt.sh
cdn.bratashine.com
Sectigo RSA Domain Validation Secure Server CA
2020-10-07 -
2021-10-07
a year crt.sh
cdnativepush.com
R3
2022-03-11 -
2022-06-09
3 months crt.sh

This page contains 3 frames:

Primary Page: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Frame ID: 6BA78A4DDD65A2D05BF79D4BAD21DE05
Requests: 26 HTTP requests in this frame

Frame: https://s7.bratashine.com/adframe.php?pid=2&ord=[timestamp]
Frame ID: 60033F5760317590564D3D42B6EF513A
Requests: 2 HTTP requests in this frame

Frame: https://s7.bratashine.com/adframe.php?pid=2&ord=%5Btimestamp%5D&vis=-1&wpcn=asmpvx3790511650475352&&ref=https%3A%2F%2Fa4.unsub.click%2F&pmrz=asm_2x1426456
Frame ID: F3F172E4C85FDCEAA5A2A5151152DAD6
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://link.news.watercamp-ep.de/unsubscribe.php?M=61453230&C=6449894bfa487269ab05c3888431f152&L=872&N=33053 HTTP 302
    https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

32
Requests

81 %
HTTPS

50 %
IPv6

17
Domains

20
Subdomains

16
IPs

7
Countries

797 kB
Transfer

1019 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://link.news.watercamp-ep.de/unsubscribe.php?M=61453230&C=6449894bfa487269ab05c3888431f152&L=872&N=33053 HTTP 302
    https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://unpkg.com/axios/dist/axios.min.js HTTP 302
  • https://unpkg.com/axios@0.26.1/dist/axios.min.js
Request Chain 19
  • https://d.adup-tech.com/newsletter/ad.jpg?p_id=4977&s_id=2842&key=%token%&rank=1 HTTP 302
  • https://m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/56f86a78.jpg

32 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
a4.unsub.click/
Redirect Chain
  • https://link.news.watercamp-ep.de/unsubscribe.php?M=61453230&C=6449894bfa487269ab05c3888431f152&L=872&N=33053
  • https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
15 KB
4 KB
Document
General
Full URL
https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.76.7.111 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-76-7-111.ap-southeast-1.compute.amazonaws.com
Software
nginx/1.10.3 (Ubuntu) / Express
Resource Hash
3cd88d40b4e350fe43e9521fc471a6f601621c89ded318995f8bd63249f545fa

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
public, max-age=0
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Wed, 20 Apr 2022 17:22:31 GMT
ETag
W/"3ced-17f25d93aa0"
Last-Modified
Wed, 23 Feb 2022 09:11:07 GMT
Server
nginx/1.10.3 (Ubuntu)
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Powered-By
Express

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Wed, 20 Apr 2022 17:22:30 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=2, max=100
Location
https://a4.unsub.click?email=david.papes%40credit-suisse.com&sys=Sendeffect
Pragma
no-cache
Server
Apache/2.4.25 (Debian)
Transfer-Encoding
chunked
adasync.min.js
cdn.mradmind.com/
33 KB
8 KB
Script
General
Full URL
https://cdn.mradmind.com/adasync.min.js
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::1 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
87f79f2f506631ff7210d138d584afc5ba8d6966db6fdca9e6f98ff19002097b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Wed, 20 Apr 2022 17:22:31 GMT
content-encoding
br
x-77-nzt-ray
SRlgKYFiUX4
x-cache
HIT
x-age
23304
x-77-nzt
AcO1ryzY8/n/CFsAAA
x-accel-expires
@1650538447
last-modified
Thu, 01 Apr 2021 12:06:58 GMT
server
CDN77-Turbo
etag
W/"3665562209"
x-77-cache
HIT
access-control-allow-methods
GET, POST, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-headers
range
expires
Fri, 26 Nov 2021 08:14:32 GMT
axios.min.js
unpkg.com/axios@0.26.1/dist/
Redirect Chain
  • https://unpkg.com/axios/dist/axios.min.js
  • https://unpkg.com/axios@0.26.1/dist/axios.min.js
17 KB
6 KB
Script
General
Full URL
https://unpkg.com/axios@0.26.1/dist/axios.min.js
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Server
2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89290d4672ac1ce466302360408c73c96d10cc7ad67a4a3f972563c88efc1b67
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:22:31 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
3629142
fly-request-id
01FXQTXV4CA8R37RTT79G27APT-fra
content-encoding
br
vary
Accept-Encoding
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"457f-zA7QrHnYYTK2xYcjaiN3JvTqWzo"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6fef9004fd209078-FRA

Redirect headers

date
Wed, 20 Apr 2022 17:22:31 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01G13ZDSKAB2Y3Y6KW3GTYFFBS-fra
server
cloudflare
age
546
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
location
/axios@0.26.1/dist/axios.min.js
cache-control
public, s-maxage=600, max-age=60
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6fef9004ccd79078-FRA
access-control-allow-origin
*
axios.min.js
cdn.jsdelivr.net/npm/axios/dist/
17 KB
7 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89290d4672ac1ce466302360408c73c96d10cc7ad67a4a3f972563c88efc1b67
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:22:31 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
fastly-original-body-size
6093
age
28755
x-jsd-version
0.26.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19147-FRA
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"457f-zA7QrHnYYTK2xYcjaiN3JvTqWzo"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d1CfsmYakev1nX1tac7vRpyDO5f%2B%2F4JlRsv8x0%2BHw%2Fsi3Q3RgfyXDfKwibBPVozWbEcF3KfX02zMA0%2Bebj7RBz449%2BX7cbh%2By2I0nD7EnpHKSaYDYbOomWifXAZPYhhFOmyvaraFEoZ89FZSKyE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
6fef9004cf52912e-FRA
jquery-3.5.1.min.js
code.jquery.com/
87 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:22:31 GMT
content-encoding
gzip
last-modified
Wed, 16 Feb 2022 10:50:39 GMT
server
nginx
etag
W/"620cd6ff-15d84"
vary
Accept-Encoding
x-hw
1650475351.dop203.am5.t,1650475351.cds281.am5.hn,1650475351.cds312.am5.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30879
main.js
a4.unsub.click/js/
3 KB
2 KB
Script
General
Full URL
https://a4.unsub.click/js/main.js
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.76.7.111 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-76-7-111.ap-southeast-1.compute.amazonaws.com
Software
nginx/1.10.3 (Ubuntu) / Express
Resource Hash
cc76630736ef83bdd794a081b0a820f69383861324bfac61f2926b7f6e466d81

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Wed, 20 Apr 2022 17:22:31 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Last-Modified
Fri, 26 Feb 2021 06:30:23 GMT
Server
nginx/1.10.3 (Ubuntu)
X-Powered-By
Express
ETag
W/"d4f-177dd07f89b"
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
4697450
agaenteitor.com/400/
71 KB
28 KB
Script
General
Full URL
https://agaenteitor.com/400/4697450
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
7912da656f626d1a67be20c85cb8aaf89610f9f71603249e139e8dd76ebe1850
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-trace-id
f3d38effe332f498b0379f93f668350c
pragma
no-cache
date
Wed, 20 Apr 2022 17:22:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
vary
Origin
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
Link
cache-control
no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials
true
strict-transport-security
max-age=1
timing-allow-origin
*, *
expires
Tue, 11 Jan 1994 10:00:00 GMT
tag.min.js
iclickcdn.com/
67 KB
24 KB
Script
General
Full URL
https://iclickcdn.com/tag.min.js
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c76 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce490f81c5f78f225b0d554990f901711dc9c7a2934b7920b995592e6a47a44b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:22:31 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
timing-allow-origin
*
age
10397
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS
x-trace-id
bb27551b8cd215e2a394717b7c54ab8b
pragma
no-cache
last-modified
Wed, 20 Apr 2022 08:01:07 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wbPVThagx1AA%2F%2Bo9sp19uRVkhXwAr8g4WyY5j4yDfZfq8YgBQIGTjDPwi1UmSBsaUEiVDlVy1i7F%2Fr786MQvp9W2fEYbii1jQcuQuFrJqDgz%2FQ%2BNY%2FSiQAyoLlTi2K7Ctlg45rjrkG599UM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-credentials
true
cf-ray
6fef9004da999b40-FRA
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding
expires
Thu, 21 Apr 2022 14:29:14 GMT
adframe.php
s7.bratashine.com/ Frame 6003
3 KB
3 KB
Document
General
Full URL
https://s7.bratashine.com/adframe.php?pid=2&ord=[timestamp]
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.215.2.54 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
www2.adspirit.sbs.stratoserver.net
Software
Apache /
Resource Hash
0d3d8440363224ff9b73e44d3f1e9fa76f994f4f6297b2ae4fb49239be624061
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://a4.unsub.click/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-length
2703
content-type
text/html; charset=UTF-8
date
Wed, 20 Apr 2022 17:22:32 GMT
expires
0
last-modified
Wed, 20 Apr 2022 17:22:32 GMT
p3p
policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
pragma
no-cache
server
Apache
x-xss-protection
0
demo-bg.jpg
raw.githubusercontent.com/JulianLaval/canvas-particle-network/master/img/
588 KB
589 KB
Image
General
Full URL
https://raw.githubusercontent.com/JulianLaval/canvas-particle-network/master/img/demo-bg.jpg
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8003::154 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
56531fd7df750f3e1d52f3aba06c01d9199c7a316188eba97d599611d1991838
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-fastly-request-id
e5387ac672b173357b444f1c0dbac7be334b379e
content-security-policy
default-src 'none'; style-src 'unsafe-inline'; sandbox
via
1.1 varnish
x-content-type-options
nosniff
x-cache
HIT
x-cache-hits
1
vary
Authorization,Accept-Encoding,Origin
content-length
602293
x-xss-protection
1; mode=block
x-served-by
cache-hhn4061-HHN
x-github-request-id
5092:1239A:13B47F:14BE4A:62602EE7
x-timer
S1650475352.795777,VS0,VE83
x-frame-options
deny
date
Wed, 20 Apr 2022 17:22:31 GMT
source-age
0
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=300
etag
W/"3c709cb6d2a1042f364744951944bf5739ac73318a5a3d1aa2e9302b7648f72a"
accept-ranges
bytes
expires
Wed, 20 Apr 2022 17:27:31 GMT
adscript.php
c.mradmind.com/
2 KB
3 KB
Script
General
Full URL
https://c.mradmind.com/adscript.php?async=p19991x0&wpcn=asm37493445x1650475351144&ref=https%3A%2F%2Fa4.unsub.click%2F%3Femail%3Ddavid.papes%2540credit-suisse.com%26sys%3DSendeffect&swf=-1&scx=1600&scy=1200&wcx=1600&wcy=1200&dcx=280&vis=4&tz=1650475351146&pid=5&gdpr_consent=[consentstring]
Requested by
Host: cdn.mradmind.com
URL: https://cdn.mradmind.com/adasync.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.215.2.54 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
www2.adspirit.sbs.stratoserver.net
Software
Apache /
Resource Hash
739a495634cbaa235513ea065ece07a0eec528ebb81fb4fa9819d041baa781b8
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Apr 2022 17:22:31 GMT
last-modified
Wed, 20 Apr 2022 17:22:31 GMT
server
Apache
p3p
policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-type
text/javascript; charset=utf-8
content-length
2368
x-xss-protection
0
expires
0
adscript.php
c.mradmind.com/
2 KB
3 KB
Script
General
Full URL
https://c.mradmind.com/adscript.php?async=p86598x1&wpcn=asm37493445x1650475351144&ref=https%3A%2F%2Fa4.unsub.click%2F%3Femail%3Ddavid.papes%2540credit-suisse.com%26sys%3DSendeffect&swf=-1&scx=1600&scy=1200&wcx=1600&wcy=1200&dcx=280&vis=4&tz=1650475351147&pid=6&gdpr_consent=[consentstring]
Requested by
Host: cdn.mradmind.com
URL: https://cdn.mradmind.com/adasync.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.215.2.54 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
www2.adspirit.sbs.stratoserver.net
Software
Apache /
Resource Hash
db24b9a6080900b0e199e6a69ca277a96329776b956d220f31565902bc40f0f3
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Apr 2022 17:22:31 GMT
last-modified
Wed, 20 Apr 2022 17:22:31 GMT
server
Apache
p3p
policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-type
text/javascript; charset=utf-8
content-length
2369
x-xss-protection
0
expires
0
adscript.php
c.mradmind.com/
2 KB
3 KB
Script
General
Full URL
https://c.mradmind.com/adscript.php?async=p75333x2&wpcn=asm37493445x1650475351144&ref=https%3A%2F%2Fa4.unsub.click%2F%3Femail%3Ddavid.papes%2540credit-suisse.com%26sys%3DSendeffect&swf=-1&scx=1600&scy=1200&wcx=1600&wcy=1200&dcx=280&vis=4&tz=1650475351148&pid=7&gdpr_consent=[consentstring]
Requested by
Host: cdn.mradmind.com
URL: https://cdn.mradmind.com/adasync.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.215.2.54 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
www2.adspirit.sbs.stratoserver.net
Software
Apache /
Resource Hash
32bbf31aa2240d23643d484fa2bc3a21deefec72d2efd20d76abe0e7fcd47bb8
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Apr 2022 17:22:31 GMT
last-modified
Wed, 20 Apr 2022 17:22:31 GMT
server
Apache
p3p
policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-type
text/javascript; charset=utf-8
content-length
2193
x-xss-protection
0
expires
0
/
bedrapiona.com/5/4697451/
3 KB
2 KB
XHR
General
Full URL
https://bedrapiona.com/5/4697451/?oo=1&js_build=iclick-v1.380.0
Requested by
Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.234 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
1c227339dd42708912de73c4bc869ced524ad6603bacca96c3424d090b019541

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-trace-id
0559505aa2ade8e622e8fa9f19c49cdd
pragma
no-cache, no-cache
date
Wed, 20 Apr 2022 17:22:31 GMT
content-encoding
gzip
server
nginx
link
<https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
https://a4.unsub.click
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding
expires
Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
gid.js
my.rtmark.net/
65 B
543 B
XHR
General
Full URL
https://my.rtmark.net/gid.js?userId=040e356613e34be69587291a000c7217
Requested by
Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e1a3f3a7d091cfa25a76f6b4deaa3a3948d4e549906c8202adefbbb56fb319e4
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:22:31 GMT
x-content-type-options
nosniff
server
nginx
strict-transport-security
max-age=1
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://a4.unsub.click
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
whereami
litrif.com/cnty/ Frame
0
0
Preflight
General
Full URL
https://litrif.com/cnty/whereami
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.140.98.203 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-140-98-203.ap-southeast-1.compute.amazonaws.com
Software
nginx / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://a4.unsub.click
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Access-Control-Allow-Headers
authorization
Access-Control-Allow-Methods
GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Length
0
Date
Wed, 20 Apr 2022 17:22:32 GMT
Server
nginx
Vary
Access-Control-Request-Headers
X-Powered-By
Express
whereami
litrif.com/cnty/
235 B
495 B
XHR
General
Full URL
https://litrif.com/cnty/whereami
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.140.98.203 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-140-98-203.ap-southeast-1.compute.amazonaws.com
Software
nginx / Express
Resource Hash
7323301421801aaec7e3c66685de4404b44852a2aad7ac1871d4420a1696a6eb

Request headers

Accept
application/json, text/plain, */*
Referer
https://a4.unsub.click/
authorization
Basic c21zbHV4LmRlOjEyMzQ1
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Wed, 20 Apr 2022 17:22:32 GMT
ETag
W/"eb-8wIaktYUjZftfcNmcbKqJxevIAQ"
Server
nginx
X-Powered-By
Express
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Length
235
/
onmarshtompor.com/
2 KB
2 KB
Fetch
General
Full URL
https://onmarshtompor.com/?rb=7wLd4qaYc3uYUmwo8UZouj9SGIx8NZqM0zFojzzwyNgvst_2lATsNjR0Bmz1B-E145ssPtH1qPUqfXDakM86G3YfMo5w2efw8JoNI7NhZ7otgvLkj2OloE_DmaI7uDsp8a0jaEmTpKkIEvWyhmoxZVIihMIlnVAW0oP1PLojWj-dF4H4dqE8JBRwDdBfaVs0E--iYqVC50zcrCIAYqT21A4dhsEt_EMxDEotM7eY5g3HMuWSQTJIfhPjf-a1BtAtHkTAPO1mdyBnJ5D9qjnC1rTS-yg%3D&request_ab2=0&zoneid=4697451&js_build=iclick-v1.380.0&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=1&pl=https%3A%2F%2Fa4.unsub.click%2F%3Femail%3Ddavid.papes%2540credit-suisse.com%26sys%3DSendeffect&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false&js_build=iclick-v1.380.0&os=other&os_version=other&bs=287e7cae-2c5e-4c55-b4eb-2a74c3c1397f&userId=040e356613e34be69587291a000c7217&m=link
Requested by
Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.243 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
2134a9564a079fe68dab4e026c7cfd9b89c0ff79bf09b4c8a4a9e827ed86d552
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:22:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
access-control-max-age
86400
x-trace-id
aff4c73a041279a93a48830403e58823
pragma
no-cache
server
nginx
strict-transport-security
max-age=1
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
https://a4.unsub.click
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding
expires
Tue, 11 Jan 1994 10:00:00 GMT
asm_pageview.min.js
cdn.mradmind.com/banner/
2 KB
1 KB
Script
General
Full URL
https://cdn.mradmind.com/banner/asm_pageview.min.js
Requested by
Host: cdn.mradmind.com
URL: https://cdn.mradmind.com/adasync.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::1 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
9d33f1621ca6eca3c807b75f23aea2f847f1992d487cab0aeb732332af8fab46

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Wed, 20 Apr 2022 17:22:32 GMT
content-encoding
br
x-77-nzt-ray
LFMkADC39Yg
x-cache
HIT
x-age
21431
x-77-nzt
AcO1ryySPir/t1MAAA
x-accel-expires
@1650540321
last-modified
Tue, 11 Jun 2019 08:31:43 GMT
server
CDN77-Turbo
etag
W/"3762381252"
x-77-cache
HIT
access-control-allow-methods
GET, POST, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-headers
range
expires
Wed, 24 Nov 2021 19:16:26 GMT
adview.php
c.mradmind.com/
43 B
467 B
Image
General
Full URL
https://c.mradmind.com/adview.php?tz=16504753512530787tzmacro&&pid=7&kid=1&wmid=1&gdpr_consent=&sid=2&nvc=1&target=-
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.215.2.54 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
www2.adspirit.sbs.stratoserver.net
Software
Apache /
Resource Hash
5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Apr 2022 17:22:32 GMT
last-modified
Wed, 20 Apr 2022 17:22:32 GMT
server
Apache
p3p
policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
43
x-xss-protection
0
expires
0
56f86a78.jpg
m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/
Redirect Chain
  • https://d.adup-tech.com/newsletter/ad.jpg?p_id=4977&s_id=2842&key=%token%&rank=1
  • https://m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/56f86a78.jpg
26 KB
27 KB
Image
General
Full URL
https://m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/56f86a78.jpg
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Server
2606:4700:10::6816:219 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65a2b88a8544c4a924453a990b01b225ff8ff80a58652365d32cd19e50215bd6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:22:32 GMT
via
1.1 490623df85c571a18ba7da1511cc969e.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
2245583
cf-polished
origSize=31675, status=webp_bigger
cf-ray
6fef90087d755c80-FRA
x-cache
Miss from cloudfront
content-length
26967
x-amz-expiration
expiry-date="Tue, 17 May 2022 00:00:00 GMT", rule-id="cleanup nl"
last-modified
Tue, 15 Feb 2022 23:47:30 GMT
server
cloudflare
etag
"18591a83ba29d3be986c23892f674eea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
null
cache-control
public, max-age=31536000
x-amz-cf-pop
AMS1-P1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
UdjwBTWf9_uqxJMqgvsgLasTYoRQZbBYtDr-gxQnlKQ8S3naHTlxaw==
cf-bgj
imgq:100,h2pri

Redirect headers

location
https://m.adup-tech.com/nl/1/32467dc4c9ad6ff1c1014d4a435be5ae/cf1c7dfb/56ce8b01/c60179c8/56f86a78.jpg
date
Wed, 20 Apr 2022 17:22:32 GMT
server
nginx
content-length
396
content-type
text/html; charset=utf-8
adview.php
c.mradmind.com/
43 B
467 B
Image
General
Full URL
https://c.mradmind.com/adview.php?tz=165047535128288695tzmacro&&pid=5&kid=6&wmid=21&gdpr_consent=&sid=3&nvc=1&target=-
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.215.2.54 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
www2.adspirit.sbs.stratoserver.net
Software
Apache /
Resource Hash
5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Apr 2022 17:22:32 GMT
last-modified
Wed, 20 Apr 2022 17:22:32 GMT
server
Apache
p3p
policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
43
x-xss-protection
0
expires
0
0_PF_Lightia_Augen_brennen.jpg
cdn.mradmind.com/banner/mradmind/6/2022-04-13/
37 KB
37 KB
Image
General
Full URL
https://cdn.mradmind.com/banner/mradmind/6/2022-04-13/0_PF_Lightia_Augen_brennen.jpg
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::1 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
5ebdc5ca4fe95cc4c3ff0d5c8ff3988e8abd9e4dbf9fbefe16bdb7d9ef328be1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Wed, 20 Apr 2022 17:22:32 GMT
x-77-nzt-ray
UZp+Qi9YyuM
x-cache
HIT
x-age
26838
content-length
37680
x-77-nzt
AcO1ryzfqQn/1mgAAA
x-accel-expires
@1650534914
last-modified
Wed, 13 Apr 2022 15:14:37 GMT
server
CDN77-Turbo
etag
"1589874106"
x-77-cache
HIT
access-control-allow-methods
GET, POST, HEAD
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 15 Apr 2022 09:23:28 GMT
adscript.php
c.mradmind.com/
316 B
762 B
Script
General
Full URL
https://c.mradmind.com/adscript.php?pid=6&hr=1&nrc=1&&async=p86598x1&wpcn=asm37493445x1650475351144&ref=https%3A%2F%2Fa4.unsub.click%2F%3Femail%3Ddavid.papes%2540credit-suisse.com%26sys%3DSendeffect&swf=-1&scx=1600&scy=1200&wcx=1600&wcy=1200&dcx=280&vis=4&tz=1650475351147&gdpr_consent=%5Bconsentstring%5D&sid=2&ex=|6&ord=1650475351349
Requested by
Host: cdn.mradmind.com
URL: https://cdn.mradmind.com/adasync.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.215.2.54 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
www2.adspirit.sbs.stratoserver.net
Software
Apache /
Resource Hash
ca7764cf81d90a98757ae92ed435f1754fe815ee8dde2c04091fe671f286c4a1
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Apr 2022 17:22:32 GMT
last-modified
Wed, 20 Apr 2022 17:22:32 GMT
server
Apache
p3p
policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-type
text/javascript; charset=utf-8
content-length
316
x-xss-protection
0
expires
0
favicon.ico
ourhotfeed.com/
0
0
Fetch
General
Full URL
https://ourhotfeed.com/favicon.ico
Requested by
Host: iclickcdn.com
URL: https://iclickcdn.com/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.151 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=60
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:22:32 GMT
x-content-type-options
nosniff
server
nginx
strict-transport-security
max-age=60
4697450
agaenteitor.com/500/
2 KB
2 KB
XHR
General
Full URL
https://agaenteitor.com/500/4697450?excludes=&oaid=040e356613e34be69587291a000c7217&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=1&pl=https%3A%2F%2Fa4.unsub.click%2F%3Femail%3Ddavid.papes%2540credit-suisse.com%26sys%3DSendeffect&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
Requested by
Host: agaenteitor.com
URL: https://agaenteitor.com/400/4697450
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
6ca082231fcf4a0a5f44cf847d57bbea1c1b9e634e51d98933113014631ef3eb
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://a4.unsub.click/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
application/json

Response headers

x-trace-id
84298c6e4f467c7b14f993911c2381a1
pragma
no-cache
date
Wed, 20 Apr 2022 17:22:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
vary
Origin
content-type
application/javascript
access-control-allow-origin
https://a4.unsub.click
access-control-expose-headers
Link
cache-control
no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials
true
strict-transport-security
max-age=1
timing-allow-origin
*, *
expires
Tue, 11 Jan 1994 10:00:00 GMT
4697450
agaenteitor.com/500/ Frame
0
0
Preflight
General
Full URL
https://agaenteitor.com/500/4697450?excludes=&oaid=040e356613e34be69587291a000c7217&fs=0&cf=0&sw=1600&sh=1200&sah=1200&wx=0&wy=0&ww=1600&wh=1200&cw=1600&wiw=1600&wih=1200&wfc=1&pl=https%3A%2F%2Fa4.unsub.click%2F%3Femail%3Ddavid.papes%2540credit-suisse.com%26sys%3DSendeffect&drf=&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://a4.unsub.click
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://a4.unsub.click
access-control-max-age
600
allow
GET, OPTIONS
content-length
0
date
Wed, 20 Apr 2022 17:22:32 GMT
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
*
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options
nosniff
adasync.min.js
cdn.bratashine.com/ Frame 6003
33 KB
8 KB
Script
General
Full URL
https://cdn.bratashine.com/adasync.min.js
Requested by
Host: s7.bratashine.com
URL: https://s7.bratashine.com/adframe.php?pid=2&ord=[timestamp]
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::2 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
87f79f2f506631ff7210d138d584afc5ba8d6966db6fdca9e6f98ff19002097b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s7.bratashine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Wed, 20 Apr 2022 17:22:32 GMT
content-encoding
br
x-77-nzt-ray
ARhsqRXrA5U
x-cache
HIT
x-age
80172
x-77-nzt
AcO1ry+Lf5v/LDkBAA
x-accel-expires
@1650481580
last-modified
Thu, 01 Apr 2021 12:06:58 GMT
server
CDN77-Turbo
etag
W/"3665562209"
x-77-cache
HIT
access-control-allow-methods
GET, POST, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-headers
range
expires
Fri, 02 Apr 2021 22:29:04 GMT
adpageview.php
c.mradmind.com/
43 B
467 B
Image
General
Full URL
https://c.mradmind.com/adpageview.php?&wsid=3&sid=2&sid2=0&sid3=0&gdpr_consent=&tz=1650475351542
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.215.2.54 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
www2.adspirit.sbs.stratoserver.net
Software
Apache /
Resource Hash
5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Apr 2022 17:22:32 GMT
last-modified
Wed, 20 Apr 2022 17:22:32 GMT
server
Apache
p3p
policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
43
x-xss-protection
0
expires
0
adframe.php
s7.bratashine.com/ Frame F3F1
620 B
1 KB
Document
General
Full URL
https://s7.bratashine.com/adframe.php?pid=2&ord=%5Btimestamp%5D&vis=-1&wpcn=asmpvx3790511650475352&&ref=https%3A%2F%2Fa4.unsub.click%2F&pmrz=asm_2x1426456
Requested by
Host: cdn.bratashine.com
URL: https://cdn.bratashine.com/adasync.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.215.2.54 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
www2.adspirit.sbs.stratoserver.net
Software
Apache /
Resource Hash
5f572c626b596472a76284a90fde2bb00cd412f2012d096c587bb404dd6a135e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://s7.bratashine.com/adframe.php?pid=2&ord=[timestamp]
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-length
620
content-type
text/html; charset=UTF-8
date
Wed, 20 Apr 2022 17:22:32 GMT
expires
0
last-modified
Wed, 20 Apr 2022 17:22:32 GMT
p3p
policyref="https://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"
pragma
no-cache
server
Apache
x-xss-protection
0
01602088365889.png
static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/
2 KB
3 KB
Image
General
Full URL
https://static.cdnativepush.com/contents/s/1b/e9/ef/c45191508dd0ffe9619d8e8d61/01602088365889.png
Requested by
Host: a4.unsub.click
URL: https://a4.unsub.click/?email=david.papes%40credit-suisse.com&sys=Sendeffect
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.151 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a4.unsub.click/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 17:22:32 GMT
last-modified
Thu, 01 Jul 2021 09:13:54 GMT
server
nginx
etag
"60dd8752-86d"
access-control-allow-methods
GET, POST, OPTIONS, HEAD
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-length
2157
asm_pageview.min.js
cdn.bratashine.com/banner/ Frame F3F1
2 KB
1 KB
Script
General
Full URL
https://cdn.bratashine.com/banner/asm_pageview.min.js
Requested by
Host: s7.bratashine.com
URL: https://s7.bratashine.com/adframe.php?pid=2&ord=%5Btimestamp%5D&vis=-1&wpcn=asmpvx3790511650475352&&ref=https%3A%2F%2Fa4.unsub.click%2F&pmrz=asm_2x1426456
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::2 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
9d33f1621ca6eca3c807b75f23aea2f847f1992d487cab0aeb732332af8fab46

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s7.bratashine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Wed, 20 Apr 2022 17:22:32 GMT
content-encoding
br
x-77-nzt-ray
YblCeHpPNmc
x-cache
HIT
x-age
80171
x-77-nzt
AcO1ry9iX3D/KzkBAA
x-accel-expires
@1650481581
last-modified
Tue, 11 Jun 2019 08:31:43 GMT
server
CDN77-Turbo
etag
W/"3762381252"
x-77-cache
HIT
access-control-allow-methods
GET, POST, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
access-control-allow-headers
range
expires
Thu, 07 May 2020 11:20:54 GMT

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| asm_async_obj object| asm_async_data number| a number| b number| u boolean| asm_gdpr_feedback number| asm_gdpr string| asm_gdpr_consent string| asm_gdpr_status object| tcfapi_frame object| cmp_callbacks object| v9t6kxy5uzi object| zfgformats function| onClickTrigger boolean| zfgloadedpopup function| axios function| $ function| jQuery object| zfgstorage object| webpushlogs function| getReason object| canvasDiv object| options object| particleCanvas function| ParticleNetwork boolean| asm_ex boolean| asm_ex_all number| asm_i object| asm_pageview string| nx string| pageViewID number| wallpaperIndex object| win object| doc string| inswrapper boolean| scrollAttached object| scrollIntoObjects object| settings function| log function| writeCookie function| readCookie function| hasCookie function| fndwin function| checkFlash number| swf function| checkRef string| ref function| asm_gp function| max function| asm_ds function| checkVisibility function| getVisibilityIndex function| checkInView function| hasAttribute function| getElementsByClassName function| addScrollObject object| scrollTimer object| scrollTimer2 boolean| scrollWaiting function| handleScroll function| handleScroll2 function| initi function| pushScript function| getOffset function| pushScriptGDPR function| findCMPFrame function| callcmp function| copyObject function| write function| fireJS function| writeScript function| writeScript_base function| writeFlash object| pretargetings function| startPretargeting function| getTimeout object| single_pretargetings function| addSingleCallPretargeting function| addPretargeting function| pretargetingDone2 function| pretargetingDone function| hasGDPRFeedback object| gdprCallbacks number| checkInterval boolean| checkIntervalActive boolean| eventRegistered function| fetchGDPRData function| checkGDPRFeedback function| cancelGDPRCheck function| cancelGDPRCheck2 function| callGDPRCallbacks function| setRefresh function| refreshSlot function| asm_pageview_object

9 Cookies

Domain/Path Name / Value
link.news.watercamp-ep.de/ Name: IEMSESSIONID
Value: koqegas0240c55obqvi1ld5pd3
bedrapiona.com/ Name: OAID
Value: 040e356613e34be69587291a000c7217
bedrapiona.com/ Name: oaidts
Value: 1650475351
my.rtmark.net/ Name: ID
Value: 040e356613e34be69587291a000c7217
a4.unsub.click/ Name: prefetchAd_4697451
Value: true
onmarshtompor.com/ Name: OAID
Value: 040e356613e34be69587291a000c7217
onmarshtompor.com/ Name: oaidts
Value: 1650475352
onmarshtompor.com/ Name: syncedCookie
Value: true
agaenteitor.com/ Name: OAID
Value: 040e356613e34be69587291a000c7217

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a4.unsub.click
agaenteitor.com
bedrapiona.com
c.mradmind.com
cdn.bratashine.com
cdn.jsdelivr.net
cdn.mradmind.com
code.jquery.com
d.adup-tech.com
iclickcdn.com
link.news.watercamp-ep.de
litrif.com
m.adup-tech.com
my.rtmark.net
onmarshtompor.com
ourhotfeed.com
raw.githubusercontent.com
s7.bratashine.com
static.cdnativepush.com
unpkg.com
139.45.195.8
139.45.197.151
139.45.197.234
139.45.197.239
139.45.197.243
18.140.98.203
2001:4de0:ac18::1:a:1a
2606:4700:10::6816:219
2606:4700:20::681a:c76
2606:4700::6810:5614
2606:4700::6810:7aaf
2606:50c0:8003::154
2a02:6ea0:c700::1
2a02:6ea0:c700::2
2a05:d014:943:a603:f2b:7439:bf46:bd5b
52.76.7.111
83.137.117.114
85.215.2.54
0d3d8440363224ff9b73e44d3f1e9fa76f994f4f6297b2ae4fb49239be624061
1c227339dd42708912de73c4bc869ced524ad6603bacca96c3424d090b019541
2134a9564a079fe68dab4e026c7cfd9b89c0ff79bf09b4c8a4a9e827ed86d552
32bbf31aa2240d23643d484fa2bc3a21deefec72d2efd20d76abe0e7fcd47bb8
3cd88d40b4e350fe43e9521fc471a6f601621c89ded318995f8bd63249f545fa
56531fd7df750f3e1d52f3aba06c01d9199c7a316188eba97d599611d1991838
5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc
5ebdc5ca4fe95cc4c3ff0d5c8ff3988e8abd9e4dbf9fbefe16bdb7d9ef328be1
5f572c626b596472a76284a90fde2bb00cd412f2012d096c587bb404dd6a135e
65a2b88a8544c4a924453a990b01b225ff8ff80a58652365d32cd19e50215bd6
6ca082231fcf4a0a5f44cf847d57bbea1c1b9e634e51d98933113014631ef3eb
7323301421801aaec7e3c66685de4404b44852a2aad7ac1871d4420a1696a6eb
739a495634cbaa235513ea065ece07a0eec528ebb81fb4fa9819d041baa781b8
7912da656f626d1a67be20c85cb8aaf89610f9f71603249e139e8dd76ebe1850
87f79f2f506631ff7210d138d584afc5ba8d6966db6fdca9e6f98ff19002097b
89290d4672ac1ce466302360408c73c96d10cc7ad67a4a3f972563c88efc1b67
9d33f1621ca6eca3c807b75f23aea2f847f1992d487cab0aeb732332af8fab46
b0cd7af0b912b1a17ecfb9284d55058a59e621500acb94e2d4a5bbfd5eb6d022
ca7764cf81d90a98757ae92ed435f1754fe815ee8dde2c04091fe671f286c4a1
cc76630736ef83bdd794a081b0a820f69383861324bfac61f2926b7f6e466d81
ce490f81c5f78f225b0d554990f901711dc9c7a2934b7920b995592e6a47a44b
db24b9a6080900b0e199e6a69ca277a96329776b956d220f31565902bc40f0f3
e1a3f3a7d091cfa25a76f6b4deaa3a3948d4e549906c8202adefbbb56fb319e4
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d