urlscan.io logo urlscan.io
SecurityTrails logo

medica1.destinationrx.com Open in urlscan Pro
74.80.246.60  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://jaypetersen.medicaplanchoices.com/
Effective URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Submission: On December 21 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 2 countries across 11 domains to perform 39 HTTP transactions. The main IP is 74.80.246.60, located in United States and belongs to CONNECTURE-156, US. The main domain is medica1.destinationrx.com.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on January 3rd 2023. Valid for: a year.
This is the only time medica1.destinationrx.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

9    216.251.172.86 (Minneapolis, United States)

ASN12042 (ENVENTIS, US)
PTR: 216.251.172.86.static.consolidated.net
jaypetersen.medicaplanchoices.com
xmpie.visionsfirst.com
2    18.65.39.20 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-65-39-20.ams1.r.cloudfront.net
ajax.xmcircle.com
1    2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
3    74.80.246.60 (United States)

ASN394428 (CONNECTURE-156, US)
PTR: *.destinationrx.com
medica1.destinationrx.com
4    2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
13    2600:9000:2090:b600:9:f936:20c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
contentserver.destinationrx.com
1    2600:9000:238d:3600:7:2bfb:7c00:93a1 (United States)

ASN16509 (AMAZON-02, US)
tags.tiqcdn.com
1    18.159.90.183 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-90-183.eu-central-1.compute.amazonaws.com
collect.tealiumiq.com
2    74.80.246.30 (None, )

ASN- ()
www.drxwebservices.com
1    151.101.194.137 (None, )

ASN- ()
js-agent.newrelic.com
1    162.247.243.29 (None, )

ASN- ()
bam.nr-data.net
Apex Domain
Subdomains		 Transfer
16 destinationrx.com
medica1.destinationrx.com
contentserver.destinationrx.com — Cisco Umbrella Rank: 245421
3 MB
7 visionsfirst.com
xmpie.visionsfirst.com
1 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 36
335 KB
2 drxwebservices.com
www.drxwebservices.com
2 KB
2 xmcircle.com
ajax.xmcircle.com
221 KB
2 medicaplanchoices.com
jaypetersen.medicaplanchoices.com
3 KB
1 nr-data.net
bam.nr-data.net
413 B
1 newrelic.com
js-agent.newrelic.com
29 KB
1 tealiumiq.com
collect.tealiumiq.com — Cisco Umbrella Rank: 2692
758 B
1 tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 1001
11 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 735
30 KB
39 11
Domain Requested by
13 contentserver.destinationrx.com medica1.destinationrx.com
contentserver.destinationrx.com
7 xmpie.visionsfirst.com ajax.xmcircle.com
4 www.googletagmanager.com medica1.destinationrx.com
www.googletagmanager.com
3 medica1.destinationrx.com 1 redirects jaypetersen.medicaplanchoices.com
medica1.destinationrx.com
2 www.drxwebservices.com medica1.destinationrx.com
2 ajax.xmcircle.com jaypetersen.medicaplanchoices.com
2 jaypetersen.medicaplanchoices.com jaypetersen.medicaplanchoices.com
1 bam.nr-data.net medica1.destinationrx.com
1 js-agent.newrelic.com medica1.destinationrx.com
1 collect.tealiumiq.com medica1.destinationrx.com
1 tags.tiqcdn.com medica1.destinationrx.com
1 code.jquery.com jaypetersen.medicaplanchoices.com
39 12

This site contains no links.

Subject Issuer Validity Valid
*.xmcircle.com
Sectigo RSA Domain Validation Secure Server CA		 2023-12-17 -
2025-01-16		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
*.destinationrx.com
GeoTrust TLS RSA CA G1		 2023-01-03 -
2024-02-03		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
tags.tiqcdn.com
Amazon RSA 2048 M01		 2023-04-18 -
2024-05-17		 a year crt.sh
*.tealiumiq.com
Amazon RSA 2048 M01		 2023-07-26 -
2024-08-23		 a year crt.sh
*.drxwebservices.com
GeoTrust TLS RSA CA G1		 2022-12-17 -
2024-01-17		 a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2		 2023-04-13 -
2024-05-14		 a year crt.sh
*.nr-data.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-29 -
2024-10-01		 a year crt.sh

This page contains 1 frames:

Primary Page: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Frame ID: A12E27E488CEAC2CC308DB13D7BF364A
Requests: 35 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

VnextCore

Page URL History Show full URLs

  1. http://jaypetersen.medicaplanchoices.com/ Page URL
  2. https://medica1.destinationrx.com/PC/2024/u/MTAwODA0 HTTP 302
    https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

39
Requests

72 %
HTTPS

36 %
IPv6

11
Domains

12
Subdomains

12
IPs

2
Countries

3562 kB
Transfer

13485 kB
Size

10
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://jaypetersen.medicaplanchoices.com/ Page URL
  2. https://medica1.destinationrx.com/PC/2024/u/MTAwODA0 HTTP 302
    https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

39 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
jaypetersen.medicaplanchoices.com/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://jaypetersen.medicaplanchoices.com/
Protocol
HTTP/1.1
Server
216.251.172.86 Minneapolis, United States, ASN12042 (ENVENTIS, US),
Reverse DNS
216.251.172.86.static.consolidated.net
Software
Microsoft-IIS/10.0 / ASP.NET ASP.NET
Resource Hash
0d435202fb84d11be91eedb5dc977c76970bbbaaa9e262ea7f940033c6d07366

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
close
Content-Length
1695
Content-Type
text/html
Date
Thu, 21 Dec 2023 21:23:45 GMT
ETag
"15a5d55ecc98d61:0"
Last-Modified
Fri, 02 Oct 2020 14:57:38 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET ASP.NET
xmp.css
ajax.xmcircle.com/ajax/libs/xmpl/3.1.4/xmp/css/ 		1 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ajax.xmcircle.com/ajax/libs/xmpl/3.1.4/xmp/css/xmp.css
Requested by
Host: jaypetersen.medicaplanchoices.com
URL: http://jaypetersen.medicaplanchoices.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.65.39.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-39-20.ams1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
da9c7703f07e50bccc1dd3fa33c2fb1937835becd92f84f12f7c180063a6ebca

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://jaypetersen.medicaplanchoices.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Thu, 21 Dec 2023 21:22:32 GMT
Via
1.1 b6cf988ed9428ad8492255f2faaacfdc.cloudfront.net (CloudFront)
Last-Modified
Sun, 01 Oct 2023 09:44:04 GMT
Server
AmazonS3
X-Amz-Cf-Pop
AMS1-P1
Age
119
x-amz-server-side-encryption
AES256
ETag
"710009fbafaf89b4ae3c6a9a843fd22b"
X-Cache
Hit from cloudfront
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1434
X-Amz-Cf-Id
LF7jELp_vHWxkewphZ1vfdg3u9PT_TvCQCkTMfjZZF_u72gw8tihBA==
jquery-3.4.1.min.js
code.jquery.com/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.4.1.min.js
Requested by
Host: jaypetersen.medicaplanchoices.com
URL: http://jaypetersen.medicaplanchoices.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://jaypetersen.medicaplanchoices.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:46 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
8391626
x-cache
HIT, HIT
content-length
30638
x-served-by
cache-lga21965-LGA, cache-fra-etou8220105-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1703193826.170754,VS0,VE0
etag
W/"28feccc0-15851"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
454, 185113
xmp.min.js
ajax.xmcircle.com/ajax/libs/xmpl/3.1.4/xmp/js/ 		218 KB
219 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.xmcircle.com/ajax/libs/xmpl/3.1.4/xmp/js/xmp.min.js
Requested by
Host: jaypetersen.medicaplanchoices.com
URL: http://jaypetersen.medicaplanchoices.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.65.39.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-39-20.ams1.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c307a3b767f3338a10b38c9663d4a48f13b13200f61f8ff4dec4b8ba8cf0b67b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://jaypetersen.medicaplanchoices.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Thu, 21 Dec 2023 21:22:32 GMT
Via
1.1 29d6db1b5ecb170f22487453430df556.cloudfront.net (CloudFront)
Last-Modified
Sun, 01 Oct 2023 09:44:06 GMT
Server
AmazonS3
X-Amz-Cf-Pop
AMS1-P1
Age
119
x-amz-server-side-encryption
AES256
ETag
"f376491d7ff886dc9761643fde4a14d0"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
223465
X-Amz-Cf-Id
gJPKKXwUcUOZqo2t8aacEpiL2rwzAxUHG_tHSrlXVPjFQWYwC33_dQ==
xmpcfg.js
jaypetersen.medicaplanchoices.com/ 		307 B
610 B 		Script
General
Check archive.org
Download Go to
Full URL
http://jaypetersen.medicaplanchoices.com/xmpcfg.js
Requested by
Host: jaypetersen.medicaplanchoices.com
URL: http://jaypetersen.medicaplanchoices.com/
Protocol
HTTP/1.1
Server
216.251.172.86 Minneapolis, United States, ASN12042 (ENVENTIS, US),
Reverse DNS
216.251.172.86.static.consolidated.net
Software
Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
5eda985566c7b630de9a4d8f369ee96d235b1a1ee59ecaf2484fd6a50a373683

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://jaypetersen.medicaplanchoices.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Thu, 21 Dec 2023 21:23:45 GMT
Last-Modified
Thu, 01 Oct 2020 00:05:58 GMT
Server
Microsoft-IIS/10.0
ETag
"6720c6a38697d61:0"
X-Powered-By
ASP.NET, ASP.NET
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
307
context
xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
http://xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/context
Protocol
HTTP/1.1
Server
216.251.172.86 Minneapolis, United States, ASN12042 (ENVENTIS, US),
Reverse DNS
216.251.172.86.static.consolidated.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
http://jaypetersen.medicaplanchoices.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Access-Control-Allow-Headers
content-type
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Content-Length
0
Date
Thu, 21 Dec 2023 21:23:45 GMT
Expires
-1
Pragma
no-cache
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
context
xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/ 		153 B
445 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/context
Requested by
Host: ajax.xmcircle.com
URL: https://ajax.xmcircle.com/ajax/libs/xmpl/3.1.4/xmp/js/xmp.min.js
Protocol
HTTP/1.1
Server
216.251.172.86 Minneapolis, United States, ASN12042 (ENVENTIS, US),
Reverse DNS
216.251.172.86.static.consolidated.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
dcf2bfc19a1cd48ce800ea31acaf2991deee0cc8652534bee6a56819325f143a

Request headers

Accept
application/json, text/plain, */*
Referer
http://jaypetersen.medicaplanchoices.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 21 Dec 2023 21:23:45 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Content-Length
153
Expires
-1
context
xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
http://xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/context
Protocol
HTTP/1.1
Server
216.251.172.86 Minneapolis, United States, ASN12042 (ENVENTIS, US),
Reverse DNS
216.251.172.86.static.consolidated.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
http://jaypetersen.medicaplanchoices.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Access-Control-Allow-Headers
content-type
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Content-Length
0
Date
Thu, 21 Dec 2023 21:23:45 GMT
Expires
-1
Pragma
no-cache
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
context
xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/ 		153 B
445 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/context
Requested by
Host: ajax.xmcircle.com
URL: https://ajax.xmcircle.com/ajax/libs/xmpl/3.1.4/xmp/js/xmp.min.js
Protocol
HTTP/1.1
Server
216.251.172.86 Minneapolis, United States, ASN12042 (ENVENTIS, US),
Reverse DNS
216.251.172.86.static.consolidated.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
dcf2bfc19a1cd48ce800ea31acaf2991deee0cc8652534bee6a56819325f143a

Request headers

Accept
application/json, text/plain, */*
Referer
http://jaypetersen.medicaplanchoices.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 21 Dec 2023 21:23:45 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Content-Length
153
Expires
-1
adorValues
xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/d52d4654-289e-4839-b7ea-529397a505e4_17768e00-724e-41fe-b900-37b06bd46733_a669259b29c04975baf8f1457fb64229/ 		74 B
365 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/d52d4654-289e-4839-b7ea-529397a505e4_17768e00-724e-41fe-b900-37b06bd46733_a669259b29c04975baf8f1457fb64229/adorValues?ieNoCache=1703193826810&adors=DestinationPURL&rid=jaypetersen
Requested by
Host: ajax.xmcircle.com
URL: https://ajax.xmcircle.com/ajax/libs/xmpl/3.1.4/xmp/js/xmp.min.js
Protocol
HTTP/1.1
Server
216.251.172.86 Minneapolis, United States, ASN12042 (ENVENTIS, US),
Reverse DNS
216.251.172.86.static.consolidated.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Accept
application/json, text/plain, */*
Referer
http://jaypetersen.medicaplanchoices.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 21 Dec 2023 21:23:46 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Content-Length
74
Expires
-1
events
xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/d52d4654-289e-4839-b7ea-529397a505e4_17768e00-724e-41fe-b900-37b06bd46733_a669259b29c04975baf8f1457fb64229/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
http://xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/d52d4654-289e-4839-b7ea-529397a505e4_17768e00-724e-41fe-b900-37b06bd46733_a669259b29c04975baf8f1457fb64229/events
Protocol
HTTP/1.1
Server
216.251.172.86 Minneapolis, United States, ASN12042 (ENVENTIS, US),
Reverse DNS
216.251.172.86.static.consolidated.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
http://jaypetersen.medicaplanchoices.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Access-Control-Allow-Headers
content-type
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Content-Length
0
Date
Thu, 21 Dec 2023 21:23:45 GMT
Expires
-1
Pragma
no-cache
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
events
xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/d52d4654-289e-4839-b7ea-529397a505e4_17768e00-724e-41fe-b900-37b06bd46733_a669259b29c04975baf8f1457fb64229/ 		0
243 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://xmpie.visionsfirst.com/XMPieXMPL_REST_API/v1/projects/d52d4654-289e-4839-b7ea-529397a505e4_17768e00-724e-41fe-b900-37b06bd46733_a669259b29c04975baf8f1457fb64229/events
Requested by
Host: ajax.xmcircle.com
URL: https://ajax.xmcircle.com/ajax/libs/xmpl/3.1.4/xmp/js/xmp.min.js
Protocol
HTTP/1.1
Server
216.251.172.86 Minneapolis, United States, ASN12042 (ENVENTIS, US),
Reverse DNS
216.251.172.86.static.consolidated.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json, text/plain, */*
Referer
http://jaypetersen.medicaplanchoices.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 21 Dec 2023 21:23:46 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Content-Length
0
Expires
-1
Primary Request 2024
medica1.destinationrx.com/PC/
Redirect Chain
  • https://medica1.destinationrx.com/PC/2024/u/MTAwODA0
  • https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
66 KB
67 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Requested by
Host: jaypetersen.medicaplanchoices.com
URL: http://jaypetersen.medicaplanchoices.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
74.80.246.60 , United States, ASN394428 (CONNECTURE-156, US),
Reverse DNS
*.destinationrx.com
Software
/
Resource Hash
eab6896d32d90ddb7683cf7dc5c29bb4893584bbc9c09798053385883e905631
Security Headers
Name Value
Content-Security-Policy default-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; script-src https: data: 'unsafe-eval' 'unsafe-inline'; img-src https: data:; style-src https: data: 'unsafe-eval' 'unsafe-inline'; connect-src https: data: wss:; font-src https: data:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://jaypetersen.medicaplanchoices.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
private
Content-Length
68040
Content-Security-Policy
default-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; script-src https: data: 'unsafe-eval' 'unsafe-inline'; img-src https: data:; style-src https: data: 'unsafe-eval' 'unsafe-inline'; connect-src https: data: wss:; font-src https: data:; upgrade-insecure-requests;
Content-Type
text/html; charset=utf-8
Date
Thu, 21 Dec 2023 21:23:47 GMT
P3P
CP="OTI DSP COR ADM DEVo TAIi PSA IVDi CONi TELi OUR IND CNT CAO"
Strict-Transport-Security
max-age=31536000; includeSubdomains
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block

Redirect headers

Cache-Control
no-cache
Content-Length
0
Content-Security-Policy
default-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; script-src https: data: 'unsafe-eval' 'unsafe-inline'; img-src https: data:; style-src https: data: 'unsafe-eval' 'unsafe-inline'; connect-src https: data: wss:; font-src https: data:; upgrade-insecure-requests;
Date
Thu, 21 Dec 2023 21:23:47 GMT
Expires
-1
Location
https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
P3P
CP="OTI DSP COR ADM DEVo TAIi PSA IVDi CONi TELi OUR IND CNT CAO"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubdomains
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
gtm.js
www.googletagmanager.com/ 		456 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-K3J8MGD&l=dataLayerDrx
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
82db667e82034259b8ece30dfa8d8e917595280906e588ba7fc6892a5f501fb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:48 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
118097
x-xss-protection
0
last-modified
Thu, 21 Dec 2023 21:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 21 Dec 2023 21:23:48 GMT
js
www.googletagmanager.com/gtag/ 		217 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-1WLP1HX0QB&l=dataLayerDrx&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3J8MGD&l=dataLayerDrx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5f76af76fc2f66b93bb369cc8af1bced9476aa1caf8e475bdf05e0a2db33d1f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:48 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
79360
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 21 Dec 2023 21:23:48 GMT
js
www.googletagmanager.com/gtag/ 		203 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-S79JWFNLJM&l=dataLayerDrx&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3J8MGD&l=dataLayerDrx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5f29bbfbe9e47a7b2917c677f34f47e1720cdfdd10a3e2b3bfcc3a5975af6cef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:48 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
75529
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 21 Dec 2023 21:23:48 GMT
marck-script.regular.ttf
contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/ 		82 KB
36 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/marck-script.regular.ttf
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
504de8cc6f919163bc9afb67b9bc208d258230c5e8d00cb82ec52474f9fafc3b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://medica1.destinationrx.com/
Origin
https://medica1.destinationrx.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:48 GMT
content-encoding
br
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
AMS58-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 28 Sep 2023 03:08:23 GMT
server
AmazonS3
etag
W/"8213f9f79159ce265b433a91528304b7"
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
max-age=604800, stale-while-revalidate=86400
x-amz-cf-id
lTLI8mRRkVbWp1TE7v9E-m0Sp6TBhNuQlhKsKzD3APhI_I7S2vz1RA==
montserrat-regular.ttf
contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/ 		257 KB
100 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/montserrat-regular.ttf
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
81ebc3916b524007b756d91d9df13c7673ec401161f2cad161662d08dcf1cc72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://medica1.destinationrx.com/
Origin
https://medica1.destinationrx.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:48 GMT
content-encoding
br
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
AMS58-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 28 Sep 2023 03:08:26 GMT
server
AmazonS3
etag
W/"9c46095118380d38f12e67c916b427f9"
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
max-age=604800, stale-while-revalidate=86400
x-amz-cf-id
PnkgrKyNEe6F5q0f877a0NF3Io7s7dd8pffOA6IXWmvLVw_7KIuPjw==
montserrat-bold.ttf
contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/ 		255 KB
100 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/montserrat-bold.ttf
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c4c8cb572a5a2c43d78b3701f4b2349684e6ca4d1557e469af6065b1e099c26c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://medica1.destinationrx.com/
Origin
https://medica1.destinationrx.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:48 GMT
content-encoding
br
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
AMS58-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 28 Sep 2023 03:08:24 GMT
server
AmazonS3
etag
W/"88932dadc42e1bba93b21a76de60ef7a"
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
max-age=604800, stale-while-revalidate=86400
x-amz-cf-id
D35LfC89-e4JJzjY0VaTGRVyNuOlgarKWVbIkQBAnqicVi63zG971g==
montserrat-light.ttf
contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/ 		253 KB
99 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/montserrat-light.ttf
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9b87925d061b1affb66417717731ad781f7d7678fb089b49f14bd922c2338559
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://medica1.destinationrx.com/
Origin
https://medica1.destinationrx.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:48 GMT
content-encoding
br
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
AMS58-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 28 Sep 2023 03:08:25 GMT
server
AmazonS3
etag
W/"100b38fa184634fc89bd07a84453992c"
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
max-age=604800, stale-while-revalidate=86400
x-amz-cf-id
3-DTD2jTEoPKUs-rK5ClLeo-l9oholSsNVNR0xuxipLN0aOuFfMesA==
montserrat-semibold.ttf
contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/ 		255 KB
99 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/drxproductcontent/phoenix/assets/fonts/montserrat-semibold.ttf
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bab583d38d105dac9141b287fb2b7763b6d8b0bae97e745faaccedb40a579c29
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://medica1.destinationrx.com/
Origin
https://medica1.destinationrx.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:48 GMT
content-encoding
br
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
AMS58-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 28 Sep 2023 03:08:27 GMT
server
AmazonS3
etag
W/"c88cecbffad6d8e731fd95de49561ebd"
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
max-age=604800, stale-while-revalidate=86400
x-amz-cf-id
Z8spKH_W6QZGEwyYbtGjG6x8yIGf2Jv5ECMJzChhzj32vvWqqt3ddQ==
styles.c84d1d6f27b17e82.css
contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/ 		416 KB
68 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/styles.c84d1d6f27b17e82.css
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
21a04334e6055d0052f05a59cf6c21c4ded76365c8ba6802c902524392433f15
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:49 GMT
content-encoding
br
via
1.1 1d10719558a2481e0d462e12964f647a.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Thu, 26 Oct 2023 04:32:40 GMT
server
AmazonS3
x-amz-cf-pop
AMS58-P1
etag
W/"4092507ff44fc78d85fed7666d7e1085"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Miss from cloudfront
content-type
text/css
cache-control
max-age=604800, stale-while-revalidate=86400
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
aCWVY9RuhzsqObC0bxdrQowytMxfwhGZUo_bGFkCRayQ3ZplqXra4w==
runtime.bcd7d7b898a9a226.js
contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/runtime.bcd7d7b898a9a226.js
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9a52bba5569ebbf24fa20be5d9416775356dfeaac1f9df9f5bb1042d7e590559
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://medica1.destinationrx.com/
Origin
https://medica1.destinationrx.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:49 GMT
content-encoding
br
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
AMS58-P1
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 26 Oct 2023 04:32:40 GMT
server
AmazonS3
etag
W/"a394bef597479c645d277d3264fddcde"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=604800, stale-while-revalidate=86400
x-amz-cf-id
Iy2oiZ6OJmkw-5wFyHvKMG4S-NpZfRtTc6-0SqNSlAo_XNd-yySMVw==
polyfills.4fd0315ef20ed280.js
contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/ 		76 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/polyfills.4fd0315ef20ed280.js
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
210f87385c0ae69272e88abc6f13e26eebb0b54c2db5632d2d1957193957df33
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://medica1.destinationrx.com/
Origin
https://medica1.destinationrx.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:49 GMT
content-encoding
br
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
AMS58-P1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 26 Oct 2023 04:32:40 GMT
server
AmazonS3
etag
W/"f8f99f66984a4d56259e310b3364327d"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=604800, stale-while-revalidate=86400
x-amz-cf-id
JS_11FhmpGD_0JM5sUbPGgLOSYHeW34jxxuEc9M9XAYzmK4hU2pAgw==
scripts.ff71a2b601bb6275.js
contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/ 		1 MB
325 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/scripts.ff71a2b601bb6275.js
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0e08bb664c281a255672f1afa97414cb9bef4aeea6b88498402ec92a59ce6f96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:49 GMT
content-encoding
br
via
1.1 1d10719558a2481e0d462e12964f647a.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Thu, 26 Oct 2023 04:32:40 GMT
server
AmazonS3
x-amz-cf-pop
AMS58-P1
etag
W/"d8439efa8bf1a8011dcd65e755ac744b"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Miss from cloudfront
content-type
application/x-javascript
cache-control
max-age=604800, stale-while-revalidate=86400
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
g_hwZTw5BRZoSkK-e-NNa6uSCuiUp0AvZ9CIB4k77AQdKZq5OmGq2A==
main.1a91d728e52713d3.js
contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/ 		8 MB
1 MB 		Script
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/main.1a91d728e52713d3.js
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f160ada453c80bcce39b7cb273b4393954efd51cd36f15dccbc38ba8268fb14a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://medica1.destinationrx.com/
Origin
https://medica1.destinationrx.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:49 GMT
content-encoding
br
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
AMS58-P1
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 26 Oct 2023 04:32:40 GMT
server
AmazonS3
etag
W/"6ed66774e3c07e0231cbeee7b1c0f53c"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=604800, stale-while-revalidate=86400
x-amz-cf-id
0NUzLATdOnN1ZjcYw1KebsNK5cWMblPiYmmj2Enh0TVIFFDd60xpQA==
gtm.js
www.googletagmanager.com/ 		205 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-M7FTVT9
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
acb28a98a365af88152f46147eb27d306ca8ce4612a6344519c790b5bde1387e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:48 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
69309
x-xss-protection
0
last-modified
Thu, 21 Dec 2023 21:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 21 Dec 2023 21:23:48 GMT
tealium_collect.min.js
tags.tiqcdn.com/libs/tealiumjs/latest/ 		29 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/libs/tealiumjs/latest/tealium_collect.min.js
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:238d:3600:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
a4b00fdde3755ae53be3e7e3e4a534d48cebf98203b772bf4d1eb94f07827455

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:22:03 GMT
content-encoding
gzip
via
1.1 13a0a1a7b326f5c854b35536576cfe0e.cloudfront.net (CloudFront)
last-modified
Thu, 03 Aug 2023 11:46:41 GMT
server
AkamaiNetStorage
x-amz-cf-pop
AMS1-P1
age
272
etag
W/"1489c947cb2e335aaf6536467f459937:1691063201.59585"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
10942
x-amz-cf-id
HLap6Bg6hsBD_Hu81ZA1Wahn9-XsXwPKEf0lt1ifEpC8Mo3qwKtshA==
i.gif
collect.tealiumiq.com/medica/main/2/ 		43 B
758 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collect.tealiumiq.com/medica/main/2/i.gif
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.90.183 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-90-183.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://medica1.destinationrx.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryN5PnWkhdkI8Vg9HB

Response headers

date
Thu, 21 Dec 2023 21:23:49 GMT
x-serverid
uconnect_i-0460546fbb8faca4f
x-tid
118c8e435e92347868224431861443674385b6c4af0
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc
medica:main:2:datacloud
x-region
eu-central-1
content-length
43
pragma
no-cache
x-did
118c8e435e92347868224431861443674385b6c4af0
vary
Origin
content-type
image/gif
access-control-allow-origin
https://medica1.destinationrx.com
x-ulver
eea0e3e72333670598197c274b6e00dfd7c24755-SNAPSHOT
access-control-expose-headers
X-Region
cache-control
no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials
true
x-uuid
b5e5dbde-dc10-4248-85a0-3fd9ac7548cd
expires
Thu, 21 Dec 2023 21:23:49 GMT
styles.c84d1d6f27b17e82.css
contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/ 		416 KB
68 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/styles.c84d1d6f27b17e82.css
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
21a04334e6055d0052f05a59cf6c21c4ded76365c8ba6802c902524392433f15
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:50 GMT
content-encoding
br
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Thu, 26 Oct 2023 04:32:40 GMT
server
AmazonS3
x-amz-cf-pop
AMS58-P1
etag
W/"4092507ff44fc78d85fed7666d7e1085"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/css
cache-control
max-age=604800, stale-while-revalidate=86400
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
EOmm0X__3n1TgkGRLi4F1iND7qA_Ki3Eavivp5804SPEwUiKrc8D5A==
token
www.drxwebservices.com/spa2024/oauth2/v1/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.drxwebservices.com/spa2024/oauth2/v1/token
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
74.80.246.30 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src https: data: 'unsafe-eval' 'unsafe-inline'; img-src https: data:; style-src https: data: 'unsafe-eval' 'unsafe-inline'; connect-src https: data:; font-src https: data:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://medica1.destinationrx.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Access-Control-Allow-Headers
content-type
Access-Control-Allow-Origin
https://medica1.destinationrx.com
Access-Control-Expose-Headers
Set-Authorization, Set-Authorization-Expires-In
Cache-Control
no-cache
Content-Length
0
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src https: data: 'unsafe-eval' 'unsafe-inline'; img-src https: data:; style-src https: data: 'unsafe-eval' 'unsafe-inline'; connect-src https: data:; font-src https: data:; upgrade-insecure-requests;
Date
Thu, 21 Dec 2023 21:23:50 GMT
Expires
-1
P3P
CP="OTI DSP COR ADM DEVo TAIi PSA IVDi CONi TELi OUR IND CNT CAO"
Pragma
no-cache
Server
Microsoft-IIS/10.0
Strict-Transport-Security
max-age=31536000; includeSubdomains
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
woman_child_baking_desktop_01222020111058690.jpg
contentserver.destinationrx.com/ContentServer/DRxProductContent/pc4_clientimages/0_1fc06ab51322ea11a2fc00505696c194/ 		385 KB
385 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contentserver.destinationrx.com/ContentServer/DRxProductContent/pc4_clientimages/0_1fc06ab51322ea11a2fc00505696c194/woman_child_baking_desktop_01222020111058690.jpg
Requested by
Host: contentserver.destinationrx.com
URL: https://contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/main.1a91d728e52713d3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
494769ca7cd7121d2e4680f150ed41735390f63f40e8f9cdb0e1830c0cea9639
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:51 GMT
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Thu, 23 Jan 2020 07:11:00 GMT
server
AmazonS3
x-amz-cf-pop
AMS58-P1
etag
"9bab07ad20251247f7f1ceeb01c4fb01"
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=604800, stale-while-revalidate=86400
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
393744
x-amz-cf-id
nflBu60VkItCZJaCDLEoTHHJcYI2G4EwqaDBzdnqWHhPbDHlf1RqFQ==
woman_child_baking_mobile_01222020111059734.jpg
contentserver.destinationrx.com/ContentServer/DRxProductContent/pc4_clientimages/0_1fc06ab51322ea11a2fc00505696c194/ 		102 KB
102 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contentserver.destinationrx.com/ContentServer/DRxProductContent/pc4_clientimages/0_1fc06ab51322ea11a2fc00505696c194/woman_child_baking_mobile_01222020111059734.jpg
Requested by
Host: contentserver.destinationrx.com
URL: https://contentserver.destinationrx.com/vnext/3f8a813dbefb87bd110ee63cf3d2ede7babfb8b8a16293d476a986760b4b3aab/638338914492507128/main.1a91d728e52713d3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:9000:2090:b600:9:f936:20c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c5a80ca875e0d3a3ac51d14cc678fcbefc8cc5eaa226258be421627058964b22
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://medica1.destinationrx.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 21:23:51 GMT
via
1.1 4c691f43539bb56ddcaef755730a6e86.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Thu, 23 Jan 2020 07:11:00 GMT
server
AmazonS3
x-amz-cf-pop
AMS58-P1
etag
"1dac99692d86f6c26be5bda0ee2d9af2"
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=604800, stale-while-revalidate=86400
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
104221
x-amz-cf-id
0mbaxs0eUuomwZh3utSZexTzD3JBU6cypHCGYMpeI4J31ggVMcNG9w==
token
www.drxwebservices.com/spa2024/oauth2/v1/ 		718 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.drxwebservices.com/spa2024/oauth2/v1/token
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
74.80.246.30 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
923a6209ce2d6a3d5387de30f908743923f1669541fd0ce89f39ac03c7dc8bcf
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src https: data: 'unsafe-eval' 'unsafe-inline'; img-src https: data:; style-src https: data: 'unsafe-eval' 'unsafe-inline'; connect-src https: data:; font-src https: data:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
Referer
https://medica1.destinationrx.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubdomains
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src https: data: 'unsafe-eval' 'unsafe-inline'; img-src https: data:; style-src https: data: 'unsafe-eval' 'unsafe-inline'; connect-src https: data:; font-src https: data:; upgrade-insecure-requests;
X-Content-Type-Options
nosniff
Date
Thu, 21 Dec 2023 21:23:50 GMT
Server
Microsoft-IIS/10.0
X-Frame-Options
SAMEORIGIN
P3P
CP="OTI DSP COR ADM DEVo TAIi PSA IVDi CONi TELi OUR IND CNT CAO"
Access-Control-Allow-Origin
https://medica1.destinationrx.com
Content-Type
application/json; charset=utf-8
Cache-Control
no-cache
Access-Control-Expose-Headers
Set-Authorization, Set-Authorization-Expires-In
Content-Length
718
X-XSS-Protection
1; mode=block
Expires
-1
nr-spa-1.249.0.min.js
js-agent.newrelic.com/ 		87 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-spa-1.249.0.min.js
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
264956d1864215422fb0cf7906731f333cda073f4007ba32f1b9321ff79a9c52
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Referer
https://medica1.destinationrx.com/
Origin
https://medica1.destinationrx.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id
xqhkUaUJHWINEJM5PSle_YSi.Q2oCtRJ
content-encoding
br
via
1.1 varnish
date
Thu, 21 Dec 2023 21:23:51 GMT
strict-transport-security
max-age=300
x-amz-request-id
CW8BBHHC6P19P5WC
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
29447
x-amz-id-2
vl0/BrwKm+DYEMseoie0sXz9zqQD0icoNjyve71zB4hD4lAMXcerjt2ukwQQmWNqc8J5gPKD6os=
x-served-by
cache-fra-etou8220060-FRA
last-modified
Thu, 14 Dec 2023 16:36:09 GMT
server
AmazonS3
x-timer
S1703193831.380190,VS0,VE0
etag
"a42a1870225259a5447c6b5e0ebad53c"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges
bytes
x-cache-hits
235043
cac7b39d3e
bam.nr-data.net/1/ 		40 B
413 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/cac7b39d3e?a=540002477,236081898,16171334&v=1.249.0&to=YgFVYRRSXBFZUxBYXVtLemMlHGANV0QnXlxBFlhZClZATXFeAFRKdBdOWwU%3D&rst=4184&ck=0&s=2bdc13dedb3c12d0&ref=https://medica1.destinationrx.com/PC/2024&af=err,xhr,stn,ins,spa&ap=456&be=1303&fe=2834&dc=2755&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1703193827216,%22n%22:0,%22r%22:0,%22re%22:734,%22f%22:734,%22dn%22:734,%22dne%22:734,%22c%22:734,%22s%22:734,%22ce%22:734,%22rq%22:735,%22rp%22:1304,%22rpe%22:1519,%22di%22:1536,%22ds%22:4058,%22de%22:4058,%22dc%22:4136,%22l%22:4136,%22le%22:4137%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=1591
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f

Request headers

Referer
https://medica1.destinationrx.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
content-type
text/plain

Response headers

date
Thu, 21 Dec 2023 21:23:51 GMT
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
content-type
text/plain
access-control-allow-origin
https://medica1.destinationrx.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
Connection
keep-alive
Content-Length
40
x-served-by
cache-fra-etou8220031-FRA
values:check
medica1.destinationrx.com/PC/2024/o/saml2/ 		18 B
728 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://medica1.destinationrx.com/PC/2024/o/saml2/values:check
Requested by
Host: medica1.destinationrx.com
URL: https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
74.80.246.60 , United States, ASN394428 (CONNECTURE-156, US),
Reverse DNS
*.destinationrx.com
Software
/
Resource Hash
631f4d836f9d199ee9721cc528112d8b61d2b90455bb214dd364596b487fe6b6
Security Headers
Name Value
Content-Security-Policy default-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; script-src https: data: 'unsafe-eval' 'unsafe-inline'; img-src https: data:; style-src https: data: 'unsafe-eval' 'unsafe-inline'; connect-src https: data: wss:; font-src https: data:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

X-NewRelic-ID
UA4HVFZADQcAVFFQAwYA
tracestate
48050@nr=0-1-48050-594414579-06136c8f9879fb70----1703193831865
traceparent
00-e46e1af5200362e829d0d3d1f888f190-06136c8f9879fb70-01
accept-language
de-DE,de;q=0.9
Authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzYjphcHBfaWQiOiI0MjQwMTI2MDEiLCJzYjpkb21haW4iOiJNZWRpY2FfQnJva2VyQ0NEdWFsX1BST0QiLCJzYjpwbGFueWVhciI6IjIwMjQiLCJzYjpsbWEiOiI1Iiwic2I6bGtfc2VjIjoiOTAwIiwic2I6bGtfZW4iOiJUcnVlIiwic2I6cGhhcm1fbGltaXQiOiI1Iiwic2I6YWdlbmN5X2VuIjoiRmFsc2UiLCJzdWIiOiJVSjN4bXdVSkVlNkd1UUJRVnIyMTVnIiwic2I6ZW52IjoiUFJPRCIsInNiOnNpdGVfdHlwZSI6ImNvbnN1bWVyIiwic2I6bWF4X3RvdHAiOiI1IiwiY2xpZW50X2lkIjoiMTI2IiwibmJmIjoxNzAzMTkzODMxLCJleHAiOjE3MDMyMDEwMzEsImlhdCI6MTcwMzE5MzgzMSwiaXNzIjoiaHR0cHM6Ly93d3cuZHJ4d2Vic2VydmljZXMuY29tL1NQQTIwMjQvIiwiYXVkIjoiaHR0cHM6Ly93d3cuZHJ4d2Vic2VydmljZXMuY29tL3NwYTIwMjQifQ.4DpFFeDCBqnCWrlp-Qm2kpOTUzBZ3QJ28QsXFi2Ajvo
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjQ4MDUwIiwiYXAiOiI1OTQ0MTQ1NzkiLCJpZCI6IjA2MTM2YzhmOTg3OWZiNzAiLCJ0ciI6ImU0NmUxYWY1MjAwMzYyZTgyOWQwZDNkMWY4ODhmMTkwIiwidGkiOjE3MDMxOTM4MzE4NjV9fQ==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Accept
application/json, text/plain, */*
Referer
https://medica1.destinationrx.com/PC/2024?utm_source=pc1&utm_medium=email&utm_campaign=bpml

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubdomains
Content-Security-Policy
default-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; script-src https: data: 'unsafe-eval' 'unsafe-inline'; img-src https: data:; style-src https: data: 'unsafe-eval' 'unsafe-inline'; connect-src https: data: wss:; font-src https: data:; upgrade-insecure-requests;
X-Content-Type-Options
nosniff
Date
Thu, 21 Dec 2023 21:23:51 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
application/json; charset=utf-8
P3P
CP="OTI DSP COR ADM DEVo TAIi PSA IVDi CONi TELi OUR IND CNT CAO"
Cache-Control
no-cache
Content-Length
18
X-XSS-Protection
1; mode=block
Expires
-1
cac7b39d3e
bam.nr-data.net/events/1/ 		0
0
values
medica1.destinationrx.com/PC/2024/o/saml2/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
bam.nr-data.net
URL
https://bam.nr-data.net/events/1/cac7b39d3e?a=540002477,236081898,16171334&v=1.249.0&to=YgFVYRRSXBFZUxBYXVtLemMlHGANV0QnXlxBFlhZClZATXFeAFRKdBdOWwU%3D&rst=4762&ck=0&s=2bdc13dedb3c12d0&ref=https://medica1.destinationrx.com/PC/2024
Domain
medica1.destinationrx.com
URL
https://medica1.destinationrx.com/PC/2024/o/saml2/values

Verdicts & Comments Add Verdict or Comment

169 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| dataLayerDrx object| NREUM object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data object| gaGlobal object| webpackChunk:NRBA-1.249.0.PROD object| newrelic string| gtmDomain string| gtmClientContainer object| dataLayer object| tealium function| Tealium object| TEAL object| webpackChunkvnext_core object| __core-js_shared__ object| core object| global object| System function| asap function| Observable object| __zone_symbol__UNPATCHED_EVENTS function| Zone function| __zone_symbol__Promise function| __zone_symbol__fetch object| __zone_symbol__BLACK_LISTED_EVENTS function| __zone_symbol__queueMicrotask function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| __zone_symbol__ononsearchpatched boolean| __zone_symbol__ononappinstalledpatched boolean| __zone_symbol__ononbeforeinstallpromptpatched boolean| __zone_symbol__ononbeforexrselectpatched boolean| __zone_symbol__ononabortpatched boolean| __zone_symbol__ononbeforeinputpatched boolean| __zone_symbol__ononbeforetogglepatched boolean| __zone_symbol__ononblurpatched boolean| __zone_symbol__ononcancelpatched boolean| __zone_symbol__ononcanplaypatched boolean| __zone_symbol__ononcanplaythroughpatched boolean| __zone_symbol__ononchangepatched boolean| __zone_symbol__ononclickpatched boolean| __zone_symbol__ononclosepatched boolean| __zone_symbol__ononcontextlostpatched boolean| __zone_symbol__ononcontextmenupatched boolean| __zone_symbol__ononcontextrestoredpatched boolean| __zone_symbol__ononcuechangepatched boolean| __zone_symbol__onondblclickpatched boolean| __zone_symbol__onondragpatched boolean| __zone_symbol__onondragendpatched boolean| __zone_symbol__onondragenterpatched boolean| __zone_symbol__onondragleavepatched boolean| __zone_symbol__onondragoverpatched boolean| __zone_symbol__onondragstartpatched boolean| __zone_symbol__onondroppatched boolean| __zone_symbol__onondurationchangepatched boolean| __zone_symbol__ononemptiedpatched boolean| __zone_symbol__ononendedpatched boolean| __zone_symbol__ononerrorpatched boolean| __zone_symbol__ononfocuspatched boolean| __zone_symbol__ononformdatapatched boolean| __zone_symbol__ononinputpatched boolean| __zone_symbol__ononinvalidpatched boolean| __zone_symbol__ononkeydownpatched boolean| __zone_symbol__ononkeypresspatched boolean| __zone_symbol__ononkeyuppatched boolean| __zone_symbol__ononloadpatched boolean| __zone_symbol__ononloadeddatapatched boolean| __zone_symbol__ononloadedmetadatapatched boolean| __zone_symbol__ononloadstartpatched boolean| __zone_symbol__ononmousedownpatched boolean| __zone_symbol__ononmouseenterpatched boolean| __zone_symbol__ononmouseleavepatched boolean| __zone_symbol__ononmousemovepatched boolean| __zone_symbol__ononmouseoutpatched boolean| __zone_symbol__ononmouseoverpatched boolean| __zone_symbol__ononmouseuppatched boolean| __zone_symbol__ononmousewheelpatched boolean| __zone_symbol__ononpausepatched boolean| __zone_symbol__ononplaypatched boolean| __zone_symbol__ononplayingpatched boolean| __zone_symbol__ononprogresspatched boolean| __zone_symbol__ononratechangepatched boolean| __zone_symbol__ononresetpatched boolean| __zone_symbol__ononresizepatched boolean| __zone_symbol__ononscrollpatched boolean| __zone_symbol__ononsecuritypolicyviolationpatched boolean| __zone_symbol__ononseekedpatched boolean| __zone_symbol__ononseekingpatched boolean| __zone_symbol__ononselectpatched boolean| __zone_symbol__ononslotchangepatched boolean| __zone_symbol__ononstalledpatched boolean| __zone_symbol__ononsubmitpatched boolean| __zone_symbol__ononsuspendpatched boolean| __zone_symbol__onontimeupdatepatched boolean| __zone_symbol__onontogglepatched boolean| __zone_symbol__ononvolumechangepatched boolean| __zone_symbol__ononwaitingpatched boolean| __zone_symbol__ononwebkitanimationendpatched boolean| __zone_symbol__ononwebkitanimationiterationpatched boolean| __zone_symbol__ononwebkitanimationstartpatched boolean| __zone_symbol__ononwebkittransitionendpatched boolean| __zone_symbol__ononwheelpatched boolean| __zone_symbol__ononauxclickpatched boolean| __zone_symbol__onongotpointercapturepatched boolean| __zone_symbol__ononlostpointercapturepatched boolean| __zone_symbol__ononpointerdownpatched boolean| __zone_symbol__ononpointermovepatched boolean| __zone_symbol__ononpointerrawupdatepatched boolean| __zone_symbol__ononpointeruppatched boolean| __zone_symbol__ononpointercancelpatched boolean| __zone_symbol__ononpointeroverpatched boolean| __zone_symbol__ononpointeroutpatched boolean| __zone_symbol__ononpointerenterpatched boolean| __zone_symbol__ononpointerleavepatched boolean| __zone_symbol__ononselectstartpatched boolean| __zone_symbol__ononselectionchangepatched boolean| __zone_symbol__ononanimationendpatched boolean| __zone_symbol__ononanimationiterationpatched boolean| __zone_symbol__ononanimationstartpatched boolean| __zone_symbol__onontransitionrunpatched boolean| __zone_symbol__onontransitionstartpatched boolean| __zone_symbol__onontransitionendpatched boolean| __zone_symbol__onontransitioncancelpatched boolean| __zone_symbol__ononafterprintpatched boolean| __zone_symbol__ononbeforeprintpatched boolean| __zone_symbol__ononbeforeunloadpatched boolean| __zone_symbol__ononhashchangepatched boolean| __zone_symbol__ononlanguagechangepatched boolean| __zone_symbol__ononmessagepatched boolean| __zone_symbol__ononmessageerrorpatched boolean| __zone_symbol__ononofflinepatched boolean| __zone_symbol__onononlinepatched boolean| __zone_symbol__ononpagehidepatched boolean| __zone_symbol__ononpageshowpatched boolean| __zone_symbol__ononpopstatepatched boolean| __zone_symbol__ononrejectionhandledpatched boolean| __zone_symbol__ononstoragepatched boolean| __zone_symbol__ononunhandledrejectionpatched boolean| __zone_symbol__ononunloadpatched boolean| __zone_symbol__onondevicemotionpatched boolean| __zone_symbol__onondeviceorientationpatched boolean| __zone_symbol__onondeviceorientationabsolutepatched boolean| __zone_symbol__ononbeforematchpatched boolean| __zone_symbol__ononcontentvisibilityautostatechangepatched boolean| __zone_symbol__ononscrollendpatched function| $localize object| process function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener undefined| __zone_symbol__eventListeners undefined| __zone_symbol__removeAllListeners function| eventListeners function| removeAllListeners

10 Cookies

Domain/Path Name / Value
medica1.destinationrx.com/PC Name: session_campaign
Value: bpml
medica1.destinationrx.com/PC Name: session_source
Value: pc1
medica1.destinationrx.com/PC Name: session_medium
Value: email
jaypetersen.medicaplanchoices.com/ Name: xmpServiceToken
Value: d52d4654-289e-4839-b7ea-529397a505e4_17768e00-724e-41fe-b900-37b06bd46733_a669259b29c04975baf8f1457fb64229
jaypetersen.medicaplanchoices.com/ Name: xmpRecipientID
Value: jaypetersen
medica1.destinationrx.com/ Name: integration.data+pc.2024
Value: eyJzdGF0ZSI6eyJhZ2VudFVzZXJuYW1lIjoiMTAwODA0IiwidXNlcnR5cGUiOiJDb25zdW1lciJ9LCJpbnRlZ3JhdGlvbiI6e30sInJlbGF5U3RhdGUiOiJodHRwczovL21lZGljYTEuZGVzdGluYXRpb25yeC5jb206NDQzL1BDLzIwMjQ/dXRtX3NvdXJjZT1wYzEmdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249YnBtbCIsInNvdXJjZSI6IkJyb2tlclVSTCJ9
.destinationrx.com/ Name: SXID
Value: dsizsrx33o3syhl0spov5f0p
medica1.destinationrx.com/ Name: site+pc.2024
Value: eyJpZCI6IlVKM3htd1VKRWU2R3VRQlFWcjIxNWciLCJyIjoiNjM4MzM4OTE0NDkyNTA3MTI4IiwiaCI6IjNmOGE4MTNkYmVmYjg3YmQxMTBlZTYzY2YzZDJlZGU3YmFiZmI4YjhhMTYyOTNkNDc2YTk4Njc2MGI0YjNhYWIifQ==
.destinationrx.com/ Name: TEAL
Value: v:118c8e435e92347868224431861443674385b6c4af0$t:1703195629012$s:1703193829011%3Bexp-sess$sn:1$en:1
.tealiumiq.com/ Name: TAPID
Value: medica/main>118c8e435e92347868224431861443674385b6c4af0|

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.xmcircle.com
bam.nr-data.net
code.jquery.com
collect.tealiumiq.com
contentserver.destinationrx.com
jaypetersen.medicaplanchoices.com
js-agent.newrelic.com
medica1.destinationrx.com
tags.tiqcdn.com
www.drxwebservices.com
www.googletagmanager.com
xmpie.visionsfirst.com
bam.nr-data.net
medica1.destinationrx.com
151.101.194.137
162.247.243.29
18.159.90.183
18.65.39.20
216.251.172.86
2600:9000:2090:b600:9:f936:20c0:93a1
2600:9000:238d:3600:7:2bfb:7c00:93a1
2a00:1450:4001:80e::2008
2a04:4e42:200::649
74.80.246.30
74.80.246.60
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0d435202fb84d11be91eedb5dc977c76970bbbaaa9e262ea7f940033c6d07366
0e08bb664c281a255672f1afa97414cb9bef4aeea6b88498402ec92a59ce6f96
210f87385c0ae69272e88abc6f13e26eebb0b54c2db5632d2d1957193957df33
21a04334e6055d0052f05a59cf6c21c4ded76365c8ba6802c902524392433f15
264956d1864215422fb0cf7906731f333cda073f4007ba32f1b9321ff79a9c52
494769ca7cd7121d2e4680f150ed41735390f63f40e8f9cdb0e1830c0cea9639
504de8cc6f919163bc9afb67b9bc208d258230c5e8d00cb82ec52474f9fafc3b
5eda985566c7b630de9a4d8f369ee96d235b1a1ee59ecaf2484fd6a50a373683
5f29bbfbe9e47a7b2917c677f34f47e1720cdfdd10a3e2b3bfcc3a5975af6cef
5f76af76fc2f66b93bb369cc8af1bced9476aa1caf8e475bdf05e0a2db33d1f4
631f4d836f9d199ee9721cc528112d8b61d2b90455bb214dd364596b487fe6b6
81ebc3916b524007b756d91d9df13c7673ec401161f2cad161662d08dcf1cc72
82db667e82034259b8ece30dfa8d8e917595280906e588ba7fc6892a5f501fb7
923a6209ce2d6a3d5387de30f908743923f1669541fd0ce89f39ac03c7dc8bcf
9a52bba5569ebbf24fa20be5d9416775356dfeaac1f9df9f5bb1042d7e590559
9b87925d061b1affb66417717731ad781f7d7678fb089b49f14bd922c2338559
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a4b00fdde3755ae53be3e7e3e4a534d48cebf98203b772bf4d1eb94f07827455
acb28a98a365af88152f46147eb27d306ca8ce4612a6344519c790b5bde1387e
bab583d38d105dac9141b287fb2b7763b6d8b0bae97e745faaccedb40a579c29
c307a3b767f3338a10b38c9663d4a48f13b13200f61f8ff4dec4b8ba8cf0b67b
c4c8cb572a5a2c43d78b3701f4b2349684e6ca4d1557e469af6065b1e099c26c
c5a80ca875e0d3a3ac51d14cc678fcbefc8cc5eaa226258be421627058964b22
c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f
da9c7703f07e50bccc1dd3fa33c2fb1937835becd92f84f12f7c180063a6ebca
dcf2bfc19a1cd48ce800ea31acaf2991deee0cc8652534bee6a56819325f143a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eab6896d32d90ddb7683cf7dc5c29bb4893584bbc9c09798053385883e905631
f160ada453c80bcce39b7cb273b4393954efd51cd36f15dccbc38ba8268fb14a