urlscan.io logo urlscan.io
SecurityTrails logo

www.benefitseverydayfair.com Open in urlscan Pro
205.156.141.241  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.benefitseverydayfair.com/
Effective URL: https://www.benefitseverydayfair.com/public/welcome
Submission: On October 25 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 1 countries across 3 domains to perform 28 HTTP transactions. The main IP is 205.156.141.241, located in United States and belongs to MMC, US. The main domain is www.benefitseverydayfair.com.
TLS certificate: Issued by COMODO RSA Organization Validation Se... on May 15th 2023. Valid for: a year.
This is the only time www.benefitseverydayfair.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 13 205.156.141.241 17161 (MMC)
7 13.225.78.57 16509 (AMAZON-02)
6 167.245.12.11 17161 (MMC)
2 13.225.78.53 16509 (AMAZON-02)
1 52.222.236.115 16509 (AMAZON-02)
28 5
13    205.156.141.241 (United States)

ASN17161 (MMC, US)
PTR: informatica.mercerbelong.com
www.benefitseverydayfair.com
7    13.225.78.57 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-57.fra2.r.cloudfront.net
consent.trustarc.com
6    167.245.12.11 (United States)

ASN17161 (MMC, US)
PTR: career-analytics.mercer.com
matomo.us-east-1.prod.ext.mercer.com
career-analytics.mercer.com
2    13.225.78.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-53.fra2.r.cloudfront.net
consent-reporting.trustarc.com
1    52.222.236.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-115.fra56.r.cloudfront.net
consent-pref.trustarc.com
Apex Domain
Subdomains		 Transfer
13 benefitseverydayfair.com
www.benefitseverydayfair.com
2 MB
10 trustarc.com
consent.trustarc.com — Cisco Umbrella Rank: 4398
consent-reporting.trustarc.com — Cisco Umbrella Rank: 67837
consent-pref.trustarc.com — Cisco Umbrella Rank: 17422
66 KB
6 mercer.com
matomo.us-east-1.prod.ext.mercer.com
career-analytics.mercer.com
87 KB
28 3
Domain Requested by
13 www.benefitseverydayfair.com 1 redirects www.benefitseverydayfair.com
7 consent.trustarc.com www.benefitseverydayfair.com
consent.trustarc.com
3 career-analytics.mercer.com www.benefitseverydayfair.com
matomo.us-east-1.prod.ext.mercer.com
3 matomo.us-east-1.prod.ext.mercer.com www.benefitseverydayfair.com
matomo.us-east-1.prod.ext.mercer.com
2 consent-reporting.trustarc.com consent.trustarc.com
1 consent-pref.trustarc.com consent.trustarc.com
28 6

This site contains links to these domains. Also see Links.

Domain
auth.mercerbelong.com
www.mercer.com
tdp.trustarc.com
trustarc.com
Subject Issuer Validity Valid
www.benefitseverydayfair.com
COMODO RSA Organization Validation Secure Server CA		 2023-05-15 -
2024-05-14		 a year crt.sh
*.trustarc.com
Amazon RSA 2048 M02		 2023-04-17 -
2024-05-14		 a year crt.sh
matomo.us-east-1.prod.ext.mercer.com
COMODO RSA Organization Validation Secure Server CA		 2023-01-24 -
2024-01-24		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.benefitseverydayfair.com/public/welcome
Frame ID: A7397F5A034ABC951F5D867DE75A376E
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Welcome Ross Stores

Page URL History Show full URLs

  1. https://www.benefitseverydayfair.com/ HTTP 302
    https://www.benefitseverydayfair.com/public/welcome Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • consent\.trustarc\.com

Page Statistics

28
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

6
Subdomains

5
IPs

1
Countries

1799 kB
Transfer

3010 kB
Size

10
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.benefitseverydayfair.com/ HTTP 302
    https://www.benefitseverydayfair.com/public/welcome Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request welcome
www.benefitseverydayfair.com/public/
Redirect Chain
  • https://www.benefitseverydayfair.com/
  • https://www.benefitseverydayfair.com/public/welcome
5 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
a9261692e4adef58fba6d0ecc6ad0ebac54ad644729d635e41e32443578d103f
Security Headers
Name Value
Content-Security-Policy script-src 'self' http://*.mercer.com https://*.mercer.com http://*.trustarc.com https://*.trustarc.com https://*.cloudflare.com https://*.firebaseapp.com https://*.vimeocdn.com https://*.google-analytics.com https://*.pez.ai https://*.trueviewportal.com https://*.google.com https://*.gstatic.com https://*.socrates.ai https://*.tiqcdn.com https://*.truste.com 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
Access-Control-Allow-Methods
GET,POST
Cache-Control
no-cache, no-store, must-revalidate
Content-Encoding
gzip
Content-Length
2521
Content-Security-Policy
script-src 'self' http://*.mercer.com https://*.mercer.com http://*.trustarc.com https://*.trustarc.com https://*.cloudflare.com https://*.firebaseapp.com https://*.vimeocdn.com https://*.google-analytics.com https://*.pez.ai https://*.trueviewportal.com https://*.google.com https://*.gstatic.com https://*.socrates.ai https://*.tiqcdn.com https://*.truste.com 'unsafe-eval' 'unsafe-inline'
Content-Type
text/html; charset=utf-8
Date
Wed, 25 Oct 2023 20:05:18 GMT
Expires
-1
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block

Redirect headers

Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
Access-Control-Allow-Methods
GET,POST
Cache-Control
private
Content-Security-Policy
script-src 'self' http://*.mercer.com https://*.mercer.com http://*.trustarc.com https://*.trustarc.com https://*.cloudflare.com https://*.firebaseapp.com https://*.vimeocdn.com https://*.google-analytics.com https://*.pez.ai https://*.trueviewportal.com https://*.google.com https://*.gstatic.com https://*.socrates.ai https://*.tiqcdn.com https://*.truste.com 'unsafe-eval' 'unsafe-inline'
Content-Type
text/html; charset=utf-8
Date
Wed, 25 Oct 2023 20:05:17 GMT
Location
/public/welcome
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
VisitorIdentification.js
www.benefitseverydayfair.com/layouts/system/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/layouts/system/VisitorIdentification.js
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
ebab9b58fe5bfc97c97757ae76ec2416caf147b120c2d843c9b62bc04deff877
Security Headers
Name Value
Content-Security-Policy script-src 'self' http://*.mercer.com https://*.mercer.com http://*.trustarc.com https://*.trustarc.com https://*.cloudflare.com https://*.firebaseapp.com https://*.vimeocdn.com https://*.google-analytics.com https://*.pez.ai https://*.trueviewportal.com https://*.google.com https://*.gstatic.com https://*.socrates.ai https://*.tiqcdn.com https://*.truste.com 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/public/welcome
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Security-Policy
script-src 'self' http://*.mercer.com https://*.mercer.com http://*.trustarc.com https://*.trustarc.com https://*.cloudflare.com https://*.firebaseapp.com https://*.vimeocdn.com https://*.google-analytics.com https://*.pez.ai https://*.trueviewportal.com https://*.google.com https://*.gstatic.com https://*.socrates.ai https://*.tiqcdn.com https://*.truste.com 'unsafe-eval' 'unsafe-inline'
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000
Date
Wed, 25 Oct 2023 20:05:18 GMT
Content-Length
1003
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 01 Nov 2022 23:08:38 GMT
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
ETag
"01ff6df46eed81:0"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
X-Frame-Options
SAMEORIGIN
Accept-Ranges
bytes
aa068f9b98934aee95b6cbad7025d702.css
www.benefitseverydayfair.com/resources/global/css/design/ 		446 KB
93 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/resources/global/css/design/aa068f9b98934aee95b6cbad7025d702.css?v=0E51A41E929FBE274BFC89386E7D0F63
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
d7a2a38ab085dbcec02dd5045cc8226b82211e07321dd1670f265d5745eace42
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/public/welcome
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Wed, 25 Oct 2023 20:05:18 GMT
Last-Modified
Wed, 25 Oct 2023 19:59:32 GMT
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Transfer-Encoding
chunked
Cache-Control
public, max-age=2592000
X-XSS-Protection
1; mode=block
5a5c279298f249659c0523c3b4d74879.css
www.benefitseverydayfair.com/resources/css/site/ 		847 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/resources/css/site/5a5c279298f249659c0523c3b4d74879.css?v=B7803BFB41AAACE15CE1B820DFEF5BF5
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
fba84dc0f12868fdc7f069d6bd8dc212dd0eb245f2fab4f050cc16e747c25a0d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/public/welcome
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Wed, 25 Oct 2023 20:05:18 GMT
Last-Modified
Wed, 25 Oct 2023 18:54:52 GMT
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Cache-Control
public, max-age=2592000
Content-Length
628
X-XSS-Protection
1; mode=block
aa068f9b98934aee95b6cbad7025d702.js
www.benefitseverydayfair.com/resources/global/js/design/top/ 		293 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/resources/global/js/design/top/aa068f9b98934aee95b6cbad7025d702.js?v=CE487A923257B711FB6E8B0B594B394F
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
134d39e51e95e449740720f9a10036c45d63042e6f4cf5116393979a51a007c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/public/welcome
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Wed, 25 Oct 2023 20:05:18 GMT
Last-Modified
Wed, 25 Oct 2023 18:54:46 GMT
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-javascript; charset=utf-8
Transfer-Encoding
chunked
Cache-Control
public, max-age=2592000
X-XSS-Protection
1; mode=block
BenefitsEverydayLogo-Color.png
www.benefitseverydayfair.com/-/media/Mercer/VBF-Sites/Ross-Stores/Images/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.benefitseverydayfair.com/-/media/Mercer/VBF-Sites/Ross-Stores/Images/BenefitsEverydayLogo-Color.png?rev=14eef60fa9744c538c487555fed3ad62
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
218e55b772946d9839d7a72774c1446094fdc607880ee8de477b800faeb6cfe5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/public/welcome
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000
Date
Wed, 25 Oct 2023 20:05:18 GMT
X-Content-Type-Options
nosniff
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
no-cache
Content-Length
10393
X-XSS-Protection
1; mode=block
Expires
-1
booth-o-meter_1.png
www.benefitseverydayfair.com/-/media/Mercer/VBF-Global/Images/Booth-O-Meter/ 		58 KB
59 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.benefitseverydayfair.com/-/media/Mercer/VBF-Global/Images/Booth-O-Meter/booth-o-meter_1.png?rev=409209dd2cf2478ea4956bc8a8583887&hash=9516305816AA95E24594AB31BD86EC7F
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
9718eaf935cb1d32bb08429eb68f252e4a30f776370d8faa41b1babb80d6e38f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/public/welcome
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000
Date
Wed, 25 Oct 2023 20:05:18 GMT
X-Content-Type-Options
nosniff
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
no-cache
Content-Length
59857
X-XSS-Protection
1; mode=block
Expires
-1
aa068f9b98934aee95b6cbad7025d702.js
www.benefitseverydayfair.com/resources/global/js/design/ 		555 KB
169 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/resources/global/js/design/aa068f9b98934aee95b6cbad7025d702.js?v=34C7DA72521BADBF8F00A0DF8DB62B2E
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
2e000e88d844a70497c1b9a2c90512d8033b4b8445dc4ff605b7634f4ff11b40
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/public/welcome
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Wed, 25 Oct 2023 20:05:19 GMT
Last-Modified
Wed, 25 Oct 2023 18:54:44 GMT
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-javascript; charset=utf-8
Transfer-Encoding
chunked
Cache-Control
public, max-age=2592000
X-XSS-Protection
1; mode=block
5a5c279298f249659c0523c3b4d74879.js
www.benefitseverydayfair.com/resources/js/site/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/resources/js/site/5a5c279298f249659c0523c3b4d74879.js?v=08F19E5E4A3E4B605DF8D57887A03BDE
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
c54f76a65b47d2f5c2bea4a4961ad795e7eb77d2755377ca73140f286f98260c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/public/welcome
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Date
Wed, 25 Oct 2023 20:05:18 GMT
Last-Modified
Wed, 25 Oct 2023 19:57:59 GMT
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-javascript; charset=utf-8
Cache-Control
public, max-age=2592000
Content-Length
2212
X-XSS-Protection
1; mode=block
q7njh7
consent.trustarc.com/v2/notice/ 		95 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://consent.trustarc.com/v2/notice/q7njh7
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-57.fra2.r.cloudfront.net
Software
/
Resource Hash
1379fceecf645fe97275f6b5b92f0105138b3395f0e1a167c0febe8f72b60d7f
Security Headers
Name Value
Content-Security-Policy object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 20:05:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
via
1.1 1e498d046330e15095a1a2a958463bf4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA2-C2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
cloudfront-viewer-country
DE
request-id
59b312130ce17f0d2086c38f6f81c6a4
referrer-policy
strict-origin-when-cross-origin
cross-origin-opener-policy
cross-origin
expect-ct
enforce, max-age=60
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
permissions-policy
geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
cloudfront-viewer-country-region
HE
x-amz-cf-id
SjBS-_WVOYMAuwmG6e8oy4EJU_SaCHFZPNT5P6scOTtZJUnxke4MNw==
ProximaNova-Regular.otf
www.benefitseverydayfair.com/-/media/files/fonts/ 		61 KB
62 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/-/media/files/fonts/ProximaNova-Regular.otf
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/resources/global/css/design/aa068f9b98934aee95b6cbad7025d702.css?v=0E51A41E929FBE274BFC89386E7D0F63
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.benefitseverydayfair.com/resources/global/css/design/aa068f9b98934aee95b6cbad7025d702.css?v=0E51A41E929FBE274BFC89386E7D0F63
Origin
https://www.benefitseverydayfair.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000
Date
Wed, 25 Oct 2023 20:05:19 GMT
X-Content-Type-Options
nosniff
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Cache-Control
no-cache
Content-Disposition
attachment; filename="ProximaNova-Regular.otf"
Content-Length
62892
X-XSS-Protection
1; mode=block
Expires
-1
ProximaNova-Bold.otf
www.benefitseverydayfair.com/-/media/files/fonts/ 		62 KB
63 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/-/media/files/fonts/ProximaNova-Bold.otf
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/resources/global/css/design/aa068f9b98934aee95b6cbad7025d702.css?v=0E51A41E929FBE274BFC89386E7D0F63
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
b9e81a47aecd3d05445ae775f48d08b3de46b2039f1d229a58a87be194e327ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.benefitseverydayfair.com/resources/global/css/design/aa068f9b98934aee95b6cbad7025d702.css?v=0E51A41E929FBE274BFC89386E7D0F63
Origin
https://www.benefitseverydayfair.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000
Date
Wed, 25 Oct 2023 20:05:18 GMT
X-Content-Type-Options
nosniff
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Cache-Control
no-cache
Content-Disposition
attachment; filename="ProximaNova-Bold.otf"
Content-Length
63808
X-XSS-Protection
1; mode=block
Expires
-1
virtualfair_2.mp4
www.benefitseverydayfair.com/-/media/Mercer/VBF-Global/Images/Welcome/ 		1 MB
1 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://www.benefitseverydayfair.com/-/media/Mercer/VBF-Global/Images/Welcome/virtualfair_2.mp4?rev=d682577923d445eaa9ab81ea8a02998d
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
205.156.141.241 , United States, ASN17161 (MMC, US),
Reverse DNS
informatica.mercerbelong.com
Software
/
Resource Hash
3c1a036b4fe408ea514932986d4de08ddc0c3fa7a7bd0fc4ac1b0fafff0b684d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.benefitseverydayfair.com/public/welcome
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Range
bytes=0-

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000
Date
Wed, 25 Oct 2023 20:05:18 GMT
X-Content-Type-Options
nosniff
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
X-Frame-Options
SAMEORIGIN
Content-Type
video/mp4
Cache-Control
no-cache
Content-Length
1091278
X-XSS-Protection
1; mode=block
Expires
-1
p.js
matomo.us-east-1.prod.ext.mercer.com/ 		128 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://matomo.us-east-1.prod.ext.mercer.com/p.js
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/resources/global/js/design/aa068f9b98934aee95b6cbad7025d702.js?v=34C7DA72521BADBF8F00A0DF8DB62B2E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.245.12.11 , United States, ASN17161 (MMC, US),
Reverse DNS
career-analytics.mercer.com
Software
Apache /
Resource Hash
f1839d7e60fc07b171e808db9526cc9600e4a625990a7185f834459f060c6f0f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Wed, 25 Oct 2023 20:05:20 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload;
Last-Modified
Fri, 10 Jun 2022 19:33:55 GMT
Server
Apache
ETag
"1fe33-5e11d04e34a27"
Transfer-Encoding
chunked
Content-Type
application/javascript
Accept-Ranges
bytes
container_J1DsvUMY.js
career-analytics.mercer.com/js/ 		187 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://career-analytics.mercer.com/js/container_J1DsvUMY.js
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/resources/global/js/design/aa068f9b98934aee95b6cbad7025d702.js?v=34C7DA72521BADBF8F00A0DF8DB62B2E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.245.12.11 , United States, ASN17161 (MMC, US),
Reverse DNS
career-analytics.mercer.com
Software
Apache /
Resource Hash
642216020166a2adeaa987189fb9d99420db1aee74e64adb45f58d0de822f8da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date
Wed, 25 Oct 2023 20:05:20 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload;
Last-Modified
Fri, 20 Oct 2023 14:20:27 GMT
Server
Apache
ETag
"2ecd0-6082692ee61bc"
Transfer-Encoding
chunked
Content-Type
application/javascript
Accept-Ranges
bytes
log
consent-reporting.trustarc.com/api/user-action/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://consent-reporting.trustarc.com/api/user-action/log?action=impression&domain=q7njh7&behavior=implied&country=de&language=de&rand=0.9241843867083244&session=5ede0214-2d60-47a6-a8c7-12e6f8898405&userType=NEW
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/v2/notice/q7njh7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-53.fra2.r.cloudfront.net
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy object-src 'none'; frame-ancestors https://*.trustarc.com https://*.truste.com https://*.trustarc.eu https://*.truste.eu https://*.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.nymity.com; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 20:05:20 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
object-src 'none'; frame-ancestors https://*.trustarc.com https://*.truste.com https://*.trustarc.eu https://*.truste.eu https://*.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.nymity.com; upgrade-insecure-requests; block-all-mixed-content;
via
1.1 590590f04f79f692591f9db0e720a31c.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA2-C2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
0
x-xss-protection
1 ; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
cross-origin-opener-policy
cross-origin
expect-ct
enforce, max-age=60
x-frame-options
SAMEORIGIN
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id
9-HHUhpcafLIjCMvoSE3MZbEHiTrEeiuJfq8_oXyztcCM5StCgOVKQ==
expires
0
getnonemptyindexes
consent.trustarc.com/v2/consentcategories/ 		5 B
751 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://consent.trustarc.com/v2/consentcategories/getnonemptyindexes?cmId=q7njh7&referer=https://www.benefitseverydayfair.com/&fullURL=https://www.benefitseverydayfair.com/public/welcome&category=
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/v2/notice/q7njh7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-57.fra2.r.cloudfront.net
Software
/
Resource Hash
540efeb2de09e9415cbff4df0439e0c8a4898008b9dc55b1fe5a9451e576b149
Security Headers
Name Value
Content-Security-Policy object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 20:05:20 GMT
content-security-policy
object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
via
1.1 6c9a2d99a25484f38efa27d58a726b2c.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA2-C2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
request-id
3133705449310c3905fede39db0a6e95
referrer-policy
strict-origin-when-cross-origin
cross-origin-opener-policy
cross-origin
expect-ct
enforce, max-age=60
x-frame-options
SAMEORIGIN
content-type
application/json;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
*
permissions-policy
geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id
u_oZC-h7_JoHTMKrTaA-zfrO-m7HhqdNwMHAIuovvfrrEy6llZw5Fg==
getSeedUrl
consent-pref.trustarc.com/self-service-cm/ 		37 B
588 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://consent-pref.trustarc.com/self-service-cm/getSeedUrl?site=q7njh7&referer=https://www.benefitseverydayfair.com/&locale=de&fullURL=https://www.benefitseverydayfair.com/public/welcome
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/v2/notice/q7njh7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-115.fra56.r.cloudfront.net
Software
nginx /
Resource Hash
4db226ad4d9caf25bb48004f1c8bdbd3fd8002dbb64041f8210eb96378bf0967
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 20:05:20 GMT
via
1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA56-P4
x-cache
Miss from cloudfront
content-length
37
x-xss-protection
1
referrer-policy
strict-origin-when-cross-origin
server
nginx
expect-ct
max-age=86400; enforce;
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
*
permissions-policy
midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id
ScI4ByZtWnVoT4CgsO3Fd_zUsxk_IQqAXq_V3y3QBtCV4vDpSeAdBg==
latin.woff2
consent.trustarc.com/v2/asset/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://consent.trustarc.com/v2/asset/latin.woff2
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-57.fra2.r.cloudfront.net
Software
/
Resource Hash
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
Security Headers
Name Value
Content-Security-Policy object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.benefitseverydayfair.com/
Origin
https://www.benefitseverydayfair.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
date
Wed, 25 Oct 2023 20:05:00 GMT
via
1.1 6c9a2d99a25484f38efa27d58a726b2c.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA2-C2
cross-origin-embedder-policy
unsafe-none
age
27
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
request-id
f359c6a846239886a170f61f4dbc4c94
content-length
13036
pragma
public
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 3 Aug 2022 01:22:09 GMT
cross-origin-opener-policy
cross-origin
expect-ct
enforce, max-age=60
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
permissions-policy
geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id
9UuvBK_CjIkfJjRT7VqlsDLs4JmdoeFw0B25NvfqlXhN7fWYqcroXQ==
bannermsg
consent-reporting.trustarc.com/api/user-action/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://consent-reporting.trustarc.com/api/user-action/bannermsg?action=views&domain=q7njh7&behavior=implied&country=de&language=de&rand=0.4488463103980722&session=5ede0214-2d60-47a6-a8c7-12e6f8898405&userType=NEW
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/v2/notice/q7njh7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-53.fra2.r.cloudfront.net
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy object-src 'none'; frame-ancestors https://*.trustarc.com https://*.truste.com https://*.trustarc.eu https://*.truste.eu https://*.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.nymity.com; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 20:05:20 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
object-src 'none'; frame-ancestors https://*.trustarc.com https://*.truste.com https://*.trustarc.eu https://*.truste.eu https://*.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.nymity.com; upgrade-insecure-requests; block-all-mixed-content;
via
1.1 590590f04f79f692591f9db0e720a31c.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA2-C2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
0
x-xss-protection
1 ; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
cross-origin-opener-policy
cross-origin
expect-ct
enforce, max-age=60
x-frame-options
SAMEORIGIN
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id
fEIYEN2Tst6QUVxngoxJrlOqe41HqmmCD3zXGUwBp8I2QZYugHQAsA==
expires
0
ic-error.svg
consent.trustarc.com/v2/asset/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://consent.trustarc.com/v2/asset/ic-error.svg
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-57.fra2.r.cloudfront.net
Software
/
Resource Hash
5ea56ed1ed92d89dd6e8a23316891c8af7cd2150977d2e8431bd0e97c0cf5282
Security Headers
Name Value
Content-Security-Policy object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
date
Wed, 25 Oct 2023 19:48:58 GMT
via
1.1 1e498d046330e15095a1a2a958463bf4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA2-C2
cross-origin-embedder-policy
unsafe-none
age
982
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
request-id
981e925f39a3a4162bfd0865a667ba01
content-length
5514
pragma
public
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 20 Mar 2019 06:14:12 GMT
cross-origin-opener-policy
cross-origin
expect-ct
enforce, max-age=60
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/svg+xml
permissions-policy
geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id
s2POrA7Wwpma7mzm6cso4gRyNcz-oha1wkjJ2q9bcf7xlkXlTOH-bg==
ic-close-white.svg
consent.trustarc.com/v2/asset/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://consent.trustarc.com/v2/asset/ic-close-white.svg
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-57.fra2.r.cloudfront.net
Software
/
Resource Hash
da0d9dec187414eaac184877e362bfd09ac956b2ab490b6adbb525af80fb3d6a
Security Headers
Name Value
Content-Security-Policy object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
date
Wed, 25 Oct 2023 19:13:58 GMT
via
1.1 1e498d046330e15095a1a2a958463bf4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA2-C2
cross-origin-embedder-policy
unsafe-none
age
3356
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
request-id
6483d29e748487ca858eb52c3fe3ed68
content-length
6901
pragma
public
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 20 Mar 2019 06:14:09 GMT
cross-origin-opener-policy
cross-origin
expect-ct
enforce, max-age=60
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/svg+xml
permissions-policy
geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id
0kqhYa4lueHPP1_W35TREVyLjv8YTIFoM8QdRMIgARjOfKLyt2P30A==
ic-close.svg
consent.trustarc.com/v2/asset/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://consent.trustarc.com/v2/asset/ic-close.svg
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-57.fra2.r.cloudfront.net
Software
/
Resource Hash
78060c93ee6a407478d39e1e16807b576ea320f5641a34d5f043c7de399a418e
Security Headers
Name Value
Content-Security-Policy object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
date
Wed, 25 Oct 2023 20:05:20 GMT
via
1.1 1e498d046330e15095a1a2a958463bf4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA2-C2
cross-origin-embedder-policy
unsafe-none
age
201
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
request-id
ea3f6e4f09413502d040aab1d45cf211
content-length
5806
pragma
public
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 20 Mar 2019 06:14:11 GMT
cross-origin-opener-policy
cross-origin
expect-ct
enforce, max-age=60
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/svg+xml
permissions-policy
geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id
hmNv7ujXltNfjAFVbvqExgig5og-1YmDnmUAsY41q3DKixX-AGrc2A==
trustarc-logo-xs.svg
consent.trustarc.com/v2/asset/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://consent.trustarc.com/v2/asset/trustarc-logo-xs.svg
Requested by
Host: www.benefitseverydayfair.com
URL: https://www.benefitseverydayfair.com/public/welcome
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-57.fra2.r.cloudfront.net
Software
/
Resource Hash
fad03d5343f00671f67d8e92a6c1e243f4b45e4f7a09d11c6d170665ae52d03e
Security Headers
Name Value
Content-Security-Policy object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.benefitseverydayfair.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
object-src 'none'; frame-ancestors https:; upgrade-insecure-requests; block-all-mixed-content;
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
date
Wed, 25 Oct 2023 19:14:32 GMT
via
1.1 1e498d046330e15095a1a2a958463bf4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA2-C2
cross-origin-embedder-policy
unsafe-none
age
3052
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
request-id
bd13358b8976ca5b6c8af86ff04956b8
content-length
3191
pragma
public
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 10 Feb 2021 02:29:33 GMT
cross-origin-opener-policy
cross-origin
expect-ct
enforce, max-age=60
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/svg+xml
permissions-policy
geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id
DYdkibcUQxH75yrUEMSJlRB_Z7vd85DB-eshZXuBvaJD7YnSF_2DVw==
p.dyd
matomo.us-east-1.prod.ext.mercer.com/ 		0
288 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://matomo.us-east-1.prod.ext.mercer.com/p.dyd?action_name=Welcome%20Ross%20Stores&idsite=401&rec=1&r=780533&h=22&m=5&s=20&url=https%3A%2F%2Fwww.benefitseverydayfair.com%2Fpublic%2Fwelcome&_id=cf09f743537e55d5&_idn=1&_refts=0&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&dimension1=auth_no%2Cprofile_no&pv_id=DG1FG3&ip=185.213.155.133&pf_net=0&pf_srv=233&pf_tfr=1&pf_dm1=1112
Requested by
Host: matomo.us-east-1.prod.ext.mercer.com
URL: https://matomo.us-east-1.prod.ext.mercer.com/p.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.245.12.11 , United States, ASN17161 (MMC, US),
Reverse DNS
career-analytics.mercer.com
Software
Apache / PHP/7.4.19
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;

Request headers

Referer
https://www.benefitseverydayfair.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8

Response headers

Access-Control-Allow-Origin
https://www.benefitseverydayfair.com
Date
Wed, 25 Oct 2023 20:05:21 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload;
Access-Control-Allow-Credentials
true
Server
Apache
X-Powered-By
PHP/7.4.19
matomo.php
career-analytics.mercer.com/ 		0
288 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://career-analytics.mercer.com/matomo.php?action_name=Welcome%20Ross%20Stores&idsite=621&rec=1&r=881761&h=22&m=5&s=20&url=https%3A%2F%2Fwww.benefitseverydayfair.com%2Fpublic%2Fwelcome&_id=b746ba7d1b799a04&_idn=0&_refts=0&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=ye1yKH&ip=185.213.155.133&pf_net=0&pf_srv=233&pf_tfr=1&pf_dm1=1112
Requested by
Host: matomo.us-east-1.prod.ext.mercer.com
URL: https://matomo.us-east-1.prod.ext.mercer.com/p.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.245.12.11 , United States, ASN17161 (MMC, US),
Reverse DNS
career-analytics.mercer.com
Software
Apache / PHP/7.4.19
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;

Request headers

Referer
https://www.benefitseverydayfair.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8

Response headers

Access-Control-Allow-Origin
https://www.benefitseverydayfair.com
Date
Wed, 25 Oct 2023 20:05:20 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload;
Access-Control-Allow-Credentials
true
Server
Apache
X-Powered-By
PHP/7.4.19
p.dyd
matomo.us-east-1.prod.ext.mercer.com/ 		0
288 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://matomo.us-east-1.prod.ext.mercer.com/p.dyd
Requested by
Host: matomo.us-east-1.prod.ext.mercer.com
URL: https://matomo.us-east-1.prod.ext.mercer.com/p.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.245.12.11 , United States, ASN17161 (MMC, US),
Reverse DNS
career-analytics.mercer.com
Software
Apache / PHP/7.4.19
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;

Request headers

Referer
https://www.benefitseverydayfair.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8

Response headers

Access-Control-Allow-Origin
https://www.benefitseverydayfair.com
Date
Wed, 25 Oct 2023 20:05:23 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload;
Access-Control-Allow-Credentials
true
Server
Apache
X-Powered-By
PHP/7.4.19
matomo.php
career-analytics.mercer.com/ 		0
288 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://career-analytics.mercer.com/matomo.php
Requested by
Host: matomo.us-east-1.prod.ext.mercer.com
URL: https://matomo.us-east-1.prod.ext.mercer.com/p.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.245.12.11 , United States, ASN17161 (MMC, US),
Reverse DNS
career-analytics.mercer.com
Software
Apache / PHP/7.4.19
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;

Request headers

Referer
https://www.benefitseverydayfair.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8

Response headers

Access-Control-Allow-Origin
https://www.benefitseverydayfair.com
Date
Wed, 25 Oct 2023 20:05:23 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload;
Access-Control-Allow-Credentials
true
Server
Apache
X-Powered-By
PHP/7.4.19

Verdicts & Comments Add Verdict or Comment

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| subscribeEvent function| unsubscribeEvent function| startActivityHandler function| placeCheckerRequest function| placeCssAspxRequest function| timeoutSleep function| getMetatagContent function| addTstampAndSiteToQueryString function| getVirtualFolder function| GetIEVersion function| setup_ieMaintenance function| $ function| jQuery object| siteParametersArray object| siteParametersObj function| saveAs function| ics function| setup_misc1 function| setup_mainMenu function| setup_overlayMask function| RightMenuPosition function| setup_alertModal function| setup_cta_dropdown function| setup_cloneForMobile object| pen object| pn function| initQAB function| GetParameterValues function| setup_resources_v2 function| setup_filters function| setup_pagination function| setupEventCal function| eventSorting object| _paq function| initMatomoTagManager function| setupMatomo object| whatInput object| Foundation object| _mtm function| startupItems function| initBoothometer function| initEnrollmentBtn function| modalAnimation function| enrollmentBtn function| boothometer function| randomAvatar object| truste object| PREF_MGR_API_DEBUG object| PrivacyManagerAPI object| TRUSTE_CMAPI_DEBUG object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log object| MatomoTagManager object| piwikPluginAsyncInit

10 Cookies

Domain/Path Name / Value
www.benefitseverydayfair.com/ Name: shell#lang
Value: en
www.benefitseverydayfair.com/ Name: ASP.NET_SessionId
Value: q54dscvgghdjiwvrdl4oquhg
www.benefitseverydayfair.com/ Name: SC_ANALYTICS_GLOBAL_COOKIE
Value: 7261538f5231488cad6f31179b4c7edc|False
www.benefitseverydayfair.com/ Name: TS0167c3d1
Value: 011c237762826a6830aba374fae20082a2757bc3bb28ee4ae5e5d9d609003832fe9871a9a7a983129493019f57b48fdfb01fdaa5c910f8a758561773660e4b113503615fe66d410d4e24ed1ccfacd47cc986518e94c6b4537d0f54852a881b9d2bad52fbfe
.benefitseverydayfair.com/ Name: TAsessionID
Value: 5ede0214-2d60-47a6-a8c7-12e6f8898405|NEW
.benefitseverydayfair.com/ Name: notice_behavior
Value: implied|eu
www.benefitseverydayfair.com/ Name: _pk_id.401.9ff6
Value: cf09f743537e55d5.1698264321.
www.benefitseverydayfair.com/ Name: _pk_ses.401.9ff6
Value: 1
www.benefitseverydayfair.com/ Name: _pk_id.621.9ff6
Value: b746ba7d1b799a04.1698264321.
www.benefitseverydayfair.com/ Name: _pk_ses.621.9ff6
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'self' http://*.mercer.com https://*.mercer.com http://*.trustarc.com https://*.trustarc.com https://*.cloudflare.com https://*.firebaseapp.com https://*.vimeocdn.com https://*.google-analytics.com https://*.pez.ai https://*.trueviewportal.com https://*.google.com https://*.gstatic.com https://*.socrates.ai https://*.tiqcdn.com https://*.truste.com 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

career-analytics.mercer.com
consent-pref.trustarc.com
consent-reporting.trustarc.com
consent.trustarc.com
matomo.us-east-1.prod.ext.mercer.com
www.benefitseverydayfair.com
13.225.78.53
13.225.78.57
167.245.12.11
205.156.141.241
52.222.236.115
134d39e51e95e449740720f9a10036c45d63042e6f4cf5116393979a51a007c5
1379fceecf645fe97275f6b5b92f0105138b3395f0e1a167c0febe8f72b60d7f
218e55b772946d9839d7a72774c1446094fdc607880ee8de477b800faeb6cfe5
2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9
2e000e88d844a70497c1b9a2c90512d8033b4b8445dc4ff605b7634f4ff11b40
3c1a036b4fe408ea514932986d4de08ddc0c3fa7a7bd0fc4ac1b0fafff0b684d
4db226ad4d9caf25bb48004f1c8bdbd3fd8002dbb64041f8210eb96378bf0967
540efeb2de09e9415cbff4df0439e0c8a4898008b9dc55b1fe5a9451e576b149
5ea56ed1ed92d89dd6e8a23316891c8af7cd2150977d2e8431bd0e97c0cf5282
642216020166a2adeaa987189fb9d99420db1aee74e64adb45f58d0de822f8da
78060c93ee6a407478d39e1e16807b576ea320f5641a34d5f043c7de399a418e
9718eaf935cb1d32bb08429eb68f252e4a30f776370d8faa41b1babb80d6e38f
a9261692e4adef58fba6d0ecc6ad0ebac54ad644729d635e41e32443578d103f
b9e81a47aecd3d05445ae775f48d08b3de46b2039f1d229a58a87be194e327ec
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c54f76a65b47d2f5c2bea4a4961ad795e7eb77d2755377ca73140f286f98260c
d7a2a38ab085dbcec02dd5045cc8226b82211e07321dd1670f265d5745eace42
da0d9dec187414eaac184877e362bfd09ac956b2ab490b6adbb525af80fb3d6a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebab9b58fe5bfc97c97757ae76ec2416caf147b120c2d843c9b62bc04deff877
f1839d7e60fc07b171e808db9526cc9600e4a625990a7185f834459f060c6f0f
fad03d5343f00671f67d8e92a6c1e243f4b45e4f7a09d11c6d170665ae52d03e
fba84dc0f12868fdc7f069d6bd8dc212dd0eb245f2fab4f050cc16e747c25a0d