www.southafricacheapflights.com Open in urlscan Pro
2606:4700:3031::ac43:c7cd Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://southafricacheapflights.com/
Effective URL:
https://www.southafricacheapflights.com/
Submission: On February 07 via automatic, source certstream-suspicious (February 7th 2023, 12:08:29 am UTC) — Scanned from DE

Summary HTTP 221 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 78 IPs in 9 countries across 60 domains to perform 221 HTTP transactions. The main IP is 2606:4700:3031::ac43:c7cd, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.southafricacheapflights.com.
TLS certificate: Issued by GTS CA 1P5 on February 6th 2023. Valid for: 3 months.

This is the only time www.southafricacheapflights.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 4	2606:4700:303... 2606:4700:3031::ac43:c7cd	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
7	2400:52e0:1e0... 2400:52e0:1e00::713:1	200325 (BUNNYCDN) (BUNNYCDN)
13	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
17	2606:4700::68... 2606:4700::6813:b007	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	172.255.224.36 172.255.224.36	7979 (SERVERS-COM) (SERVERS-COM)
1	13.225.78.40 13.225.78.40	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
2 10	185.106.81.236 185.106.81.236	7979 (SERVERS-COM) (SERVERS-COM)
1 14	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::ac43:44ed	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1 3	74.208.14.106 74.208.14.106	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1	13.224.189.18 13.224.189.18	16509 (AMAZON-02) (AMAZON-02)
3	13.224.189.9 13.224.189.9	16509 (AMAZON-02) (AMAZON-02)
11	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
16	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3965	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 10	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
1	80.158.18.121 80.158.18.121	6878 (AS6878) (AS6878)
1	216.58.212.130 216.58.212.130	15169 (GOOGLE) (GOOGLE)
1	2a02:2638:1::d 2a02:2638:1::d	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
7	104.19.160.97 104.19.160.97	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	176.34.212.241 176.34.212.241	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:20:... 2606:4700:20::681a:e2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2606:4700:10:... 2606:4700:10::6816:1883	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
4 5	2a02:2638:1::13 2a02:2638:1::13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	13.225.78.103 13.225.78.103	16509 (AMAZON-02) (AMAZON-02)
1 2	142.250.185.102 142.250.185.102	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	2606:4700::68... 2606:4700::6812:1c93	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
1	178.250.2.146 178.250.2.146	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	13.224.189.51 13.224.189.51	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:20e... 2600:9000:20eb:6800:8:cf94:88c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:82a::200d	15169 (GOOGLE) (GOOGLE)
1	13.224.189.67 13.224.189.67	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	178.250.0.163 178.250.0.163	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	54.229.40.207 54.229.40.207	16509 (AMAZON-02) (AMAZON-02)
1	13.225.78.105 13.225.78.105	16509 (AMAZON-02) (AMAZON-02)
1	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
1 2	3.76.151.8 3.76.151.8	16509 (AMAZON-02) (AMAZON-02)
1 1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
2 2	185.89.211.116 185.89.211.116	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2.18.235.93 2.18.235.93	16625 (AKAMAI-AS) (AKAMAI-AS)
1	64.202.112.63 64.202.112.63	23352 (SERVERCEN...) (SERVERCENTRAL)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1	18.158.43.18 18.158.43.18	16509 (AMAZON-02) (AMAZON-02)
1	185.86.138.142 185.86.138.142	201081 (SMARTADSE...) (SMARTADSERVER)
1	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1	104.111.217.42 104.111.217.42	16625 (AKAMAI-AS) (AKAMAI-AS)
1	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
1 2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1	37.157.4.24 37.157.4.24	198622 (ADFORM) (ADFORM)
1	185.255.84.153 185.255.84.153	200271 (IGUANE-) (IGUANE-)
1 2	104.18.33.19 104.18.33.19	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	34.251.149.144 34.251.149.144	16509 (AMAZON-02) (AMAZON-02)
1	162.19.138.118 162.19.138.118	16276 (OVH) (OVH)
1 2	52.16.200.203 52.16.200.203	16509 (AMAZON-02) (AMAZON-02)
1	34.117.157.22 34.117.157.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.123.113.206 3.123.113.206	16509 (AMAZON-02) (AMAZON-02)
1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2600:1f18:612... 2600:1f18:612b:4216:59f0:7d1c:f2a3:a394	14618 (AMAZON-AES) (AMAZON-AES)
1	85.215.5.31 85.215.5.31	6786 (CRONON-BE...) (CRONON-BERLIN-AS)
1	2.17.187.27 2.17.187.27	16625 (AKAMAI-AS) (AKAMAI-AS)
1	3.71.169.66 3.71.169.66	16509 (AMAZON-02) (AMAZON-02)
2	162.247.241.2 162.247.241.2	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
2	3.229.224.106 3.229.224.106	14618 (AMAZON-AES) (AMAZON-AES)
1	54.195.73.77 54.195.73.77	16509 (AMAZON-02) (AMAZON-02)
1	3.16.134.16 3.16.134.16	16509 (AMAZON-02) (AMAZON-02)
221	78

4 2606:4700:3031::ac43:c7cd (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

southafricacheapflights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.southafricacheapflights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2400:52e0:1e00::713:1 (Slovenia)

ASN200325 (BUNNYCDN, SI)

southafricacheapflights.b-cdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2606:4700::6813:b007 (United States)

ASN13335 (CLOUDFLARENET, US)

www.travelstart.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.255.224.36 (Netherlands)

ASN7979 (SERVERS-COM, US)

www.travelpayouts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-40.fra2.r.cloudfront.net

forms.feedblitz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 185.106.81.236 (Netherlands) 2 redirects

ASN7979 (SERVERS-COM, US)

avsplow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:44ed (United States)

ASN13335 (CLOUDFLARENET, US)

st.avsplow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 74.208.14.106 (United States) 1 redirects

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: mail03.feedblitz.com

app.feedblitz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.18 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-18.fra2.r.cloudfront.net

assets.feedblitz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.224.189.9 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-9.fra2.r.cloudfront.net

assets.feedblitzstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3965 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.158.18.121 (Germany)

ASN6878 (AS6878, DE)
PTR: ecs-80-158-18-121.reverse.open-telekom-cloud.com

dtm-dre.platform.hicloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s46-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::d (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dynamic.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.19.160.97 (None, )

ASN13335 (CLOUDFLARENET, US)

loco.travelstart.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.travelstart.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 176.34.212.241 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-176-34-212-241.eu-west-1.compute.amazonaws.com

wapi.travelstart.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:e2 (United States)

ASN13335 (CLOUDFLARENET, US)

api.country.is	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:10::6816:1883 (United States)

ASN13335 (CLOUDFLARENET, US)

embed.tawk.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
va.tawk.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:2638:1::13 (France) 4 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-103.fra2.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.102 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f6.1e100.net

5139389.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:1c93 (United States)

ASN13335 (CLOUDFLARENET, US)

ssl.widgets.webengage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wsdk-files.webengage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

afs.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.51 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-51.fra2.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:6800:8:cf94:88c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

14507cd62.webengage.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.67 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-67.fra2.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 178.250.0.163 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

sslwidget.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.229.40.207 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-40-207.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-105.fra2.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.76.151.8 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-76-151-8.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.211.116 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.202.112.63 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.158.43.18 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-43-18.eu-central-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.138.142 (France)

ASN201081 (SMARTADSERVER, FR)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync-t1.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.217.42 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-217-42.deploy.static.akamaitechnologies.com

criteo-sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.223.111.18 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.4.24 (Denmark)

ASN198622 (ADFORM, DK)

cm.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.255.84.153 (France)

ASN200271 (IGUANE-, FR)

visitor.omnitagjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.33.19 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

r.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.251.149.144 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-149-144.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.138.118 (France)

ASN16276 (OVH, FR)
PTR: ns31533569.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.16.200.203 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-200-203.eu-west-1.compute.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.157.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.157.117.34.bc.googleusercontent.com

matching.ivitrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.123.113.206 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-113-206.eu-central-1.compute.amazonaws.com

exchange.mediavine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4216:59f0:7d1c:f2a3:a394 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

criteo-partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.215.5.31 (Berlin, Germany)

ASN6786 (CRONON-BERLIN-AS, DE)

a.twiago.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.17.187.27 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-17-187-27.deploy.static.akamaitechnologies.com

ad.yieldlab.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.71.169.66 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-71-169-66.eu-central-1.compute.amazonaws.com

e1.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.247.241.2 (Lake Oswego, United States)

ASN23467 (NEWRELIC-AS-1, US)

bam-cell.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.229.224.106 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-229-224-106.compute-1.amazonaws.com

c.webengage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.195.73.77 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-195-73-77.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.16.134.16 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-16-134-16.us-east-2.compute.amazonaws.com

s.thebrighttag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 104 tpc.googlesyndication.com — Cisco Umbrella Rank: 149	361 KB
18	google.com 4 redirects adservice.google.com — Cisco Umbrella Rank: 70 www.google.com — Cisco Umbrella Rank: 2 apis.google.com — Cisco Umbrella Rank: 92 accounts.google.com — Cisco Umbrella Rank: 75	169 KB
17	doubleclick.net 3 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 29 5139389.fls.doubleclick.net cm.g.doubleclick.net — Cisco Umbrella Rank: 211	115 KB
17	travelstart.co.za www.travelstart.co.za	1 MB
11	tawk.to embed.tawk.to — Cisco Umbrella Rank: 8174 va.tawk.to — Cisco Umbrella Rank: 8079	137 KB
11	gstatic.com www.gstatic.com fonts.gstatic.com	122 KB
11	avsplow.com 2 redirects avsplow.com — Cisco Umbrella Rank: 184590 st.avsplow.com — Cisco Umbrella Rank: 209942	18 KB
10	criteo.com 4 redirects dynamic.criteo.com — Cisco Umbrella Rank: 3800 gum.criteo.com — Cisco Umbrella Rank: 388 mug.criteo.com — Cisco Umbrella Rank: 2753 sslwidget.criteo.com — Cisco Umbrella Rank: 1763 dis.criteo.com — Cisco Umbrella Rank: 696	28 KB
9	travelstart.com loco.travelstart.com wapi.travelstart.com — Cisco Umbrella Rank: 204574 www.travelstart.com	133 KB
7	travelpayouts.com www.travelpayouts.com — Cisco Umbrella Rank: 162783	143 KB
7	b-cdn.net southafricacheapflights.b-cdn.net	131 KB
5	webengage.com ssl.widgets.webengage.com — Cisco Umbrella Rank: 32338 wsdk-files.webengage.com — Cisco Umbrella Rank: 24308 c.webengage.com — Cisco Umbrella Rank: 12528	65 KB
5	feedblitz.com 1 redirects forms.feedblitz.com — Cisco Umbrella Rank: 662978 app.feedblitz.com — Cisco Umbrella Rank: 99579 assets.feedblitz.com — Cisco Umbrella Rank: 88352	16 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	330 KB
4	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 620 script.hotjar.com — Cisco Umbrella Rank: 815 vars.hotjar.com — Cisco Umbrella Rank: 855 in.hotjar.com — Cisco Umbrella Rank: 1661	72 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 146	223 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	4 KB
4	southafricacheapflights.com 1 redirects southafricacheapflights.com www.southafricacheapflights.com	15 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	257 B
3	bing.com bat.bing.com — Cisco Umbrella Rank: 351	12 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 186	145 KB
3	feedblitzstatic.com assets.feedblitzstatic.com — Cisco Umbrella Rank: 124109	41 KB
3	google.de adservice.google.de — Cisco Umbrella Rank: 8741 www.google.de — Cisco Umbrella Rank: 5986	1 KB
3	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 858 www.googleadservices.com — Cisco Umbrella Rank: 167	2 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 21	40 KB
2	nr-data.net bam-cell.nr-data.net — Cisco Umbrella Rank: 1770	2 KB
2	360yield.com 1 redirects ad.360yield.com — Cisco Umbrella Rank: 650	855 B
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 197	2 KB
2	casalemedia.com 1 redirects r.casalemedia.com — Cisco Umbrella Rank: 1367	1 KB
2	yahoo.com 1 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 274	508 B
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 203	2 KB
2	bidswitch.net 1 redirects x.bidswitch.net — Cisco Umbrella Rank: 281	877 B
2	googleusercontent.com afs.googleusercontent.com — Cisco Umbrella Rank: 12397	1 KB
2	country.is api.country.is — Cisco Umbrella Rank: 204441	412 B
1	thebrighttag.com s.thebrighttag.com — Cisco Umbrella Rank: 1695	268 B
1	krxd.net beacon.krxd.net — Cisco Umbrella Rank: 581	338 B
1	emxdgt.com e1.emxdgt.com — Cisco Umbrella Rank: 792	55 B
1	yieldlab.net ad.yieldlab.net — Cisco Umbrella Rank: 4045	525 B
1	twiago.com a.twiago.com — Cisco Umbrella Rank: 27063	153 B
1	tremorhub.com criteo-partners.tremorhub.com — Cisco Umbrella Rank: 2174	183 B
1	pubmatic.com simage2.pubmatic.com — Cisco Umbrella Rank: 665	580 B
1	mediavine.com exchange.mediavine.com — Cisco Umbrella Rank: 1242	880 B
1	ivitrack.com matching.ivitrack.com — Cisco Umbrella Rank: 2467	274 B
1	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 389	1 KB
1	omnitagjs.com visitor.omnitagjs.com — Cisco Umbrella Rank: 756	235 B
1	adform.net cm.adform.net — Cisco Umbrella Rank: 1400	163 B
1	3lift.com eb2.3lift.com — Cisco Umbrella Rank: 329	140 B
1	teads.tv criteo-sync.teads.tv — Cisco Umbrella Rank: 1844	172 B
1	taboola.com sync-t1.taboola.com — Cisco Umbrella Rank: 1244	99 B
1	smartadserver.com rtb-csync.smartadserver.com — Cisco Umbrella Rank: 560	163 B
1	sharethrough.com match.sharethrough.com — Cisco Umbrella Rank: 502	35 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 308	239 B
1	outbrain.com sync.outbrain.com — Cisco Umbrella Rank: 720	145 B
1	media.net contextual.media.net — Cisco Umbrella Rank: 563	978 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 314	18 KB
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 2148	257 B
1	webengage.co 14507cd62.webengage.co	2 KB
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 647	14 KB
1	hicloud.com dtm-dre.platform.hicloud.com — Cisco Umbrella Rank: 52855	45 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 958	6 KB
221	60

	Domain	Requested by
17	www.travelstart.co.za	www.southafricacheapflights.com southafricacheapflights.b-cdn.net www.travelstart.co.za
16	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
14	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net
13	pagead2.googlesyndication.com	www.southafricacheapflights.com pagead2.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com tpc.googlesyndication.com
10	www.google.com	4 redirects pagead2.googlesyndication.com www.google.com www.southafricacheapflights.com tpc.googlesyndication.com
10	www.gstatic.com	googleads.g.doubleclick.net accounts.google.com
10	avsplow.com	2 redirects www.southafricacheapflights.com st.avsplow.com
8	embed.tawk.to	www.travelstart.co.za embed.tawk.to
7	www.travelpayouts.com	www.southafricacheapflights.com www.travelpayouts.com
7	southafricacheapflights.b-cdn.net	www.southafricacheapflights.com southafricacheapflights.b-cdn.net
6	loco.travelstart.com	www.travelstart.co.za
5	gum.criteo.com	4 redirects www.travelstart.co.za
5	www.googletagmanager.com	www.southafricacheapflights.com www.travelstart.co.za
4	connect.facebook.net	www.travelstart.co.za
4	fonts.googleapis.com	googleads.g.doubleclick.net
3	va.tawk.to	www.travelstart.co.za
3	www.facebook.com	www.travelstart.co.za www.southafricacheapflights.com
3	accounts.google.com	apis.google.com www.southafricacheapflights.com www.gstatic.com
3	bat.bing.com	www.travelstart.co.za
3	www.googletagservices.com	googleads.g.doubleclick.net
3	assets.feedblitzstatic.com	www.southafricacheapflights.com
3	app.feedblitz.com	1 redirects forms.feedblitz.com
3	adservice.google.com	pagead2.googlesyndication.com 5139389.fls.doubleclick.net
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.travelstart.co.za
3	www.southafricacheapflights.com	www.southafricacheapflights.com
2	c.webengage.com	ssl.widgets.webengage.com
2	bam-cell.nr-data.net	www.travelstart.co.za
2	ad.360yield.com	1 redirects www.southafricacheapflights.com
2	dpm.demdex.net	1 redirects www.southafricacheapflights.com
2	r.casalemedia.com	1 redirects www.southafricacheapflights.com
2	ups.analytics.yahoo.com	1 redirects www.southafricacheapflights.com
2	ib.adnxs.com	2 redirects
2	dis.criteo.com	www.southafricacheapflights.com
2	x.bidswitch.net	1 redirects www.southafricacheapflights.com
2	wsdk-files.webengage.com	14507cd62.webengage.co ssl.widgets.webengage.com
2	afs.googleusercontent.com	www.google.com
2	5139389.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	apis.google.com	www.travelstart.co.za
2	api.country.is	www.travelstart.co.za
2	wapi.travelstart.com	www.travelstart.co.za
2	adservice.google.de	pagead2.googlesyndication.com
2	partner.googleadservices.com	pagead2.googlesyndication.com www.google.com
1	s.thebrighttag.com	www.southafricacheapflights.com
1	beacon.krxd.net	www.southafricacheapflights.com
1	e1.emxdgt.com	www.southafricacheapflights.com
1	ad.yieldlab.net	www.southafricacheapflights.com
1	a.twiago.com	www.southafricacheapflights.com
1	criteo-partners.tremorhub.com	www.southafricacheapflights.com
1	simage2.pubmatic.com	www.southafricacheapflights.com
1	exchange.mediavine.com	www.southafricacheapflights.com
1	matching.ivitrack.com	www.southafricacheapflights.com
1	id5-sync.com	www.southafricacheapflights.com
1	visitor.omnitagjs.com	www.southafricacheapflights.com
1	cm.adform.net	www.southafricacheapflights.com
1	eb2.3lift.com	www.southafricacheapflights.com
1	criteo-sync.teads.tv	www.southafricacheapflights.com
1	sync-t1.taboola.com	www.southafricacheapflights.com
1	rtb-csync.smartadserver.com	www.southafricacheapflights.com
1	match.sharethrough.com	www.southafricacheapflights.com
1	pixel.rubiconproject.com	www.southafricacheapflights.com
1	sync.outbrain.com	www.southafricacheapflights.com
1	contextual.media.net	www.southafricacheapflights.com
1	cm.g.doubleclick.net	1 redirects
1	js-agent.newrelic.com	www.travelstart.co.za
1	vc.hotjar.io	www.travelstart.co.za
1	in.hotjar.com	www.travelstart.co.za
1	sslwidget.criteo.com	www.travelstart.co.za
1	vars.hotjar.com	www.travelstart.co.za
1	14507cd62.webengage.co	www.travelstart.co.za
1	script.hotjar.com	www.travelstart.co.za
1	mug.criteo.com	www.travelstart.co.za
1	ssl.widgets.webengage.com	www.travelstart.co.za
1	static.criteo.net	www.travelstart.co.za
1	static.hotjar.com	www.travelstart.co.za
1	www.google.de	www.travelstart.co.za
1	www.travelstart.com	www.travelstart.co.za
1	dynamic.criteo.com	www.travelstart.co.za
1	www.googleadservices.com	www.travelstart.co.za
1	fonts.gstatic.com	fonts.googleapis.com
1	dtm-dre.platform.hicloud.com	www.travelstart.co.za
1	static.cloudflareinsights.com	www.travelstart.co.za
1	assets.feedblitz.com	forms.feedblitz.com
1	st.avsplow.com	www.travelpayouts.com
1	forms.feedblitz.com	www.southafricacheapflights.com
1	southafricacheapflights.com	1 redirects
221	85

This site contains links to these domains. Also see Links.

Domain
www.travelpayouts.com
www.feedblitz.com

Subject Issuer	Validity	Valid
*.southafricacheapflights.com GTS CA 1P5	`2023-02-06` - `2023-05-07`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.b-cdn.net Sectigo RSA Domain Validation Secure Server CA	`2022-11-07` - `2023-11-11`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-17` - `2023-06-17`	a year	crt.sh
travelpayouts.com R3	`2022-12-28` - `2023-03-28`	3 months	crt.sh
forms.feedblitz.com Amazon	`2022-05-11` - `2023-06-08`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
avsplow.com R3	`2023-01-16` - `2023-04-16`	3 months	crt.sh
app.feedblitz.com R3	`2023-01-02` - `2023-04-02`	3 months	crt.sh
assets.feedblitz.com Amazon	`2023-01-05` - `2024-02-03`	a year	crt.sh
assets.feedblitzstatic.com Amazon	`2022-09-27` - `2023-10-25`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
dnkeeper.platform.dbankcloud.cn GlobalSign RSA OV SSL CA 2018	`2022-07-27` - `2023-08-28`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-04` - `2023-03-31`	3 months	crt.sh
*.travelstart.co.za Amazon	`2022-07-19` - `2023-08-17`	a year	crt.sh
*.apis.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-11-16` - `2023-02-14`	3 months	crt.sh
*.hotjar.com Amazon	`2022-10-25` - `2023-11-23`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2022-11-25` - `2023-05-25`	6 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-13` - `2023-04-15`	3 months	crt.sh
webengage.com Cloudflare Inc ECC CA-3	`2022-04-23` - `2023-04-22`	a year	crt.sh
*.googleusercontent.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
webengage.co Amazon	`2022-07-04` - `2023-08-02`	a year	crt.sh
accounts.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.hotjar.io Amazon	`2022-07-18` - `2023-08-16`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-07-10` - `2023-08-11`	a year	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2022-02-20` - `2023-02-22`	a year	crt.sh
*.outbrain.com Thawte RSA CA 2018	`2022-11-06` - `2023-11-28`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.sharethrough.com Amazon	`2022-07-14` - `2023-08-12`	a year	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-21` - `2024-01-23`	a year	crt.sh
*.taboola.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-08` - `2023-12-31`	a year	crt.sh
teads.tv R3	`2023-01-20` - `2023-04-20`	3 months	crt.sh
*.3lift.com Amazon	`2022-05-13` - `2023-06-11`	a year	crt.sh
*.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2022-05-18` - `2023-06-16`	a year	crt.sh
omnitagjs.com Sectigo RSA Domain Validation Secure Server CA	`2022-06-21` - `2023-07-21`	a year	crt.sh
*.id5-sync.com R3	`2023-01-25` - `2023-04-25`	3 months	crt.sh
itm.ivitrack.com R3	`2023-02-03` - `2023-05-04`	3 months	crt.sh
exchange.mediavine.com Amazon	`2022-07-06` - `2023-08-04`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-14`	a year	crt.sh
*.tremorhub.com Amazon	`2022-03-24` - `2023-04-22`	a year	crt.sh
*.twiago.com Sectigo RSA Domain Validation Secure Server CA	`2022-11-28` - `2023-12-29`	a year	crt.sh
*.yieldlab.net DigiCert TLS RSA SHA256 2020 CA1	`2022-11-16` - `2023-11-15`	a year	crt.sh
*.emxdgt.com Go Daddy Secure Certificate Authority - G2	`2022-05-18` - `2023-06-19`	a year	crt.sh
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1	`2022-11-18` - `2023-12-19`	a year	crt.sh
*.webengage.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-05` - `2023-05-11`	a year	crt.sh

This page contains 24 frames:

Primary Page: https://www.southafricacheapflights.com/
Frame ID: C71A497A06D248CD459DD0764E1C30EC
Requests: 62 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20190131/zrt_lookup.html
Frame ID: 4ED6062AEE308C831F4734D6AF4416DA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3205907082861840&output=html&adk=1812271804&adf=3025194257&lmt=1675728501&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Fwww.southafricacheapflights.com%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1675728500998&bpp=6&bdt=291&idt=274&shv=r20230202&mjsv=m202301170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1767846474577&frm=20&pv=2&ga_vid=223379191.1675728501&ga_sid=1675728501&ga_hid=1504167397&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071756&oid=2&pvsid=1112848247560789&tmod=334677973&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=300
Frame ID: 4E73EDCFA8EA6897BFE226CBE3945722
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3205907082861840&output=html&h=280&slotname=6527298723&adk=3349968481&adf=3248184483&pi=t.ma~as.6527298723&w=762&fwrn=4&fwrnh=100&lmt=1675728501&rafmt=1&format=762x280&url=https%3A%2F%2Fwww.southafricacheapflights.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1675728501424&bpp=65&bdt=717&idt=65&shv=r20230202&mjsv=m202301170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1767846474577&frm=20&pv=1&ga_vid=223379191.1675728501&ga_sid=1675728501&ga_hid=1504167397&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=224&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071756&oid=2&pvsid=1112848247560789&tmod=334677973&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=LJWcbm45F4&p=https%3A//www.southafricacheapflights.com&dtd=73
Frame ID: 3AB719B559FB569329E2216825EBB26C
Requests: 14 HTTP requests in this frame

Frame: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Frame ID: 8E37767B181A8E1D20AD0AC1A2933D61
Requests: 65 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 012F1D46B3F08035676DC424FCFBA971
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1
Frame ID: 3740AD9613E08247DC16915BCE0F7BE2
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1
Frame ID: 4C6286232F35BDDADBF7DD745B40F1C9
Requests: 13 HTTP requests in this frame

Frame: https://www.google.com/afs/ads?psid=5134551505&channel=AutoRsVariant&fexp=44766999%2C21404%2C17301140%2C17301144%2C17301146&client=pub-3205907082861840&r=m&hl=en&rpbu=http%3A%2F%2Fgoogle.com&rpqp=q&type=3&rs_tt=c&oe=UTF-8&ie=UTF-8&format=r5&nocache=691675728502441&num=0&output=afd_ads&domain_name=www.southafricacheapflights.com&v=3&bsl=10&pac=0&u_his=2&u_tz=0&dt=1675728502441&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1995&frm=0&cl=503972142&uio=-&cont=autors-container-0&jsid=csa&jsv=503972142&rurl=https%3A%2F%2Fwww.southafricacheapflights.com%2F&adbw=master-1%3A752
Frame ID: BEC2167D54C2617D0CEFA41B4B0ED7B5
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js
Frame ID: 2CF65786C25464501F2468CA32196C06
Requests: 1 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 9DD0497871266161FAE672389B2F085F
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: C216EC0A32B58124441B6417AE455148
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?topUrl=www.southafricacheapflights.com&origin=onetag
Frame ID: D62F5CBA1F6BDC798AA03B25625F791F
Requests: 2 HTTP requests in this frame

Frame: https://5139389.fls.doubleclick.net/activityi;dc_pre=CMGDuZGPgv0CFRokBgAd628DOA;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F
Frame ID: BCD09D875E91D1431A73F7F05D946672
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: AD63FA892A59ED741CC90E7B8D0C3AE4
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js
Frame ID: 71672E3CE924CAAE69CEDC554A50A080
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js
Frame ID: 63E07C779CF0EE05A0BD7BC2FB644C5D
Requests: 1 HTTP requests in this frame

Frame: https://14507cd62.webengage.co/storage-frame-1.18.htm?cdn=y&cbf=webengage-engagement-callback-frame&lc=14507cd62
Frame ID: 9199F85F75EB68A34107BEC012535E68
Requests: 2 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: 832147ADE7F183BD4BF682FFF46CDBBD
Requests: 4 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-e031119f9e9e307a08fa610f85dbfb52.html
Frame ID: 865998CB51D2384B148D40292E43AA52
Requests: 1 HTTP requests in this frame

Frame: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-uVZB9q4K_LR51UdJ8yRcihDzt5Q3hgSE-3W6Uw&expires=30
Frame ID: 0295F0EA68BEEB666328377C9152FDA7
Requests: 27 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: B012BFBBE590E6EB789164FF43A69FDE
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 1B1E23643BE0A8F91F834EDCAB8AE056
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 548938F416EA944E70F1D5EF7213FFB2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Book Your Flight - South Africa Cheap Flights Booking

Page URL History Show full URLs

https://southafricacheapflights.com/ HTTP 301
https://www.southafricacheapflights.com/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Google Sign-in (Social logins) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/platform\.js

Tawk.to (Live Chat) Expand

Overall confidence: 100%
Detected patterns

//embed\.tawk\.to

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Criteo (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

//static\.criteo\.net/js/ld/ld\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

221
Requests

94 %
HTTPS

41 %
IPv6

60
Domains

85
Subdomains

78
IPs

9
Countries

3644 kB
Transfer

13465 kB
Size

55
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.travelpayouts.com/?marker=73262.poweredby&utm_source=powered_by&utm_medium=widget&utm_campaign=mewtwo

Search URL Search Domain Scan URL

URL: https://www.feedblitz.com/tos/
Title: Terms

Search URL Search Domain Scan URL

URL: https://www.feedblitz.com/privacy/
Title: Privacy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://southafricacheapflights.com/ HTTP 301
https://www.southafricacheapflights.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20

https://avsplow.com/a/j.gif?p=web&tv=pixel&e=se&aid=tp_widgets&se_ca=mewtwo&se_ac=proxy_init&co=%7B%22schema%22%3A%22contexts%22%2C%22data%22%3A%5B%7B%22schema%22%3A%22event%22%2C%22data%22%3A%7B%22widget_id%22%3A%22df101f195d9b58d4356a542f2a13bb43%22%2C%22trace_id%22%3A%22Zz59d5dca95d83430cbffef182-73262%22%2C%22promo_id%22%3A%224238%22%7D%7D%5D%7D HTTP 302
https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22df101f195d9b58d4356a542f2a13bb43%22,%22trace_id%22:%22Zz59d5dca95d83430cbffef182-73262%22,%22promo_id%22:%224238%22%7D%7D%5D%7D&aid=tp_widgets&tv=pixel&se_ac=proxy_init&se_ca=mewtwo&p=web

Request Chain 23

https://avsplow.com/a/j.gif?p=web&tv=pixel&e=se&aid=tp_widgets&se_ca=mewtwo&se_ac=proxy_init&co=%7B%22schema%22%3A%22contexts%22%2C%22data%22%3A%5B%7B%22schema%22%3A%22event%22%2C%22data%22%3A%7B%22widget_id%22%3A%22df101f195d9b58d4356a542f2a13bb43%22%2C%22trace_id%22%3A%22Zzcbdd7eb71a2e47228b12e55b-73262%22%2C%22promo_id%22%3A%224238%22%7D%7D%5D%7D HTTP 302
https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22df101f195d9b58d4356a542f2a13bb43%22,%22trace_id%22:%22Zzcbdd7eb71a2e47228b12e55b-73262%22,%22promo_id%22:%224238%22%7D%7D%5D%7D&aid=tp_widgets&tv=pixel&se_ac=proxy_init&se_ca=mewtwo&p=web

Request Chain 83

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 86

https://app.feedblitz.com/formdata/20764/8920cd22-66b4-4a73-a0bf-540b145c97f6/https://www.southafricacheapflights.com/ HTTP 302
https://assets.feedblitzstatic.com/images/blank.gif

Request Chain 132

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/724060168/?random=1543554560&cv=11&fst=1675728502371&bg=ffffff&guid=ON&async=1&gtm=45He3210&u_w=1600&u_h=1200&label=nchwCKDt_qUBEIiQodkC&hn=www.googleadservices.com&frm=2&url=https%3A%2F%2Fwww.travelstart.co.za%2Fsearch-on-index%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%2F%2Fwww.southafricacheapflights.com%2F&ref=https%3A%2F%2Fwww.southafricacheapflights.com%2F&tiba=Search%20and%20Book%20Cheap%20Flights%20%7C%20Travelstart&value=0&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=dpbhY43TH4ucxgKqy4WQBg&sscte=1&crd=&eitems=ChEIgOeCnwYQwOSKueKEpcbiARIdAG0XhA1LQK8LM-nhfe-qVbeX_OwENXy5zNm9myk HTTP 302
https://www.google.com/pagead/1p-conversion/724060168/?random=1543554560&cv=11&fst=1675728502371&bg=ffffff&guid=ON&async=1&gtm=45He3210&u_w=1600&u_h=1200&label=nchwCKDt_qUBEIiQodkC&hn=www.googleadservices.com&frm=2&url=https%3A%2F%2Fwww.travelstart.co.za%2Fsearch-on-index%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%2F%2Fwww.southafricacheapflights.com%2F&ref=https%3A%2F%2Fwww.southafricacheapflights.com%2F&tiba=Search%20and%20Book%20Cheap%20Flights%20%7C%20Travelstart&value=0&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=dpbhY43TH4ucxgKqy4WQBg&cid=CAQSKQDUE5ympeCk4hFaSEKnzatTzLRS4pqm95RDmdr0lzOGM7gZjSlZJkVo&eitems=ChEIgOeCnwYQwOSKueKEpcbiARIdAG0XhA3fZf_-FJDGyUQCRFCbIYuX5Sc2r7Ypb2I&random=1286894370 HTTP 302
https://www.google.de/pagead/1p-conversion/724060168/?random=1543554560&cv=11&fst=1675728502371&bg=ffffff&guid=ON&async=1&gtm=45He3210&u_w=1600&u_h=1200&label=nchwCKDt_qUBEIiQodkC&hn=www.googleadservices.com&frm=2&url=https%3A%2F%2Fwww.travelstart.co.za%2Fsearch-on-index%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%2F%2Fwww.southafricacheapflights.com%2F&ref=https%3A%2F%2Fwww.southafricacheapflights.com%2F&tiba=Search%20and%20Book%20Cheap%20Flights%20%7C%20Travelstart&value=0&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=dpbhY43TH4ucxgKqy4WQBg&cid=CAQSKQDUE5ympeCk4hFaSEKnzatTzLRS4pqm95RDmdr0lzOGM7gZjSlZJkVo&eitems=ChEIgOeCnwYQwOSKueKEpcbiARIdAG0XhA3fZf_-FJDGyUQCRFCbIYuX5Sc2r7Ypb2I&random=1286894370&ipr=y&prhg=0&ezwbk=AZuM4hDmg7TyUtXNXBlr025vDN002V_9vket7YqW-rLTwnJXlsav8Bu5CnAX0TJR1AK_2BwNt8jHrNkbHEuJbgJ6K1ou

Request Chain 139

https://5139389.fls.doubleclick.net/activityi;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F HTTP 302
https://5139389.fls.doubleclick.net/activityi;dc_pre=CMGDuZGPgv0CFRokBgAd628DOA;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F

Request Chain 149

https://gum.criteo.com/sid/json?origin=onetag&domain=www.travelstart.co.za&sn=ChromeSyncframe&so=0&topUrl=www.southafricacheapflights.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=gCj0EnxBeUVaZHdRZXkxSGV5dm5JWjVtd3VXdjNaN21qTlZXNUtnYlRWMlYvMnM0NTlaWHljbUtaaVpPVDZyNHUyZ1h0bzdyREs5THZ3NHcydExOZVBPMmd5eDFKd2pEdVg5VmJGYVJYNW85ODRsd3g0OHkzRml5YXF5WWZsa0dTL251VVY3MnFkL1JtYzl2aGJNUjhZeC9Zc0RiU0Q1M3AvR1dqWU9ZdDdFZXcwcTM1Zm1LTHlFQUhVa09QeDdCWlRhK3ZDZ3VrQ1daOUNnVFZzSEVoUGdyOUppREpDdkpWNUY5Z2xxcnhDVXRBaEdPYy9mMjZpOTRBeFFNbEsvVUsxZzliSmQ3UlI5aTN4VXZuZ0pBcncwQlgrc0ZmYjB3emp2VEYxcnhxRFRMaWlzTjZFaThreFVmaEpMWTZUMWJLTUhqaHw&cppv=2

Request Chain 151

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 157

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 180

https://x.bidswitch.net/sync?dsp_id=46&user_id=k-uVZB9q4K_LR51UdJ8yRcihDzt5Q3hgSE-3W6Uw&expires=30 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-uVZB9q4K_LR51UdJ8yRcihDzt5Q3hgSE-3W6Uw&expires=30

Request Chain 181

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-k98Ocq4K_LR51UdJ8yRcihDzt5RzLiJdx0DsyQ&google_cm&google_hm=ay1rOThPY3E0S19MUjUxVWRKOHlSY2loRHp0NVJ6TGlKZHgwRHN5UQ HTTP 302
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-k98Ocq4K_LR51UdJ8yRcihDzt5RzLiJdx0DsyQ&google_gid=CAESENfdU0aEOCNiCrvpWCpehVY&google_cver=1&google_ula=913071,0

Request Chain 182

https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID HTTP 302
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=8575157591724207535

Request Chain 191

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-aWPmmq4K_LR51UdJ8yRcihDzt5TYUbrubYWWjw HTTP 302
https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-aWPmmq4K_LR51UdJ8yRcihDzt5TYUbrubYWWjw&verify=true

Request Chain 194

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-qGzoIK4K_LR51UdJ8yRcihDzt5TcuDJVnmb75w HTTP 302
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-qGzoIK4K_LR51UdJ8yRcihDzt5TcuDJVnmb75w&C=1

Request Chain 195

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40 HTTP 302
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=CVCqIBE6brHM8gRMjYa98ZEI4NZ8Ylvo HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=CVCqIBE6brHM8gRMjYa98ZEI4NZ8Ylvo

Request Chain 197

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-k2-PJq4K_LR51UdJ8yRcihDzt5R4h6VwH5MlwQ HTTP 302
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-k2-PJq4K_LR51UdJ8yRcihDzt5R4h6VwH5MlwQ

Request Chain 215

https://gum.criteo.com/sync?c=83&r=1&a=1&u=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcriteo%26partner_uid%3D%40USERID%40 HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=cDMWoe_ZQ_k22PYO9f_q8KuYFv8-UY-m

Request Chain 216

https://gum.criteo.com/sync?c=10&r=1&u=https%3A%2F%2Fs.thebrighttag.com%2Fcs%3Fbtt%3D0%26tp%3Dcr%26uid%3D%40USERID%40 HTTP 302
https://s.thebrighttag.com/cs?btt=0&tp=cr&uid=JZCsDHqWDATa4oaV0C6V6NyYm1aMFcWh

221 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.southafricacheapflights.com/
Redirect Chain

https://southafricacheapflights.com/
https://www.southafricacheapflights.com/

26 KB
7 KB

507ms
488ms

Document
text/html

2606:4700:3031::ac43:c7cd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c7cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.34
Resource Hash: 85de210bb4b6289104d74761f7ea415c75a98061f7a26ad291c8d56b9b92e6b0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=0
cf-cache-status: DYNAMIC
cf-ray: 7957e3f38d76163f-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 07 Feb 2023 00:08:20 GMT
expires: Tue, 07 Feb 2023 00:08:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XJ%2BijPzWJpWd7Rd%2FxLRwrzkNbu8pg8g4nQ6Yci184A%2B9W%2FlmhXsfPCFnCWKCc8NuH%2FgmfAo9ruKXsjQoHDim%2FgMUe6gmHsMFZ%2BYCXESXWRY7VR9Im%2BQe1QTZt20yj6pI%2FHb2ePuyHDe0TxXN7X2fWgMVjWTpVUdnuJu3AIq0"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding Accept-Encoding
x-cache-handler: swis-cache-engine
x-cdn-cache-status: MISS
x-origin-cache-status: EXPIRED
x-powered-by: PHP/7.2.34
x-provided-by: StackCDN StackCDN
x-via: FRA1

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=0
cf-cache-status: DYNAMIC
cf-ray: 7957e3ecbbcb163f-FRA
content-type: text/html; charset=UTF-8
date: Tue, 07 Feb 2023 00:08:19 GMT
expires: Tue, 07 Feb 2023 00:08:19 GMT
location: https://www.southafricacheapflights.com/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u6TTQHzY7uH5krT7LX3vwKCNIJgIdvjAn1mUxIw1XiM%2B53fVST5tquRwFzG6U2iDiSLFAQX5Dww2Go1WUC8hg1uUZoaysmseIs%2BsFH9L3GfVGf3GI7JE%2FZfvwJJUiO7QTSv%2FryzckDVez23k3qpjI2vDEKsp2sy0Z78%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-cdn-cache-status: MISS
x-origin-cache-status: EXPIRED
x-powered-by: PHP/7.2.34
x-provided-by: StackCDN StackCDN
x-redirect-by: WordPress
x-via: FRA1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 162ms
53ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-12368874-30

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

56e50f59a70b88d40b861711564aa935c41c01ee3664d7848d29998f0feff301

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 43905
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 Feb 2023 00:08:20 GMT

GET
H2 200 font-awesome.min.css
southafricacheapflights.b-cdn.net/wp-content/themes/onepage-lite/css/ 28 KB
8 KB 554ms
449ms Stylesheet
text/css 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://southafricacheapflights.b-cdn.net/wp-content/themes/onepage-lite/css/font-awesome.min.css?ver=6.1.1
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: 39043cb6354e318af6f4f37b70b1a057b485f6e367ad9b578901185cbfe8c06a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires: Tue, 06 Feb 2024 20:59:53 GMT
date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid: 860
x-cdn-cache-status: MISS
x-via: FRA1
cdn-cachedat: 02/07/2023 00:08:21
cdn-pullzone: 573695
alt-svc: h3=":443", h3-29=":443"
x-origin-cache-status: HIT
x-provided-by: StackCDN
last-modified: Fri, 05 Aug 2022 20:20:04 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZT9qf3axmmJiWEW%2FQRMsd3gpqGb0ZKrmgY1QUFvYQTcydD%2BaPVF%2B17IXE0yT2py%2FcsEAvIVy9ftRkEHRzPwtthA2v9BwQXL%2BTEpv8qX%2FbEUEdY3ycfvqA9nDVzujIfKM4lycTtN0H3AGS34h2UgJDVq1"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: MISS
cdn-uid: 278b2bd8-796d-43c6-94b2-0397ab8c0b07
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31536000
cdn-requestid: 543691b112c395dfad29430c178365e8
cf-ray: 7957e3fa6bb66969-FRA
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 frontend-gtag.min.js Show response
southafricacheapflights.b-cdn.net/wp-content/plugins/google-analytics-for-wordpress/assets/js/ 12 KB
4 KB 495ms
429ms Script
application/javascript 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://southafricacheapflights.b-cdn.net/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js?ver=8.11.0
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: abc9faa4970e07db7d506d6b2a98e4c86223be305c7541ced54ea2e15f99a76e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires: Tue, 30 Jan 2024 21:27:40 GMT
date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid: 863
x-cdn-cache-status: MISS
x-via: FRA1
cdn-cachedat: 02/07/2023 00:08:21
cdn-pullzone: 573695
alt-svc: h3=":443", h3-29=":443"
x-origin-cache-status: HIT
x-provided-by: StackCDN
last-modified: Tue, 27 Dec 2022 11:49:52 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bz1E97k4zEIegSPNFu%2FOirQcr4gYaA8%2BdtAAHSgo83WJ7w%2BtFAQv3JoFfmOdKZ0tQL3ACKBYoB5qnF1klscCSyr0IP5LMDRKOHagImaoawh45Si60BkzNcFliR0Z9on7vxGdN9sKvZbRVmy158uEENcA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cdn-cache: MISS
cdn-uid: 278b2bd8-796d-43c6-94b2-0397ab8c0b07
cache-control: public, max-age=31536000
cdn-requestid: 08b92bc9ef523a502c3220556b67b8e9
cf-ray: 7957e3fa5c439a1d-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
southafricacheapflights.b-cdn.net/wp-includes/js/jquery/ 88 KB
32 KB 639ms
573ms Script
application/javascript 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://southafricacheapflights.b-cdn.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires: Tue, 06 Feb 2024 20:59:53 GMT
date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid: 722
x-cdn-cache-status: MISS
x-via: FRA1
cdn-cachedat: 02/07/2023 00:08:21
cdn-pullzone: 573695
alt-svc: h3=":443", h3-29=":443"
x-origin-cache-status: HIT
x-provided-by: StackCDN
last-modified: Fri, 04 Nov 2022 04:08:35 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NO1pO9JGyMiXCN5gCsHMhWiO%2F13A0AjI9VJVDCoglaXCjDxOSNI0BStBNtTAGi0bhyafs49syQdyQBpzuLxp%2FqcTSOeyMQWVaY7500CXAYvOo4%2Fm%2Bw0vMaTCPiie3kb0B%2FZQUbHN%2FxYXyz60Ro1UnqZJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cdn-cache: MISS
cdn-uid: 278b2bd8-796d-43c6-94b2-0397ab8c0b07
cache-control: public, max-age=31536000
cdn-requestid: 84f2394fe4b101362a276227f74a29da
cf-ray: 7957e3fa5f6f91db-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery-migrate.min.js Show response
southafricacheapflights.b-cdn.net/wp-includes/js/jquery/ 11 KB
5 KB 509ms
443ms Script
application/javascript 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://southafricacheapflights.b-cdn.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires: Tue, 06 Feb 2024 20:59:53 GMT
date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid: 1080
x-cdn-cache-status: MISS
x-via: FRA1
cdn-cachedat: 02/07/2023 00:08:21
cdn-pullzone: 573695
alt-svc: h3=":443", h3-29=":443"
x-origin-cache-status: HIT
x-provided-by: StackCDN
last-modified: Fri, 05 Aug 2022 20:20:05 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Qe%2FJZXyJ6LEscyOoOu4cR19CJG0MwixK%2FvKBjLGjJWdNqeCHahvt9J1%2BfNgiYT2SE%2BR%2FbMNN6EdKFpfcNSjc2rphdqoIPJVklG9%2FD%2BOBLM73JLvjzFSv%2FhVWQI%2FIXIxJHNSo%2FWERCLy0%2FMT5ow8dW8X"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cdn-cache: MISS
cdn-uid: 278b2bd8-796d-43c6-94b2-0397ab8c0b07
cache-control: public, max-age=31536000
cdn-requestid: 25050c9b57ae135e3ce2711f7cf5815e
cf-ray: 7957e3fa48e9901f-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 151 KB
50 KB 161ms
66ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3205907082861840

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c97a353b7c3d34c96ef920afab9b0240e8f56e7c3c7d327ebb332acb613d66eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.southafricacheapflights.com/
Origin: https://www.southafricacheapflights.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50366
x-xss-protection: 0
server: cafe
etag: 117767369284595949
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 07 Feb 2023 00:08:20 GMT

GET
H2 200 jquery.browser-0.0.8.min.js Show response
www.travelstart.co.za/resources/js/vendor/ 0
0 512ms
390ms Script
text/html 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/resources/js/vendor/jquery.browser-0.0.8.min.js
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

GET
H2 200 jquery.ba-postmessage.min.js Show response
www.travelstart.co.za/resources/js/ 0
0 532ms
409ms Script
text/html 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/resources/js/jquery.ba-postmessage.min.js
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

GET
H2 200 responsiveiframe.js Show response
www.southafricacheapflights.com/wp-content/uploads/2018/05/ 4 KB
2 KB 426ms
424ms Script
application/javascript 2606:4700:3031::ac43:c7cd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.southafricacheapflights.com/wp-content/uploads/2018/05/responsiveiframe.js
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c7cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 812ba2d5353ea618586a36175932a14fd1c665f4a570cc3c0124d86045a14292

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cdn-cache-status: MISS
x-via: FRA1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-origin-cache-status: HIT
x-provided-by: StackCDN
last-modified: Fri, 05 Aug 2022 20:20:04 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hRvrG4%2FRQE7lSxRpjzB2xH6luXXMTrin69dFwa3bPgJgMCGtj4dACujAkkD1PDfJvLey0mHSFwVEekY6oofVsOU8j%2FQV%2FalDdSBVz6thnR6trLmOEZT9UxOzhDDq47skFSeZ%2Fw40UakI0l6sw%2Br5xWt2vu8NHr7iAkx6%2FpOm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7957e3f9cf8c163f-FRA
expires: Sat, 20 Jan 2024 13:04:27 GMT

GET
H2 200 df101f195d9b58d4356a542f2a13bb43.js Show response
www.travelpayouts.com/widgets/ 7 KB
2 KB 237ms
124ms Script
application/javascript 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelpayouts.com/widgets/df101f195d9b58d4356a542f2a13bb43.js?v=2265
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 6e675ff448ac52856833527d6cbbf50b25726cacc7e219710dfdd652374404ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:20 GMT
content-encoding: br
server: nginx
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=0
x-robots-tag: noindex
timing-allow-origin: *
link: </mewtwo/styles.css?v=002>; rel=preload; as=style, </widgets_static/df101f195d9b58d4356a542f2a13bb43.js?v=2265>; rel=preload; as=script
x-promo-id: 4238
x-request-id: ee2921bac14a6be3558081e888b11751

GET
H2 200 df101f195d9b58d4356a542f2a13bb43.js Show response
www.travelpayouts.com/widgets/ 7 KB
2 KB 217ms
105ms Script
application/javascript 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelpayouts.com/widgets/df101f195d9b58d4356a542f2a13bb43.js?v=2201
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 0250fbd11ea83c65333d1ffaedcefcbde9de63202d2f1d23b29f4d18ea17d105

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:20 GMT
content-encoding: br
server: nginx
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=0
x-robots-tag: noindex
timing-allow-origin: *
link: </mewtwo/styles.css?v=002>; rel=preload; as=style, </widgets_static/df101f195d9b58d4356a542f2a13bb43.js?v=2201>; rel=preload; as=script
x-promo-id: 4238
x-request-id: 792d5469b719f149c9731eedc97f8064

GET
H2 200 g0s Show response
forms.feedblitz.com/js/ 12 KB
3 KB 614ms
478ms Script
application/javascript 13.225.78.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://forms.feedblitz.com/js/g0s
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-40.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ce9f02f84b0052a69d7e4da4c1c5dc60595ce4d3974f0c4ddd68fa5cfb94c26b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
last-modified: Thu, 13 Oct 2022 03:12:59 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C2
etag: W/"ee2f15cb19538d0891bab33481c85983"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
cache-control: no-cache
x-amz-cf-id: OrAANmz6Fa20z0Q2YL106QN0AYW_U3sSRr6z-Su2vC4No_mckDqktg==

GET
H2 200 customscript-1659730804.min.js Show response
southafricacheapflights.b-cdn.net/wp-content/swis/cache/js/themes/onepage-lite/js/ 4 KB
2 KB 429ms
429ms Script
application/javascript 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://southafricacheapflights.b-cdn.net/wp-content/swis/cache/js/themes/onepage-lite/js/customscript-1659730804.min.js?ver=1.0.3
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: cf0bd3c60a3f9faabb9c6bfedc2c198d622e7cc0e835ace3763e13ad0e742bf0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires: Tue, 06 Feb 2024 20:59:53 GMT
date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid: 1078
x-cdn-cache-status: MISS
x-via: FRA1
cdn-cachedat: 02/07/2023 00:08:21
cdn-pullzone: 573695
alt-svc: h3=":443", h3-29=":443"
x-origin-cache-status: HIT
x-provided-by: StackCDN
last-modified: Sat, 06 Aug 2022 15:44:59 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RA9Vf1FY248RL2ogOy95H9P6oAP1y3noWKEfUxvL39RCpMVK4%2BAxYF96rZCqDP%2BsLDjzdEMYOJoI4AzQYmO6AflPBceoLmejJzfBcVaj7cKe%2FFzW5jXk0QGW0TSTtyVxNPIILqowgEmJQ7snH36aRow%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cdn-cache: MISS
cdn-uid: 278b2bd8-796d-43c6-94b2-0397ab8c0b07
cache-control: public, max-age=31536000
cdn-requestid: 1c66afc235f6506f79b338789c516076
cf-ray: 7957e3fafb0e9b9e-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 wp-emoji-release.min.js Show response
www.southafricacheapflights.com/wp-includes/js/ 18 KB
5 KB 425ms
423ms Script
application/javascript 2606:4700:3031::ac43:c7cd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.southafricacheapflights.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c7cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cdn-cache-status: MISS
x-via: FRA1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-origin-cache-status: HIT
x-provided-by: StackCDN
last-modified: Fri, 05 Aug 2022 20:20:05 GMT
server: cloudflare
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t2IIKuF5fLfHzeQii1AG2lv4Dj8Sd%2FAEujQZiDsJ2JOiZnlBTKNy7HFMAheNYQgbQcTqJFVlcfq73yIwX%2FcYK4EalF7ik5wGdBX3d4eQIeg0iOOd0eqF3i%2B4dVHBvRvI4VNlGG3v3HD0YyanXhykYOpeiwIp5xaStB4C4Wox"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7957e3f9cf8f163f-FRA
expires: Fri, 26 Jan 2024 13:07:41 GMT

GET
H2 200 style-1659730804.min.css
southafricacheapflights.b-cdn.net/wp-content/swis/cache/css/themes/onepage-lite/ 31 KB
9 KB 444ms
443ms Stylesheet
text/css 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://southafricacheapflights.b-cdn.net/wp-content/swis/cache/css/themes/onepage-lite/style-1659730804.min.css?ver=6.1.1
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: 2959c57705d19212277cf18dde75362abe945255599c461ff8b963c64b30bae1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires: Tue, 06 Feb 2024 20:59:53 GMT
date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid: 1054
x-cdn-cache-status: MISS
x-via: FRA1
cdn-cachedat: 02/07/2023 00:08:21
cdn-pullzone: 573695
alt-svc: h3=":443", h3-29=":443"
x-origin-cache-status: HIT
x-provided-by: StackCDN
last-modified: Sat, 06 Aug 2022 15:44:59 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pk5WdupzvmnII5R0fDVlhBhejmvgff1iSxEG5iBwS3tFOgEEvfjFBA3wGlPdck9Z9pjndwsD3Nu6ff4SbMCH0uL7qrGrRnVWQsccx3bD8Qp1dSLkrtwbWWu4CwJt6JwWxbsinUgkkTcNlTX08nt6HjzJ"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: MISS
cdn-uid: 278b2bd8-796d-43c6-94b2-0397ab8c0b07
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31536000
cdn-requestid: 0a182de24a64bf75c15f57eed3c799ce
cf-ray: 7957e3fb0928916b-FRA
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
cdn-requestpullsuccess: True

GET
DATA 200
OK truncated Show response
/ 56 B
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4e45646f18c229b08f34cf4c3401f56e57a36cf5e2eb2c08acd9cd641750f8c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: text/javascript

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 137ms
40ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-12368874-30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 06 Feb 2023 22:54:50 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 4411
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Tue, 07 Feb 2023 00:54:50 GMT

GET
H2 200 styles.css
www.travelpayouts.com/mewtwo/ 167 KB
12 KB 70ms
70ms Stylesheet
text/css 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelpayouts.com/mewtwo/styles.css?v=002
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 5627529e11b9dc9abd9754a8011415cb5244d37c15cecfafc2c05ba533c1340e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
last-modified: Mon, 05 Dec 2022 13:46:53 GMT
server: nginx
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=600
content-length: 11680

GET
H2 200 df101f195d9b58d4356a542f2a13bb43.js Show response
www.travelpayouts.com/widgets_static/ 318 KB
62 KB 159ms
159ms Script
application/javascript 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelpayouts.com/widgets_static/df101f195d9b58d4356a542f2a13bb43.js?v=2201
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 4025427a412a2ac1fa7fbf7065460308f9e0ddd7fbff0eb67e5e97ecd8ccb6c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: gzip
last-modified: Mon, 05 Dec 2022 14:24:53 GMT
server: nginx
etag: W/"638dff35-4f6e0"
content-type: application/javascript; charset=utf-8

GET
H2 200 df101f195d9b58d4356a542f2a13bb43.js Show response
www.travelpayouts.com/widgets_static/ 318 KB
62 KB 68ms
68ms Script
application/javascript 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelpayouts.com/widgets_static/df101f195d9b58d4356a542f2a13bb43.js?v=2265
Requested by: Host: www.travelpayouts.com
URL: https://www.travelpayouts.com/widgets/df101f195d9b58d4356a542f2a13bb43.js?v=2201
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 4025427a412a2ac1fa7fbf7065460308f9e0ddd7fbff0eb67e5e97ecd8ccb6c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: gzip
last-modified: Mon, 05 Dec 2022 14:24:53 GMT
server: nginx
etag: W/"638dff35-4f6e0"
content-type: application/javascript; charset=utf-8

GET
H2

200

j.gif
avsplow.com/a/
Redirect Chain

https://avsplow.com/a/j.gif?p=web&tv=pixel&e=se&aid=tp_widgets&se_ca=mewtwo&se_ac=proxy_init&co=%7B%22schema%22%3A%22contexts%22%2C%22data%22%3A%5B%7B%22schema%22%3A%22event%22%2C%22data%22%3A%7B%2...
https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22df101f195d9b58d4356a542f2a13bb43%22,%22trace_...

43 B
387 B

70ms
70ms

Image
image/gif

185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22df101f195d9b58d4356a542f2a13bb43%22,%22trace_id%22:%22Zz59d5dca95d83430cbffef182-73262%22,%22promo_id%22:%224238%22%7D%7D%5D%7D&aid=tp_widgets&tv=pixel&se_ac=proxy_init&se_ca=mewtwo&p=web
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"
access-control-allow-origin: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 43

Redirect headers

date: Tue, 07 Feb 2023 00:08:21 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"
location: https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22df101f195d9b58d4356a542f2a13bb43%22,%22trace_id%22:%22Zz59d5dca95d83430cbffef182-73262%22,%22promo_id%22:%224238%22%7D%7D%5D%7D&aid=tp_widgets&tv=pixel&se_ac=proxy_init&se_ca=mewtwo&p=web
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 0

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301170101/ 361 KB
119 KB 166ms
82ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301170101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3205907082861840&plah=www.southafricacheapflights.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3205907082861840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9210bc824ca636dcdea6a9faac00dfd4beeb04eeecaa18fd92975ddd19d609f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 121321
x-xss-protection: 0
server: cafe
etag: 2054683709899389206
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 07 Feb 2023 00:08:21 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230202/r20190131/ Frame 4ED6 10 KB
5 KB 136ms
40ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230202/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3205907082861840

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.southafricacheapflights.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 80549
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 06 Feb 2023 01:45:52 GMT
etag: 10353107486223812946
expires: Mon, 20 Feb 2023 01:45:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

j.gif
avsplow.com/a/
Redirect Chain

https://avsplow.com/a/j.gif?p=web&tv=pixel&e=se&aid=tp_widgets&se_ca=mewtwo&se_ac=proxy_init&co=%7B%22schema%22%3A%22contexts%22%2C%22data%22%3A%5B%7B%22schema%22%3A%22event%22%2C%22data%22%3A%7B%2...
https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22df101f195d9b58d4356a542f2a13bb43%22,%22trace_...

43 B
387 B

70ms
68ms

Image
image/gif

185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22df101f195d9b58d4356a542f2a13bb43%22,%22trace_id%22:%22Zzcbdd7eb71a2e47228b12e55b-73262%22,%22promo_id%22:%224238%22%7D%7D%5D%7D&aid=tp_widgets&tv=pixel&se_ac=proxy_init&se_ca=mewtwo&p=web
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"
access-control-allow-origin: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 43

Redirect headers

date: Tue, 07 Feb 2023 00:08:21 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"
location: https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22df101f195d9b58d4356a542f2a13bb43%22,%22trace_id%22:%22Zzcbdd7eb71a2e47228b12e55b-73262%22,%22promo_id%22:%224238%22%7D%7D%5D%7D&aid=tp_widgets&tv=pixel&se_ac=proxy_init&se_ca=mewtwo&p=web
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
217 B 53ms
52ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1504167397&t=pageview&_s=1&dl=https%3A%2F%2Fwww.southafricacheapflights.com%2F&ul=en-us&de=UTF-8&dt=Book%20Your%20Flight%20-%20South%20Africa%20Cheap%20Flights%20Booking&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=916829583&gjid=986592171&cid=223379191.1675728501&tid=UA-12368874-30&_gid=639079244.1675728501&_r=1&gtm=457e3210&did=dZGIzZG&gdid=dZGIzZG&z=22663550

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.southafricacheapflights.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.southafricacheapflights.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.js Show response
st.avsplow.com/19.18.9/ 41 KB
14 KB 222ms
47ms Script
application/x-javascript 2606:4700:20::ac43:44ed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.avsplow.com/19.18.9/sp.js
Requested by: Host: www.travelpayouts.com
URL: https://www.travelpayouts.com/widgets_static/df101f195d9b58d4356a542f2a13bb43.js?v=2265
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:44ed , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2506986c6f53bd6740ed8fea43dd6a1a42d9429533c20ece438d973c4e6bf3e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 55401
cf-polished: origSize=42630
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 11 Jul 2022 06:29:08 GMT
server: cloudflare
etag: W/"fb6c75c607bf3120c5b82845fbd28e71"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3OAZ0kwDBdXI3D6cgkfML4u8dZfAqwL4tjr6SivpA80m0jT8KBmzMuPHG0qFe15lmWynEYJxpAyKCHPRS9A79rhjtxgdIR86%2BiJ9ulQj0oSOnvat9hEzh0BFv5%2BVn8MY%2BZITaKV3arBrkjUu"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: public, max-age=86400
cf-ray: 7957e3fd5dc9917d-FRA

GET
H2 200 whereami Show response
www.travelpayouts.com/ 122 B
261 B 49ms
49ms Script
application/x-javascript 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelpayouts.com/whereami?locale=en&callback=mewtwoForms.geoIPSetter.lang_en
Requested by: Host: www.travelpayouts.com
URL: https://www.travelpayouts.com/widgets_static/df101f195d9b58d4356a542f2a13bb43.js?v=2265
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 60ab96ffcc7088d7d52879c525475923f1799a673f35983481d69fb102f7a027

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
server: nginx
x-request-id: c285844f9ff2ff50a0cc34041dc11b1b
content-type: application/x-javascript; charset=utf-8

GET
DATA 200
OK truncated
/ 611 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c22b83b631a5293a1acd2dd2e6e8d19f254d46990b5e2115d572fc24a6a2c461

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 381 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cd67ee7ca8d8e8492d61c34033243e78d6f478551aaba5ee30367cc47c53f4e0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 129 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7aba1186b73911d9422fbdef504b34963dc896c16c53daacb94c06d304b3653c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 503 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9648446cf73c35ef331ed5fc53fb53b06f5cdb11af3d7b64f5d54ae24758b449

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 635 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fd338f829b37a85daaccdfd14453413263221708c477ff625bd998a16c7482f8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 261 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e345df69bc7e03c6fb150a526675c88e4bed7136aa3b1eb21f68f1a6a4204d23

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 704 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75fc384c8b2f47fcbdc7291162c2e8a3879a67a82e2b3db3067684ff852206ce

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 tp_white.png
www.travelpayouts.com/powered_by/img/ 3 KB
3 KB 69ms
69ms Image
image/png 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelpayouts.com/powered_by/img/tp_white.png
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2b987833855741a74ca43f6003d83d784ed04ff8a496ea912ea48a1433f87f84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
last-modified: Tue, 13 Sep 2022 13:39:39 GMT
server: nginx
accept-ranges: bytes
etag: "6320881b-a70"
content-length: 2672
content-type: image/png

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 421 B
616 B 140ms
48ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.southafricacheapflights.com&callback=_gfp_s_&client=ca-pub-3205907082861840

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301170101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3205907082861840&plah=www.southafricacheapflights.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0cad61b5cca684b36a95e7fc00c5612a52b881e1c5ff0d0b9398a25b3fea872f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 264
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 139ms
48ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.southafricacheapflights.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 137ms
49ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.southafricacheapflights.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4E73 267 KB
67 KB 607ms
603ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3205907082861840&output=html&adk=1812271804&adf=3025194257&lmt=1675728501&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Fwww.southafricacheapflights.com%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1675728500998&bpp=6&bdt=291&idt=274&shv=r20230202&mjsv=m202301170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1767846474577&frm=20&pv=2&ga_vid=223379191.1675728501&ga_sid=1675728501&ga_hid=1504167397&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071756&oid=2&pvsid=1112848247560789&tmod=334677973&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=300

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d32c95cfd4ea4275c6ed68ab8447aca69da5a64cb5ad42e81688fac44dd1e22d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.southafricacheapflights.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 68249
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:21 GMT
expires: Tue, 07 Feb 2023 00:08:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 fontawesome-webfont.woff2
southafricacheapflights.b-cdn.net/wp-content/themes/onepage-lite/fonts/ 70 KB
71 KB 1056ms
668ms Font
font/woff2 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://southafricacheapflights.b-cdn.net/wp-content/themes/onepage-lite/fonts/fontawesome-webfont.woff2
Requested by: Host: southafricacheapflights.b-cdn.net
URL: https://southafricacheapflights.b-cdn.net/wp-content/themes/onepage-lite/css/font-awesome.min.css?ver=6.1.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Referer: https://southafricacheapflights.b-cdn.net/wp-content/themes/onepage-lite/css/font-awesome.min.css?ver=6.1.1
Origin: https://www.southafricacheapflights.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires: Sat, 03 Jun 2023 07:43:54 GMT
date: Tue, 07 Feb 2023 00:08:22 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cdn-edgestorageid: 1053
x-cdn-cache-status: MISS
x-via: FRA1
cdn-cachedat: 02/07/2023 00:08:22
cdn-pullzone: 573695
alt-svc: h3=":443", h3-29=":443"
content-length: 71896
x-origin-cache-status: HIT
x-provided-by: StackCDN
last-modified: Fri, 05 Aug 2022 20:20:04 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DR7RJCY89qTAAsxMiK2BTXNIPJyazjhzN%2Bw6ApVIH3b8LXOg6X1hVSzY1xQpYwIcO2TcCnN2ic5tkM6oNalClfos5YW6pvHhP8OHlK8KjXLJPPLcz7TgoCoHKrHNtcjiUoL7GXo%2F0D5pxymCc12WUJWh"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cdn-cache: MISS
cdn-uid: 278b2bd8-796d-43c6-94b2-0397ab8c0b07
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: max-age=10368000
cdn-requestid: 84f45f7c296718d741f06bd4f73cb3b5
accept-ranges: bytes
cf-ray: 7957e3ffdf985c44-FRA
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
cdn-requestpullsuccess: True

POST
H2 200 j
avsplow.com/a/ 2 B
347 B 69ms
68ms Ping
text/plain 185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://avsplow.com/a/j
Requested by: Host: st.avsplow.com
URL: https://st.avsplow.com/19.18.9/sp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.southafricacheapflights.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.southafricacheapflights.com
date: Tue, 07 Feb 2023 00:08:21 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"

POST
H2 200 j
avsplow.com/a/ 2 B
347 B 47ms
47ms Ping
text/plain 185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://avsplow.com/a/j
Requested by: Host: st.avsplow.com
URL: https://st.avsplow.com/19.18.9/sp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.southafricacheapflights.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.southafricacheapflights.com
date: Tue, 07 Feb 2023 00:08:21 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"

POST
H2 200 j
avsplow.com/a/ 2 B
347 B 69ms
69ms Ping
text/plain 185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://avsplow.com/a/j
Requested by: Host: st.avsplow.com
URL: https://st.avsplow.com/19.18.9/sp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.southafricacheapflights.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.southafricacheapflights.com
date: Tue, 07 Feb 2023 00:08:21 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"

POST
H2 200 j
avsplow.com/a/ 2 B
347 B 47ms
46ms Ping
text/plain 185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://avsplow.com/a/j
Requested by: Host: st.avsplow.com
URL: https://st.avsplow.com/19.18.9/sp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.southafricacheapflights.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.southafricacheapflights.com
date: Tue, 07 Feb 2023 00:08:21 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3AB7 93 KB
33 KB 330ms
326ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3205907082861840&output=html&h=280&slotname=6527298723&adk=3349968481&adf=3248184483&pi=t.ma~as.6527298723&w=762&fwrn=4&fwrnh=100&lmt=1675728501&rafmt=1&format=762x280&url=https%3A%2F%2Fwww.southafricacheapflights.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1675728501424&bpp=65&bdt=717&idt=65&shv=r20230202&mjsv=m202301170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1767846474577&frm=20&pv=1&ga_vid=223379191.1675728501&ga_sid=1675728501&ga_hid=1504167397&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=224&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071756&oid=2&pvsid=1112848247560789&tmod=334677973&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=LJWcbm45F4&p=https%3A//www.southafricacheapflights.com&dtd=73

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4e7aac2f5069feb2cc85d59e918f39a0ce30244ee0eba030f761b4f2cb357d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.southafricacheapflights.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 33435
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:21 GMT
expires: Tue, 07 Feb 2023 00:08:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 search-on-index Show response
www.travelstart.co.za/ Frame 8E37 76 KB
17 KB 364ms
363ms Document
text/html 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Requested by: Host: southafricacheapflights.b-cdn.net
URL: https://southafricacheapflights.b-cdn.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7562674dfc24ab1a2386f298bc81770f94fed5af3d05a144e74c3ab8f6abf6bb

Request headers

Referer: https://www.southafricacheapflights.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,TS-country,TS-language,TS-source
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7957e3fe8995bbc5-FRA
content-encoding: br
content-type: text/html
date: Tue, 07 Feb 2023 00:08:21 GMT
last-modified: Mon, 06 Feb 2023 13:47:49 GMT
server: cloudflare
vary: Accept-Encoding Accept-Encoding
via: 1.1 60c559b8bc9c5fb751043cfb74bd1656.cloudfront.net (CloudFront)
x-amz-cf-id: xJu_5FQZqRZp2xiWtxqQ2VmY39a9ONZZYgtRJpBJH9B6mO6YWu1o5g==
x-amz-cf-pop: MAN51-P1
x-amz-version-id: null
x-cache: Error from cloudfront

GET
H/1.1 200
OK f.Fbz Show response
app.feedblitz.com/f/ 2 KB
2 KB 1113ms
625ms Script
text/javascript 74.208.14.106
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL

https://app.feedblitz.com/f/f.Fbz?turing&ajax=3

Requested by

Host: forms.feedblitz.com
URL: https://forms.feedblitz.com/js/g0s

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

74.208.14.106 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),

Reverse DNS

mail03.feedblitz.com

Software

Microsoft-IIS/10.0 /

Resource Hash

3f53150c39bf768c46efc688b616a93ec4b238a5e83e9edfe20f2d63b8f69f31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Tue, 07 Feb 2023 00:08:22 GMT
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
X-fbzip: 74.208.14.106
Content-Type: text/javascript; charset=utf-8
X-Frame-Options: sameorigin
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Length: 1234
X-XSS-Protection: 1
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK fbz_smartform.js Show response
assets.feedblitz.com/js/ 32 KB
9 KB 154ms
45ms Script
application/javascript 13.224.189.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.feedblitz.com/js/fbz_smartform.js
Requested by: Host: forms.feedblitz.com
URL: https://forms.feedblitz.com/js/g0s
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-18.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c68c4b9e0e06802bd415f664bde3e325f969e439013bf8d0eded8d9f9e22b922

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Sat, 04 Feb 2023 02:15:44 GMT
Content-Encoding: gzip
Via: 1.1 34f50889bc574f1edeb41dd758962a5a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C1
Age: 251558
Transfer-Encoding: chunked
x-amz-meta-sha256: c68c4b9e0e06802bd415f664bde3e325f969e439013bf8d0eded8d9f9e22b922
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Mon, 07 Nov 2022 18:04:22 GMT
Server: AmazonS3
ETag: W/"53aeeb339bcf8f3b833cd368467593b3"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=864000, immutable
X-Amz-Cf-Id: VT_9fTPDhCVXvBeVqytWE71rbN68dmv683idxV8-6S1w5jqzSV_pJA==
x-amz-meta-s3b-last-modified: 20221107T175534Z

GET
H/1.1 200
OK / Show response
app.feedblitz.com/f/ 66 B
575 B 706ms
219ms Script
text/javascript 74.208.14.106
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL

https://app.feedblitz.com/f/?p13n=1131241

Requested by

Host: forms.feedblitz.com
URL: https://forms.feedblitz.com/js/g0s

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

74.208.14.106 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),

Reverse DNS

mail03.feedblitz.com

Software

Microsoft-IIS/10.0 /

Resource Hash

932dd24628d630a4c594d750036839378e17685dd56ce566c6ab597724dacafd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Tue, 07 Feb 2023 00:08:22 GMT
Server: Microsoft-IIS/10.0
X-Frame-Options: sameorigin
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
X-fbzip: 74.208.14.106
Access-Control-Allow-Origin: *
Content-Length: 165
X-XSS-Protection: 1

GET
H2 200 spinner.gif
assets.feedblitzstatic.com/images/ 39 KB
39 KB 162ms
45ms Image
image/gif 13.224.189.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.feedblitzstatic.com/images/spinner.gif
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-9.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a50c54766e77ea53b2b04a686d9ab4cf0e0fcf639eb2d0de00f329f1b8451287

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 12:01:51 GMT
via: 1.1 0e7eb16f335fe24acf3f13c5dee19c88.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 302791
x-cache: Hit from cloudfront
x-amz-meta-md5-hash: 45f422ceb51df978a7f3911441881303
content-length: 39448
x-amz-meta-id-2: ebrzbYtCry1UJyojaetl0BKOysl8TfzyPVQ6ggrEciXY0OxhOMU34hctyCbNUYXpdkr6io5SLS0=
x-amz-meta-etag: "04166146e314571386838b297c82e5cc"
x-amz-meta-request-id: 47944CDBEE1C05D8
last-modified: Fri, 05 Feb 2021 13:58:57 GMT
server: AmazonS3
x-amz-meta-bucketexplorer-md5: 45f422ceb51df978a7f3911441881303
etag: "45f422ceb51df978a7f3911441881303"
content-type: image/gif
cache-control: public, max-age=864000, immutable
x-amz-meta-bucketexplorer-sha1: 37850625969391d51a4c17ea3c0ebf99fd6b9c88
accept-ranges: bytes
x-amz-cf-id: gxXsVzB9BFv_0qglOU2dJw9AvrfruYdcPKnUy5qZqAlgKVNqTUpHlg==

GET
H2 200 close.gif
assets.feedblitzstatic.com/images/ 222 B
877 B 195ms
79ms Image
image/gif 13.224.189.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.feedblitzstatic.com/images/close.gif
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-9.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 21ea2a02b229aa1e5a38d21816119b839221f69029e3c5dbba7856b29060da56

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-amz-meta-key: images/close.gif
date: Sat, 28 Jan 2023 12:00:23 GMT
via: 1.1 0e7eb16f335fe24acf3f13c5dee19c88.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 821279
x-cache: Hit from cloudfront
x-amz-meta-md5-hash: 540f65d2b2f94032d6c3037622843a50
content-length: 222
x-amz-meta-etag: "540f65d2b2f94032d6c3037622843a50"
last-modified: Fri, 05 Feb 2021 13:57:44 GMT
server: AmazonS3
x-amz-meta-bucketexplorer-md5: 540f65d2b2f94032d6c3037622843a50
etag: "540f65d2b2f94032d6c3037622843a50"
content-type: image/gif
x-amz-meta-bucket: assets.feedblitz.com
cache-control: public, max-age=864000, immutable
x-amz-meta-bucketexplorer-sha1: 2b2daec8418c9d49f14de9122d9a9a91629b7d93
accept-ranges: bytes
x-amz-meta-id: 382b969a55524a1b465f34b2ca00ec47a045e677aadbda2cb29f4d682daa649f
x-amz-cf-id: iw44iZwydRw5QnncrObY4-9fwxQYhlHV-OG9616Mxolf5mtNBrPTrQ==

POST
H2 200 j
avsplow.com/a/ 2 B
347 B 48ms
48ms Ping
text/plain 185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://avsplow.com/a/j
Requested by: Host: st.avsplow.com
URL: https://st.avsplow.com/19.18.9/sp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.southafricacheapflights.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.southafricacheapflights.com
date: Tue, 07 Feb 2023 00:08:21 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"

POST
H2 200 j
avsplow.com/a/ 2 B
347 B 50ms
50ms Ping
text/plain 185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://avsplow.com/a/j
Requested by: Host: st.avsplow.com
URL: https://st.avsplow.com/19.18.9/sp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.southafricacheapflights.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.southafricacheapflights.com
date: Tue, 07 Feb 2023 00:08:21 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"

GET
H2 200 8229fa5a5c3ebd24f3e2eb95db7eba72.js Show response
www.gstatic.com/mysidia/ Frame 3AB7 9 KB
5 KB 144ms
46ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8229fa5a5c3ebd24f3e2eb95db7eba72.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3205907082861840&output=html&h=280&slotname=6527298723&adk=3349968481&adf=3248184483&pi=t.ma~as.6527298723&w=762&fwrn=4&fwrnh=100&lmt=1675728501&rafmt=1&format=762x280&url=https%3A%2F%2Fwww.southafricacheapflights.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1675728501424&bpp=65&bdt=717&idt=65&shv=r20230202&mjsv=m202301170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1767846474577&frm=20&pv=1&ga_vid=223379191.1675728501&ga_sid=1675728501&ga_hid=1504167397&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=224&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071756&oid=2&pvsid=1112848247560789&tmod=334677973&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=LJWcbm45F4&p=https%3A//www.southafricacheapflights.com&dtd=73

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b597bf422617af67b2ffe3e420f0fd2d9a01a3b95020e368c57b2a131151158

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 14:05:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 381764
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4209
x-xss-protection: 0
last-modified: Wed, 01 Feb 2023 06:12:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 03 May 2023 14:05:37 GMT

GET
H2 200 9e5698c686bc55900eb7505b234da968.js Show response
www.gstatic.com/mysidia/ Frame 3AB7 10 KB
4 KB 145ms
47ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9e5698c686bc55900eb7505b234da968.js?tag=text/vanilla_highlight

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98a03cded6a2bd3976ad215e9f51af528f6be61edf3666ea4656e35a87f13687

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 16:35:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 372749
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4467
x-xss-protection: 0
last-modified: Fri, 27 Jan 2023 00:31:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 03 May 2023 16:35:52 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 3AB7 8 KB
1 KB 151ms
53ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 06 Feb 2023 22:08:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Feb 2023 00:08:21 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/ Frame 3AB7 2 KB
846 B 43ms
39ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 01:03:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83091
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 01:03:31 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/ Frame 3AB7 22 KB
9 KB 172ms
81ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1caae31a6a05aa0be067b968fb12c9421ee72184a2a2db915a54d3330f7be923

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 00:56:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83498
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9012
x-xss-protection: 0
server: cafe
etag: 10578598109654303351
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 00:56:43 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/ Frame 3AB7 3 KB
1 KB 43ms
41ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 18:49:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 18:49:36 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/ Frame 3AB7 18 KB
8 KB 172ms
82ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2bf373aab01a96fddf0099658b27e2eefb64c4aac7061d97d629fd7ca9a42534

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 00:56:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83497
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7647
x-xss-protection: 0
server: cafe
etag: 2161395064574532456
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 00:56:44 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3AB7 157 KB
49 KB 148ms
58ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c90fa7f2b86e88bc876a28a908c00565250cfbdce151c8f3e5800bf98fa394c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49146
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1675254965429469"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 07 Feb 2023 00:08:21 GMT

GET
H2 200 8aec859a266e19fb42fee7f82edeac28.js Show response
www.gstatic.com/mysidia/ Frame 3AB7 33 KB
14 KB 81ms
79ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8aec859a266e19fb42fee7f82edeac28.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07970172ef078d9a58aa9ed9e9b54dd1cfbfec021be21b0d0fc7484c5fd5a58a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Sun, 05 Feb 2023 15:32:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117366
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14079
x-xss-protection: 0
last-modified: Wed, 01 Feb 2023 06:12:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 06 May 2023 15:32:16 GMT

GET
H3 200 styles.a46f9b1c859ea77ef197.css
www.travelstart.co.za/ Frame 8E37 409 KB
65 KB 95ms
94ms Stylesheet
text/css 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/styles.a46f9b1c859ea77ef197.css
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5adeb96ad5450c8215350b0e3f8e40ebcdb4d8ee93e041312965acbcf56dfa16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
x-amz-version-id: null
via: 1.1 d1065aa7163db3a0368b157f398a77ec.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN51-P1
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 27 Jan 2023 12:12:23 GMT
server: cloudflare
etag: W/"e017a3007374e975284a95698973cd13"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 7957e400ea6f2c26-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,TS-country,TS-language,TS-source
x-amz-cf-id: oQZx1F7ktignMXrXVfgGh8xHrJ2dJNkgASkAWMrhW-CvFIZaD6Y1Kw==
expires: Tue, 07 Feb 2023 00:28:21 GMT

GET
H3 200 runtime-es2015.404c69666ed624613703.js Show response
www.travelstart.co.za/ Frame 8E37 2 KB
2 KB 54ms
53ms Script
application/javascript 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/runtime-es2015.404c69666ed624613703.js
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e3c6d48c9c7dbb7c899dbb021ebba1e8047cdd95b06226fcb75b505d7b62829

Request headers

Referer: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
x-amz-version-id: null
via: 1.1 3f691588ca081b6d917addc7d27405b4.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN51-P1
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 01 Feb 2023 07:43:58 GMT
server: cloudflare
etag: W/"54cf49f5f444f2f6d0f45dafece2a588"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 7957e400ea702c26-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,TS-country,TS-language,TS-source
x-amz-cf-id: wXtNRg-Ul-lJDoaDZeCcuBxXdHeHUhBdcOKPG98GHX1KNp7-Supb7g==
expires: Tue, 07 Feb 2023 00:28:21 GMT

GET
H3 200 polyfills-es2015.7efd60621c1fcbdabec0.js Show response
www.travelstart.co.za/ Frame 8E37 85 KB
29 KB 55ms
55ms Script
application/javascript 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/polyfills-es2015.7efd60621c1fcbdabec0.js
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbd1f3bd76f9bcf6e437c1ab9206d2a3079a6e0c34cf3d41e4bcbf4802837685

Request headers

Referer: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
x-amz-version-id: null
via: 1.1 587008ba996b678a886e443d280cf96a.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN51-P1
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 27 Jan 2023 12:12:23 GMT
server: cloudflare
etag: W/"b5b9c317ce00650929db9a7ad8e4fe39"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 7957e400ea732c26-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,TS-country,TS-language,TS-source
x-amz-cf-id: SjNRJONYbsC8SzkAQiIm0-aRlg7XDw5RDQAaqxQGhxy33qH4v5RgIA==
expires: Tue, 07 Feb 2023 00:28:21 GMT

GET
H3 200 scripts.cb3279593ea4f130ad1b.js Show response
www.travelstart.co.za/ Frame 8E37 196 KB
63 KB 397ms
396ms Script
application/javascript 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/scripts.cb3279593ea4f130ad1b.js
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3bb7f5958170cc19b125c07a1505cc233dcea3b3966c5934e6005d2cb12d636

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
x-amz-version-id: null
via: 1.1 46e66d8a43c4da941c24d6cc77f3c0da.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN51-P1
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 27 Jan 2023 12:12:23 GMT
server: cloudflare
etag: W/"03a11cf302b1fbf3bdf36da88827427b"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 7957e400fa7b2c26-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,TS-country,TS-language,TS-source
x-amz-cf-id: f622oY5ZPB3-ezWlt2HE1zfmq_85HEyMa1Rz-TYxd7mLHM6F9cQ-2w==
expires: Tue, 07 Feb 2023 00:28:21 GMT

GET
H3 200 main-es2015.1fef3a8c5c0d717ecd53.js Show response
www.travelstart.co.za/ Frame 8E37 4 MB
857 KB 187ms
187ms Script
application/javascript 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/main-es2015.1fef3a8c5c0d717ecd53.js
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94e85586b47ae1cf74156a2733affac5d712a52cb9ea32e4fa496f9ec2e82ff5

Request headers

Referer: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
x-amz-version-id: null
via: 1.1 a8d7d3dded45c4593e4083a2053f8e08.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN51-P1
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 01 Feb 2023 07:43:57 GMT
server: cloudflare
etag: W/"efe56492fbb58b9b766e199ba309681b"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 7957e400ea752c26-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,TS-country,TS-language,TS-source
x-amz-cf-id: ojET32QdF4tLv0pRighZYcUEYctdHGWhKBtb-XGJl-A-KbScW52nzQ==
expires: Tue, 07 Feb 2023 00:28:21 GMT

GET
H2 200 vaafb692b2aea4879b33c060e79fe94621666317369993 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame 8E37 17 KB
6 KB 173ms
67ms Script
text/javascript 2606:4700::6810:3965
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3

Request headers

Referer: https://www.travelstart.co.za/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
last-modified: Fri, 21 Oct 2022 01:56:09 GMT
server: cloudflare
etag: W/2022.10.1
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 7957e4019bdbbb83-FRA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 8E37 241 KB
67 KB 70ms
69ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TZB8WNH

Requested by

Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ee0ea76e7b5536eef65c7059d682ed54d2873f1ff9a7e91a87c55f5452d03421

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 68407
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 Feb 2023 00:08:21 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301170101/ 150 KB
51 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301170101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a3b08a66fcfde2c7b538d11e1ef15916e46d007832f2a40629c1150c0090e5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52192
x-xss-protection: 0
server: cafe
etag: 1041287213375046164
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H2 200 async-ads.js Show response
www.google.com/adsense/search/ 140 KB
52 KB 160ms
58ms Script
text/javascript 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/adsense/search/async-ads.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85ded2f008c94dc48accbeaa127fe3e625f57df66e387648caca7e3228203518

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
etag: "9018236020628771199"
vary: Accept-Encoding
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
accept-ranges: bytes
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 74ms
73ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_auto_rs&sts=ok&evt=place&vh=1200&eid=44766999&pvc=1112848247560789

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 8E37 248 KB
80 KB 76ms
74ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M5XBMKV&l=dataLayer

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9dee02aeeb0625ae8a1a727868168f660124d1b79129a6a21408d7555f94f717

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 81372
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H/1.1 200
OK dtm.js Show response
dtm-dre.platform.hicloud.com/download/web/ Frame 8E37 45 KB
45 KB 168ms
53ms Script
application/javascript 80.158.18.121
AS6878

General

Check archive.org

Show headers Download Go to

Full URL

https://dtm-dre.platform.hicloud.com/download/web/dtm.js?id=DTM-ac1262027c6e10a2817cc06442e74a12

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

80.158.18.121 , Germany, ASN6878 (AS6878, DE),

Reverse DNS

ecs-80-158-18-121.reverse.open-telekom-cloud.com

Software

elb /

Resource Hash

f78076c88dc1857960ecdcb0b9e32d22ec71921e25bfbbd4ea5285c33d8606c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Tue, 07 Feb 2023 00:08:20 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Server: elb
X-frame-options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=utf-8
Cache-Control: private,max-age=900
Content-Disposition: inline
Connection: keep-alive
X-XSS-Protection: 1; mode=block

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 8E37 209 KB
74 KB 54ms
53ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VMT7E11PJK&l=dataLayer&cx=c

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fba8688323036b2ccff912e8ed1128c42a361c2f2a4397c85363cc1ec453dcaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 75810
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3AB7 0
0 102ms
102ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CDZN3dZbhY5bpIdiP78EP2eKkkAzpl5jtbt-wwpGfEcCNtwEQASC7rsURYJXCpoKwB6ABzsaS3wLIAQGpAkpR8hrg_LE-qAMByAPDBKoEjgJP0PW5XcTy_TIZWOTM9GFhGCo95QBh1ighxQi3IcAn0z7mx_8SH68pc3GDIw7TITIwhtYFfphUijTzerYDedWHcG17u4fPDvLzgWAzsq0T-FDkjRaJ9ZgZ2-K6Tj4Rx3ly7PaOPnL1pG76kWJGzPg9VRvp2p9CU-yYrhUBD781svMWboMHajn8rH54wqluS6VoSmxODcAAoTAoZRBA6TnyXQW33Z1lYMoIPmJq1LdedWl0eAg9vbQGQOIMdRaBVSZ-B5FFfbfm4Xcf426pxtsh8IFE5WLWrCv1BmGG_6oOa2qzP9wUBKaRKHOf7AzPMH-28CsyUGRT9MwHRiXSkqL4PYDsbkYabsT9r5iRqqnABKfwoJyKApIFBAgEGAGSBQQIBRgEoAZmgAeaue2gAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEKz2MtIIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMV0BUBgBcBshccChoIABIUcHViLTMyMDU5MDcwODI4NjE4NDAYAA&sigh=NxPaWBe_W0c&uach_m=[UACH]&cid=CAQSGwDUE5ymHIAGnQVjTdXIz9yBXTxXYceQ-Lx8OxgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3205907082861840&output=html&h=280&slotname=6527298723&adk=3349968481&adf=3248184483&pi=t.ma~as.6527298723&w=762&fwrn=4&fwrnh=100&lmt=1675728501&rafmt=1&format=762x280&url=https%3A%2F%2Fwww.southafricacheapflights.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1675728501424&bpp=65&bdt=717&idt=65&shv=r20230202&mjsv=m202301170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1767846474577&frm=20&pv=1&ga_vid=223379191.1675728501&ga_sid=1675728501&ga_hid=1504167397&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=224&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071756&oid=2&pvsid=1112848247560789&tmod=334677973&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=LJWcbm45F4&p=https%3A//www.southafricacheapflights.com&dtd=73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 07 Feb 2023 00:08:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 012F 143 B
166 B 40ms
39ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3205907082861840&output=html&h=280&slotname=6527298723&adk=3349968481&adf=3248184483&pi=t.ma~as.6527298723&w=762&fwrn=4&fwrnh=100&lmt=1675728501&rafmt=1&format=762x280&url=https%3A%2F%2Fwww.southafricacheapflights.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1675728501424&bpp=65&bdt=717&idt=65&shv=r20230202&mjsv=m202301170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1767846474577&frm=20&pv=1&ga_vid=223379191.1675728501&ga_sid=1675728501&ga_hid=1504167397&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=230&ady=224&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31071756&oid=2&pvsid=1112848247560789&tmod=334677973&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=LJWcbm45F4&p=https%3A//www.southafricacheapflights.com&dtd=73
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 324
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:02:58 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3AB7 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 123fe4944eb0f80e31d33112895744634c8b24e1a754588cbac964a0ce6a91cb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 50ms
47ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.southafricacheapflights.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 52ms
50ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.southafricacheapflights.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/ Frame 3740 10 KB
4 KB 43ms
42ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.southafricacheapflights.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 74971
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 06 Feb 2023 03:18:51 GMT
etag: 10353107486223812946
expires: Mon, 20 Feb 2023 03:18:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/ Frame 4C62 10 KB
4 KB 51ms
46ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.southafricacheapflights.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 74971
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 06 Feb 2023 03:18:51 GMT
etag: 10353107486223812946
expires: Mon, 20 Feb 2023 03:18:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 3AB7 28 KB
28 KB 137ms
40ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 10:59:50 GMT
x-content-type-options: nosniff
age: 306512
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Feb 2024 10:59:50 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 012F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

50ms
49ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:22 GMT
expires: Tue, 07 Feb 2023 00:08:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:22 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/724060168/ Frame 8E37 2 KB
2 KB 166ms
52ms Script
text/javascript 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/724060168/?random=1675728502371&cv=11&fst=1675728502371&bg=ffffff&guid=ON&async=1&gtm=45He3210&u_w=1600&u_h=1200&label=nchwCKDt_qUBEIiQodkC&hn=www.googleadservices.com&frm=2&url=https%3A%2F%2Fwww.travelstart.co.za%2Fsearch-on-index%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%2F%2Fwww.southafricacheapflights.com%2F&ref=https%3A%2F%2Fwww.southafricacheapflights.com%2F&tiba=Search%20and%20Book%20Cheap%20Flights%20%7C%20Travelstart&value=0&bttype=purchase&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s46-in-f2.1e100.net

Software

cafe /

Resource Hash

fe6c5a49c6fad7e4eb29bbd8047bad07161797648fe74a1f6ccc4dc7688ba16e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1209
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ld.js Show response
dynamic.criteo.com/js/ld/ Frame 8E37 43 KB
15 KB 212ms
94ms Script
application/javascript 2a02:2638:1::d
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dynamic.criteo.com/js/ld/ld.js?a=11171

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

17dfd1e7e55698bdc34982e02dce6c617f4bf84f120a931b7b309f1aa0351bdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public,max-age=10800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2

200

blank.gif
assets.feedblitzstatic.com/images/
Redirect Chain

https://app.feedblitz.com/formdata/20764/8920cd22-66b4-4a73-a0bf-540b145c97f6/https://www.southafricacheapflights.com/
https://assets.feedblitzstatic.com/images/blank.gif

43 B
691 B

42ms
41ms

Image
image/gif

13.224.189.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.feedblitzstatic.com/images/blank.gif
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Server: 13.224.189.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-9.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 30 Jan 2023 21:09:44 GMT
x-amz-meta-key: images/blank.gif
via: 1.1 0e7eb16f335fe24acf3f13c5dee19c88.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 615519
x-cache: Hit from cloudfront
x-amz-meta-md5-hash: fc94fb0c3ed8a8f909dbc7630a0987ff
content-length: 43
x-amz-meta-etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
last-modified: Fri, 05 Feb 2021 13:57:36 GMT
server: AmazonS3
x-amz-meta-bucketexplorer-md5: fc94fb0c3ed8a8f909dbc7630a0987ff
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
content-type: image/gif
x-amz-meta-bucket: assets.feedblitz.com
cache-control: public, max-age=864000, immutable
x-amz-meta-bucketexplorer-sha1: 56d45f8a17f5078a20af9962c992ca4678450765
accept-ranges: bytes
x-amz-meta-id: 382b969a55524a1b465f34b2ca00ec47a045e677aadbda2cb29f4d682daa649f
x-amz-cf-id: _J3dOgn2GU0GMRmj8GWVnF2aSFF0KZVgSNIVNDV60TXhwuAylBqclg==

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Date: Tue, 07 Feb 2023 00:08:22 GMT
X-Content-Type-Options: nosniff
Server: Microsoft-IIS/10.0
X-fbzip: 74.208.14.106
X-Frame-Options: sameorigin
Content-Type: text/html; charset=UTF-8
Location: https://assets.feedblitzstatic.com/images/blank.gif
Access-Control-Allow-Origin: *
Content-Length: 0
X-XSS-Protection: 1

GET
H2 200 css2
fonts.googleapis.com/ Frame 3740 4 KB
732 B 61ms
58ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 06 Feb 2023 23:25:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 3740 205 B
229 B 48ms
47ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 20:31:45 GMT
x-content-type-options: nosniff
age: 12997
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 06 Feb 2024 20:31:45 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 3740 604 B
628 B 49ms
47ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 23:32:50 GMT
x-content-type-options: nosniff
age: 2132
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 06 Feb 2024 23:32:50 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/elements/html/ Frame 3740 20 KB
8 KB 47ms
45ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

675575eb734b5114526cdc1cc9116bea0e2189e9351700944375af81e226f62d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 01:54:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80036
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8365
x-xss-protection: 0
server: cafe
etag: 8727046649480766555
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 01:54:26 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 394 B
322 B 54ms
53ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.southafricacheapflights.com&client=partner-pub-3205907082861840&product=SAS&callback=__sasCookie

Requested by

Host: www.google.com
URL: https://www.google.com/adsense/search/async-ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f04b15a548a85e8d8d0ca4d5cb8ca077d0f3a9008f5a7fb54bcc72aea4e0dad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 253
x-xss-protection: 0

GET
H3 200 ads Show response
www.google.com/afs/ Frame BEC2 6 KB
2 KB 127ms
126ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/afs/ads?psid=5134551505&channel=AutoRsVariant&fexp=44766999%2C21404%2C17301140%2C17301144%2C17301146&client=pub-3205907082861840&r=m&hl=en&rpbu=http%3A%2F%2Fgoogle.com&rpqp=q&type=3&rs_tt=c&oe=UTF-8&ie=UTF-8&format=r5&nocache=691675728502441&num=0&output=afd_ads&domain_name=www.southafricacheapflights.com&v=3&bsl=10&pac=0&u_his=2&u_tz=0&dt=1675728502441&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1995&frm=0&cl=503972142&uio=-&cont=autors-container-0&jsid=csa&jsv=503972142&rurl=https%3A%2F%2Fwww.southafricacheapflights.com%2F&adbw=master-1%3A752

Requested by

Host: www.google.com
URL: https://www.google.com/adsense/search/async-ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

fadd2893a492d84b3424a4aaf6c8f7dc6687c76ee54c74e2cc11842176a9a67d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.southafricacheapflights.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=3600
content-disposition: inline
content-encoding: br
content-length: 2288
content-type: text/html; charset=UTF-8
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="gws"
date: Tue, 07 Feb 2023 00:08:22 GMT
expires: Tue, 07 Feb 2023 00:08:22 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
server: gws
x-xss-protection: 0

GET
H3 200 8229fa5a5c3ebd24f3e2eb95db7eba72.js Show response
www.gstatic.com/mysidia/ Frame 4C62 9 KB
4 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8229fa5a5c3ebd24f3e2eb95db7eba72.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b597bf422617af67b2ffe3e420f0fd2d9a01a3b95020e368c57b2a131151158

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 14:05:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 381765
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4209
x-xss-protection: 0
last-modified: Wed, 01 Feb 2023 06:12:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 03 May 2023 14:05:37 GMT

GET
H3 200 9e5698c686bc55900eb7505b234da968.js Show response
www.gstatic.com/mysidia/ Frame 4C62 10 KB
4 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9e5698c686bc55900eb7505b234da968.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98a03cded6a2bd3976ad215e9f51af528f6be61edf3666ea4656e35a87f13687

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 16:35:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 372750
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4467
x-xss-protection: 0
last-modified: Fri, 27 Jan 2023 00:31:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 03 May 2023 16:35:52 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 4C62 8 KB
968 B 61ms
58ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 06 Feb 2023 22:08:56 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/ Frame 4C62 2 KB
799 B 64ms
62ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 01:03:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83091
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 01:03:31 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/ Frame 4C62 22 KB
9 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1caae31a6a05aa0be067b968fb12c9421ee72184a2a2db915a54d3330f7be923

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 00:56:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83499
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9012
x-xss-protection: 0
server: cafe
etag: 10578598109654303351
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 00:56:43 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/ Frame 4C62 3 KB
1 KB 65ms
63ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 18:49:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 18:49:36 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/ Frame 4C62 18 KB
8 KB 48ms
46ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2bf373aab01a96fddf0099658b27e2eefb64c4aac7061d97d629fd7ca9a42534

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 00:56:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83498
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7647
x-xss-protection: 0
server: cafe
etag: 2161395064574532456
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 00:56:44 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4C62 157 KB
48 KB 77ms
75ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c90fa7f2b86e88bc876a28a908c00565250cfbdce151c8f3e5800bf98fa394c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49146
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1675254965429469"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H3 200 8aec859a266e19fb42fee7f82edeac28.js Show response
www.gstatic.com/mysidia/ Frame 4C62 33 KB
14 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8aec859a266e19fb42fee7f82edeac28.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07970172ef078d9a58aa9ed9e9b54dd1cfbfec021be21b0d0fc7484c5fd5a58a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Sun, 05 Feb 2023 15:32:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117366
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14079
x-xss-protection: 0
last-modified: Wed, 01 Feb 2023 06:12:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 06 May 2023 15:32:16 GMT

OPTIONS
H2 200 web
loco.travelstart.com/translations/ Frame 0
0 444ms
155ms Preflight 104.19.160.97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loco.travelstart.com/translations/web?country=ZA&language=en&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.160.97 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,ts-country,ts-language
Access-Control-Request-Method: GET
Origin: https://www.travelstart.co.za
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type, ts-country, ts-language
access-control-allow-methods: GET,HEAD,POST
access-control-allow-origin: https://www.travelstart.co.za
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7957e4075ccb3663-FRA
content-length: 0
date: Tue, 07 Feb 2023 00:08:23 GMT
server: cloudflare
vary: Origin
x-application-context: loco:production:8080

OPTIONS
H2 200 web
loco.travelstart.com/translations/ Frame 0
0 459ms
172ms Preflight 104.19.160.97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loco.travelstart.com/translations/web?country=ZA&language=en&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.160.97 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,ts-country,ts-language
Access-Control-Request-Method: GET
Origin: https://www.travelstart.co.za
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type, ts-country, ts-language
access-control-allow-methods: GET,HEAD,POST
access-control-allow-origin: https://www.travelstart.co.za
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7957e4075ccc3663-FRA
content-length: 0
date: Tue, 07 Feb 2023 00:08:23 GMT
server: cloudflare
vary: Origin
x-application-context: loco:production:8080

OPTIONS
H2 200 /
wapi.travelstart.com/website-services/api/countries/ Frame 0
0 345ms
58ms Preflight 176.34.212.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wapi.travelstart.com/website-services/api/countries/?language=en&correlation_id=e5ac612f-a470-411c-9d99-1f30a8c9a41a
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.34.212.241 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-212-241.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,ts-country,ts-language
Access-Control-Request-Method: GET
Origin: https://www.travelstart.co.za
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin,access-control-request-method,accept,access-control-allow-origin,authorization,last-modified,access-control-allow-credentials,x-requested-with,access-control-request-headers,ts-country,content-type,ts-source,ts-language
access-control-allow-methods: GET
access-control-allow-origin: https://www.travelstart.co.za
access-control-max-age: 10
content-length: 0
date: Tue, 07 Feb 2023 00:08:22 GMT
server: Apache

OPTIONS
H2 204 /
api.country.is/ Frame 0
0 643ms
357ms Preflight 2606:4700:20::681a:e2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.country.is/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:e2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,ts-country,ts-language
Access-Control-Request-Method: GET
Origin: https://www.travelstart.co.za
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-headers: content-type,ts-country,ts-language
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 7957e40758659bce-FRA
content-length: 0
date: Tue, 07 Feb 2023 00:08:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lLTgx7WboS4JABV2Yo6L%2BpefDrz7DDCEsxsiydVNoPkITTmOSKZPYWNwkDgXTuUQT4kMXqZihSAcWNwS6AkaT0W9GjOkR%2FYnSDILTBGPYYKolDtLpfmiFK5Bj3B6u8ejWyv%2B3ktHUDgg%2BTR5"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Access-Control-Request-Headers

GET
H2 200 1eq7s6k31 Show response
embed.tawk.to/590b02ae4ac4446b24a6d2d2/ Frame 8E37 2 KB
948 B 324ms
50ms Script
application/x-javascript 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/590b02ae4ac4446b24a6d2d2/1eq7s6k31

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ee8198b98d57f4994d281b1b1af08e6141f140f647e1bd2e9c8302ae6d715ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.travelstart.co.za/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
server: cloudflare
age: 551
etag: W/"stable-v4-63b77dcd282"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, s-maxage=3600
cf-ray: 7957e40738009c10-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 web Show response
loco.travelstart.com/translations/ Frame 8E37 149 KB
37 KB 95ms
94ms XHR
application/json 104.19.160.97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loco.travelstart.com/translations/web?country=ZA&language=en&
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.160.97 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31e6c6c8223b3c233a3e4e2b3f8ecd65688e32dd743b74686661a1c5678dc1a7

Request headers

Content-Type: application/json
Accept: application/json
TS-country: ZA
Referer: https://www.travelstart.co.za/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
TS-language: en

Response headers

date: Tue, 07 Feb 2023 00:08:23 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.travelstart.co.za
access-control-allow-credentials: true
cf-ray: 7957e4084d7a3663-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-application-context: loco:production:8080

GET
H2 200 web Show response
loco.travelstart.com/translations/ Frame 8E37 149 KB
37 KB 75ms
75ms XHR
application/json 104.19.160.97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loco.travelstart.com/translations/web?country=ZA&language=en&
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.160.97 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31e6c6c8223b3c233a3e4e2b3f8ecd65688e32dd743b74686661a1c5678dc1a7

Request headers

Content-Type: application/json
Accept: application/json
TS-country: ZA
Referer: https://www.travelstart.co.za/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
TS-language: en

Response headers

date: Tue, 07 Feb 2023 00:08:23 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.travelstart.co.za
access-control-allow-credentials: true
cf-ray: 7957e4086d963663-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-application-context: loco:production:8080

GET
H2 200 / Show response
wapi.travelstart.com/website-services/api/countries/ Frame 8E37 17 KB
17 KB 58ms
57ms XHR
application/json 176.34.212.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wapi.travelstart.com/website-services/api/countries/?language=en&correlation_id=e5ac612f-a470-411c-9d99-1f30a8c9a41a
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.34.212.241 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-212-241.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 114169a02f247c62d4a76c05ba1fa054b1f80e1fcab845363ae415f50c4c66c4

Request headers

Content-Type: application/json
Accept: application/json
TS-country: ZA
Referer: https://www.travelstart.co.za/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
TS-language: en

Response headers

sec-fetch-mode: cors
date: Tue, 07 Feb 2023 00:08:23 GMT
origin: https://www.travelstart.co.za
accept-encoding: gzip, deflate, br
language: en
correlation_id: e5ac612f-a470-411c-9d99-1f30a8c9a41a
accept-language: de-DE,de;q=0.9
x-forwarded-for: 80.255.7.100
ts-country: ZA
sec-fetch-dest: empty
x-forwarded-proto: https
content-length: 16958
server: Apache
x-amzn-trace-id: Root=1-63e19676-7843a4706b2f2d2b5112785d
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
content-type: application/json
access-control-allow-origin: https://www.travelstart.co.za
accept: application/json
access-control-expose-headers: Authorization,TS-language,Access-Control-Allow-Origin,Access-Control-Allow-Credentials,TS-country
referer: https://www.travelstart.co.za/
access-control-allow-credentials: true
sec-fetch-site: cross-site
x-forwarded-port: 443
breadcrumbid: ID-i-0beacb35a4af6a42c-44514-1675726408587-0-66502
ts-language: en

GET
H2 200 / Show response
api.country.is/ Frame 8E37 43 B
412 B 374ms
356ms XHR
application/json 2606:4700:20::681a:e2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.country.is/
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:e2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21bee4db5c786a6c79fac54502db966b828e8374a52a6aafa0cae9f41c8ce63a

Request headers

Content-Type: application/json
Accept: application/json
TS-country: ZA
Referer: https://www.travelstart.co.za/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
TS-language: en

Response headers

date: Tue, 07 Feb 2023 00:08:23 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "2b-9JLRjwDXok/jbN24mtxgfMC0Z0c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FZVjUL0TWaQ8WoUmTeR58c67rNk58Fp5%2Frm%2F%2FB1j3yPrNwpWXXX3Sn0gCX4xBlf7UX4ykNbBemEIdBMNVjGhsgtjDaAUdIO6UMZe3O2%2BfPS8sBdsUsKwtuIMpFe2tUJOka0rc54JlgCDmPNd"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7957e409aa3f9bce-FRA
content-length: 43

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 8E37 241 KB
67 KB 86ms
85ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TZB8WNH

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

229d27626fbe0fa82d67c235d27ab08c67fb6635c3d3a58f153bac7ee999761b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 68257
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H3 200 1-es2015.c3c076db58649d9603ac.js Show response
www.travelstart.co.za/ Frame 8E37 463 KB
69 KB 71ms
70ms Script
application/javascript 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/1-es2015.c3c076db58649d9603ac.js
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa88afa82ef67bdb0daeedafd49158952580d4b5d0a8c5da988dd16fbe70f1c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
x-amz-version-id: null
via: 1.1 d4657bc6bf8da8c5da2e946f2079a11a.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN51-P1
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 01 Feb 2023 07:43:05 GMT
server: cloudflare
etag: W/"ed5ab862bf3181f69e3a845ba61eedac"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 7957e405ad352c26-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,TS-country,TS-language,TS-source
x-amz-cf-id: sZYE_0RJRcSXRHq22Ywqyb3F0bRIyhIGJ2pGJ6SkCcNkwCYZfzbZPQ==
expires: Tue, 07 Feb 2023 00:28:22 GMT

GET
H3 200 6-es2015.20768716c630cdf27b38.js Show response
www.travelstart.co.za/ Frame 8E37 244 KB
44 KB 64ms
64ms Script
application/javascript 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/6-es2015.20768716c630cdf27b38.js
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a69940b6cef172f1cab443d8755463509d21cc9a4c3b61b9fd2846b79d3bab8d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
x-amz-version-id: null
via: 1.1 a67f3b9136ffbd5e2186ff4b9d3119ba.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN51-P1
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 01 Feb 2023 07:43:05 GMT
server: cloudflare
etag: W/"a64287834340724389cfc51a9fd8d8f2"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 7957e405ad372c26-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,TS-country,TS-language,TS-source
x-amz-cf-id: iwGNTFmSmaxOSoVUqHCbOrsFpBS2QSM_oMyMAJeeBBc3kPB0P_-Bjw==
expires: Tue, 07 Feb 2023 00:28:22 GMT

GET
H2 200 platform.js Show response
apis.google.com/js/ Frame 8E37 54 KB
21 KB 298ms
50ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34733e6f59010024c036b2a25e711808ef85bfcca8e1afd607ba34bfa762bfb6

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 07 Feb 2023 00:08:22 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "d180a2ced31e8f24"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 8E37 3 KB
2 KB 290ms
42ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

742fc3808a614fc993365a8a71f5ae1d170ed88ddaee326dc933fa7073828eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 07 Feb 2023 00:08:22 GMT
content-md5: PHhZv/9V3be5vwgPofhXjg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1684
x-fb-rlafr: 0
x-fb-debug: 0krMdNvvVNvsloAgrQf3+0c2kgqi0ieqxmeqW5E7RCX3jIpSlrRDW8ePv5h9y8ZOfjW6N9+PYQgoVr7WAdwU5A==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 917726464
x-fb-content-md5: a99e3a8080ffced9dd3efdfcc37a8baa
cross-origin-opener-policy: same-origin-allow-popups
etag: "d773206745cd89e212cde5a90a43bdb3"
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Tue, 07 Feb 2023 00:19:33 GMT

GET
H3 200 Group%2020664.svg
www.travelstart.co.za/assets/icons/ Frame 8E37 1 KB
858 B 56ms
55ms Image
image/svg+xml 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelstart.co.za/assets/icons/Group%2020664.svg
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4daa303c0637f84d8f83bcfc80a1fd002e8eeb538e2f91f7ea7dcac755920d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
x-amz-version-id: null
via: 1.1 bf7ddccbb38083d1ce515f8046ed53b4.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN50-C2
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 27 Jan 2023 12:11:37 GMT
server: cloudflare
etag: W/"886d2614be8ebb4fdd92cefd21063289"
vary: Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1200
cf-ray: 7957e4066da42c26-FRA
x-amz-cf-id: 2EbJhfD5_cLOAOwOB3gYpQrJ244Xl7C5985XB5UbsspfWVMWKpsKug==
expires: Tue, 07 Feb 2023 00:28:22 GMT

GET
H2 200 ts-logo-EN.svg
www.travelstart.com/assets/img/logos/ Frame 8E37 8 KB
3 KB 370ms
228ms Image
image/svg+xml 104.19.160.97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelstart.com/assets/img/logos/ts-logo-EN.svg
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.160.97 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 773d6b46b2648bbf427beb7fd078c23eee573eb0029a6d69b31771113a32aef5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:23 GMT
x-amz-version-id: null
via: 1.1 8e2465f23cb732983113a5a1f361cfe4.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
content-encoding: br
x-amz-cf-pop: MAN51-P1
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 01 Feb 2023 07:43:52 GMT
server: cloudflare
etag: W/"7c5508d790ab8af8bf3705d3e08cd1d9"
vary: Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=28800
cf-ray: 7957e4075c79908b-FRA
x-amz-cf-id: UH6txwo-bCharznVY0DJMh5NaAAx-fv2EwFjd2xXA31J0eD5bCetaA==
expires: Tue, 07 Feb 2023 08:08:23 GMT

GET
H3 200 facebook-icn.svg
www.travelstart.co.za/assets/images/ Frame 8E37 1 KB
1 KB 56ms
53ms Image
image/svg+xml 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelstart.co.za/assets/images/facebook-icn.svg
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c8011851570e5733721ce3f317e6135903f844321d853b26f2e78fa3689c5fb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
x-amz-version-id: null
via: 1.1 57848aee7db89203b80a027107beee20.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN50-C2
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 27 Jan 2023 12:11:52 GMT
server: cloudflare
etag: W/"429e3fc2e5b17ffdc94b18bfaf28bdd2"
vary: Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1200
cf-ray: 7957e4067da52c26-FRA
x-amz-cf-id: b1dcJLY6_uvRNtgh9yKJv6tT8BN8Y0mZkAObLcYMpn1QdVrdCgOK7g==
expires: Tue, 07 Feb 2023 00:28:22 GMT

GET
H3 200 google-icn.svg
www.travelstart.co.za/assets/images/ Frame 8E37 2 KB
1 KB 59ms
55ms Image
image/svg+xml 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelstart.co.za/assets/images/google-icn.svg
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba0889bd87875c092e5fd5615a70d76c4512c700f8dc99d77c25c400f66a3df9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
x-amz-version-id: null
via: 1.1 194504167e4d01fad3a14d0632c4a12e.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN50-C2
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 27 Jan 2023 12:11:52 GMT
server: cloudflare
etag: W/"54ab8a21733d2b3ab5449312c29800a0"
vary: Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1200
cf-ray: 7957e4067da72c26-FRA
x-amz-cf-id: IldiNOPvkQfDz2fUFxmrM9q4obEh3dHxgh5xSyiHw_Jtj0w5Fpx8Lg==
expires: Tue, 07 Feb 2023 00:28:22 GMT

GET
H3 200 Group%2019030.svg
www.travelstart.co.za/assets/icons/ Frame 8E37 1 KB
1 KB 59ms
56ms Image
image/svg+xml 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelstart.co.za/assets/icons/Group%2019030.svg
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 562722d5e9bb0f13fff5ba234654a50412130eec7684cbb472666e51df5a66db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
x-amz-version-id: null
via: 1.1 1cea41348481b3edf706fcd9a48d6eea.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN51-P1
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 01 Feb 2023 07:43:06 GMT
server: cloudflare
etag: W/"d8b8ce5f242ed7ffdf19f74ecd41f2b6"
vary: Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1200
cf-ray: 7957e4067da82c26-FRA
x-amz-cf-id: 5zP94rjsWIL69ARITjyVMemBdyUcnNQdRs42v9WQCpfDcHgBiVAE9A==
expires: Tue, 07 Feb 2023 00:28:22 GMT

GET
H3 200 Group%2019028.svg
www.travelstart.co.za/assets/icons/ Frame 8E37 2 KB
1 KB 61ms
58ms Image
image/svg+xml 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelstart.co.za/assets/icons/Group%2019028.svg
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cbede3acf5a4c0b3cf99c55649b1bba8a5b71b593578dffb4891215480bae60

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
x-amz-version-id: null
via: 1.1 93786590e00f3d822174b77ee78fc0fc.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: MAN51-P1
age: 551
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 01 Feb 2023 07:43:06 GMT
server: cloudflare
etag: W/"9a54bab0960ed05188f63ea8171f1219"
vary: Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=1200
cf-ray: 7957e4067da92c26-FRA
x-amz-cf-id: DRK0EhPJ_uA3wdl45muPWBFG32RautpMtoZJaWPzIzJ-uqg1KelFeg==
expires: Tue, 07 Feb 2023 00:28:22 GMT

GET
H3 200 fontawesome-webfont.20fd1704ea223900efa9.woff2
www.travelstart.co.za/ Frame 8E37 75 KB
76 KB 240ms
239ms Font
binary/octet-stream 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelstart.co.za/fontawesome-webfont.20fd1704ea223900efa9.woff2?v=4.7.0
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/styles.a46f9b1c859ea77ef197.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://www.travelstart.co.za/styles.a46f9b1c859ea77ef197.css
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
x-amz-version-id: null
via: 1.1 93786590e00f3d822174b77ee78fc0fc.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-cf-pop: MAN51-P1
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77160
last-modified: Wed, 01 Feb 2023 07:43:57 GMT
server: cloudflare
etag: "af7ae505a9eed503f8b8e6982036873e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 7957e4067dad2c26-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,TS-country,TS-language,TS-source
x-amz-cf-id: NRW97ylyHywodR62tejQw6gqyXkZjxtJGls-GJ2wAp4XdkxAGozgAg==
expires: Tue, 07 Feb 2023 00:28:22 GMT

GET
H3 200 ads.js Show response
www.google.com/adsense/search/ Frame BEC2 140 KB
51 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/adsense/search/ads.js?pac=0

Requested by

Host: www.google.com
URL: https://www.google.com/afs/ads?psid=5134551505&channel=AutoRsVariant&fexp=44766999%2C21404%2C17301140%2C17301144%2C17301146&client=pub-3205907082861840&r=m&hl=en&rpbu=http%3A%2F%2Fgoogle.com&rpqp=q&type=3&rs_tt=c&oe=UTF-8&ie=UTF-8&format=r5&nocache=691675728502441&num=0&output=afd_ads&domain_name=www.southafricacheapflights.com&v=3&bsl=10&pac=0&u_his=2&u_tz=0&dt=1675728502441&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1995&frm=0&cl=503972142&uio=-&cont=autors-container-0&jsid=csa&jsv=503972142&rurl=https%3A%2F%2Fwww.southafricacheapflights.com%2F&adbw=master-1%3A752

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f6bc46e2a599c6d4e0950823024b3ced07ae54f83dc8138782f31a022d703a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
etag: "17298816947113699295"
vary: Accept-Encoding
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
accept-ranges: bytes
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H3 200 4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js Show response
pagead2.googlesyndication.com/bg/ Frame 2CF6 36 KB
14 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1b4fa762c0f3ec4067aeb7c830a07a3422749a1358742d77a94e8237fc86ed3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Sun, 05 Feb 2023 20:03:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 101113
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14278
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 05 Feb 2024 20:03:09 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9DD0 8 KB
895 B 52ms
51ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 00:06:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/ Frame 9DD0 2 KB
765 B 45ms
44ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 01:03:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83091
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 01:03:31 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/ Frame 9DD0 22 KB
9 KB 51ms
42ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1caae31a6a05aa0be067b968fb12c9421ee72184a2a2db915a54d3330f7be923

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 00:56:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83499
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9012
x-xss-protection: 0
server: cafe
etag: 10578598109654303351
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 00:56:43 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/ Frame 9DD0 3 KB
1 KB 52ms
43ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 18:49:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 18:49:36 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/ Frame 9DD0 18 KB
7 KB 49ms
43ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230202/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2bf373aab01a96fddf0099658b27e2eefb64c4aac7061d97d629fd7ca9a42534

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 00:56:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83498
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7647
x-xss-protection: 0
server: cafe
etag: 2161395064574532456
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 20 Feb 2023 00:56:44 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9DD0 157 KB
48 KB 84ms
79ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c90fa7f2b86e88bc876a28a908c00565250cfbdce151c8f3e5800bf98fa394c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49146
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1675254965429469"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 07 Feb 2023 00:08:22 GMT

GET
H3 200 8aec859a266e19fb42fee7f82edeac28.js Show response
www.gstatic.com/mysidia/ Frame 9DD0 33 KB
14 KB 49ms
43ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8aec859a266e19fb42fee7f82edeac28.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07970172ef078d9a58aa9ed9e9b54dd1cfbfec021be21b0d0fc7484c5fd5a58a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Sun, 05 Feb 2023 15:32:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117366
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14079
x-xss-protection: 0
last-modified: Wed, 01 Feb 2023 06:12:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 06 May 2023 15:32:16 GMT

GET
H2

200

/
www.google.de/pagead/1p-conversion/724060168/ Frame 8E37
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/724060168/?random=1543554560&cv=11&fst=1675728502371&bg=ffffff&guid=ON&async=1&gtm=45He3210&u_w=1600&u_h=1200&label=nchwCKDt_qUBEIiQ...
https://www.google.com/pagead/1p-conversion/724060168/?random=1543554560&cv=11&fst=1675728502371&bg=ffffff&guid=ON&async=1&gtm=45He3210&u_w=1600&u_h=1200&label=nchwCKDt_qUBEIiQodkC&hn=www.googleads...
https://www.google.de/pagead/1p-conversion/724060168/?random=1543554560&cv=11&fst=1675728502371&bg=ffffff&guid=ON&async=1&gtm=45He3210&u_w=1600&u_h=1200&label=nchwCKDt_qUBEIiQodkC&hn=www.googleadse...

42 B
455 B

256ms
55ms

Image
image/gif

2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/724060168/?random=1543554560&cv=11&fst=1675728502371&bg=ffffff&guid=ON&async=1&gtm=45He3210&u_w=1600&u_h=1200&label=nchwCKDt_qUBEIiQodkC&hn=www.googleadservices.com&frm=2&url=https%3A%2F%2Fwww.travelstart.co.za%2Fsearch-on-index%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%2F%2Fwww.southafricacheapflights.com%2F&ref=https%3A%2F%2Fwww.southafricacheapflights.com%2F&tiba=Search%20and%20Book%20Cheap%20Flights%20%7C%20Travelstart&value=0&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=dpbhY43TH4ucxgKqy4WQBg&cid=CAQSKQDUE5ympeCk4hFaSEKnzatTzLRS4pqm95RDmdr0lzOGM7gZjSlZJkVo&eitems=ChEIgOeCnwYQwOSKueKEpcbiARIdAG0XhA3fZf_-FJDGyUQCRFCbIYuX5Sc2r7Ypb2I&random=1286894370&ipr=y&prhg=0&ezwbk=AZuM4hDmg7TyUtXNXBlr025vDN002V_9vket7YqW-rLTwnJXlsav8Bu5CnAX0TJR1AK_2BwNt8jHrNkbHEuJbgJ6K1ou

Requested by

Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F

Protocol

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:23 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:23 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/724060168/?random=1543554560&cv=11&fst=1675728502371&bg=ffffff&guid=ON&async=1&gtm=45He3210&u_w=1600&u_h=1200&label=nchwCKDt_qUBEIiQodkC&hn=www.googleadservices.com&frm=2&url=https%3A%2F%2Fwww.travelstart.co.za%2Fsearch-on-index%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%2F%2Fwww.southafricacheapflights.com%2F&ref=https%3A%2F%2Fwww.southafricacheapflights.com%2F&tiba=Search%20and%20Book%20Cheap%20Flights%20%7C%20Travelstart&value=0&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=dpbhY43TH4ucxgKqy4WQBg&cid=CAQSKQDUE5ympeCk4hFaSEKnzatTzLRS4pqm95RDmdr0lzOGM7gZjSlZJkVo&eitems=ChEIgOeCnwYQwOSKueKEpcbiARIdAG0XhA3fZf_-FJDGyUQCRFCbIYuX5Sc2r7Ypb2I&random=1286894370&ipr=y&prhg=0&ezwbk=AZuM4hDmg7TyUtXNXBlr025vDN002V_9vket7YqW-rLTwnJXlsav8Bu5CnAX0TJR1AK_2BwNt8jHrNkbHEuJbgJ6K1ou
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4C62 0
0 87ms
86ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CmgeldZbhY8asFvyT78EPsOq0uArY3NKvbqLCuoWiEcCNtwEQASC7rsURYJXCpoKwB6ABzrjenQLIAQGpAl_PeXjhJbQ-qAMByAPDBKoEjwJP0AddTQyxNFMccct3izLGsBb_yhqiJT3-DC3JyLddodbowKV69XPKjyxJMOvFsIINGgxgErEM7YdoP4ck1Da3q3keZO_8zlZs2bxuJRJB2Goe-0mLZwd8B4CmC7XkYRt0r4gFzuC8yHLaT130I1CFmyTN6v_8AubezqWrn9diJ-ho8yTKZMgUbXWXqqnHutzjsagnu6i5_5jjCVepPfY3-XgBmhpbrdqO7A2c250fEucDoO58eiQEIPixH42cYuZM9d3rqQS2i4DHqvp-ijGzOQ8IiC6RB5lArAlIMMdbkXq9gKjzY0aJv5xyg0yPMFlvBkfpQKuDKhMazOTyBOyQfKY3iBK0_Znj5dIdsBGcwASHpNKelwSSBQQIBBgBkgUECAUYBKAGZoAHmseh4gGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBD-1QPSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAdgTDdAVAYAXAbIXHAoaCAASFHB1Yi0zMjA1OTA3MDgyODYxODQwGAA&sigh=UqzPPuKRyk0&uach_m=[UACH]&cid=CAQSGwDUE5ymZ4sLItCa72HONQ3DRIny18mkMGUiohgB

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 07 Feb 2023 00:08:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C216 143 B
166 B 46ms
41ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 324
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:02:58 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4C62 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a91393eb4cc1ccf9c54f913a8282c0a3de79fdabaa66edcc4f17415e7fd26e9f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame D62F 15 KB
6 KB 167ms
51ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=www.southafricacheapflights.com&origin=onetag

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

d0f07190791630edc058ad6e5a33a3cda6a8f85c470e593ce0bbed46ffec148b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.travelstart.co.za/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:22 GMT
server: Kestrel
server-processing-duration-in-ticks: 869698
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame 8E37 49 KB
20 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 06 Feb 2023 22:54:50 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 4413
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Tue, 07 Feb 2023 00:54:50 GMT

GET
H2 200 hotjar-2933028.js Show response
static.hotjar.com/c/ Frame 8E37 8 KB
4 KB 152ms
48ms Script
application/javascript 13.225.78.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2933028.js?sv=6

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.103 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-103.fra2.r.cloudfront.net

Software

Resource Hash

5b07e35be371eb04bde074bfeabb4822494db88cbb22a580dcbc4886bfbc7772

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Tue, 07 Feb 2023 00:07:32 GMT
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
age: 51
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/0e12ac5d7d43976f2e8f8368184ff719
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: qNvU6xZ76lOtq1l9lOJ89XdCooXBK4v6Ytv5Ren5dGZJy5s290AIQQ==

GET
H2

200

activityi;dc_pre=CMGDuZGPgv0CFRokBgAd628DOA;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_ba... Show response
5139389.fls.doubleclick.net/ Frame BCD0
Redirect Chain

https://5139389.fls.doubleclick.net/activityi;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_...
https://5139389.fls.doubleclick.net/activityi;dc_pre=CMGDuZGPgv0CFRokBgAd628DOA;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart...

683 B
479 B

57ms
55ms

Document
text/html

142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5139389.fls.doubleclick.net/activityi;dc_pre=CMGDuZGPgv0CFRokBgAd628DOA;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M5XBMKV&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

12dce92a8b28e26e0c667ea62a022051c168a89a0d375aa06c522b4462050fd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.travelstart.co.za/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 369
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:23 GMT
expires: Tue, 07 Feb 2023 00:08:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:23 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5139389.fls.doubleclick.net/activityi;dc_pre=CMGDuZGPgv0CFRokBgAd628DOA;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 bat.js Show response
bat.bing.com/ Frame 8E37 38 KB
12 KB 186ms
64ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

1d26490f083b209ef29e08d092649725edf15ac2b33ad62fdeaafd37f7d79d6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 07 Feb 2023 00:08:22 GMT
last-modified: Mon, 23 Jan 2023 19:59:24 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DC980EFC02064CEEB558A3FDE3990A85 Ref B: FRA31EDGE0515 Ref C: 2023-02-07T00:08:23Z
etag: "076bc30652fd91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 11552

GET
H2 200 ld.js Show response
static.criteo.net/js/ld/ Frame 8E37 43 KB
14 KB 186ms
53ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/ld.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

d1ff0de8bc0eef53396c02f1c428f62b25f05306692a9eed14a09e02a77af0ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 02 Jan 2023 16:36:54 GMT
server: nginx
etag: W/"63b30826-aae4"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 08 Feb 2023 00:08:23 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 8E37 106 KB
28 KB 44ms
43ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 07 Feb 2023 00:08:23 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27843
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: pS+bMkX+hAx+kS7zGsAqPw9k/zYaKVAjgZgGohyUUj2xlwc4icesIHS8Zo7ETFuP15uzo8wMQbCDwWgCOZPqdg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 webengage-min-v-6.0.js Show response
ssl.widgets.webengage.com/js/ Frame 8E37 202 KB
61 KB 161ms
47ms Script
application/javascript 2606:4700::6812:1c93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.widgets.webengage.com/js/webengage-min-v-6.0.js
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1c93 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d402540423e7ba6ade84a095ecb190d89749b53aca129eaaffb0837f4aff248d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:23 GMT
via: 1.1 edffe6978db53d114a80cda421e0b6b8.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: HIT
x-amz-cf-pop: FRA56-P5
age: 2033
x-cache: Hit from cloudfront
last-modified: Tue, 31 Jan 2023 07:27:41 GMT
server: cloudflare
etag: W/"63d8c2ed-329d8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 7957e40a9e529295-FRA
x-amz-cf-id: -Y_vMXEc5Bx2nYV-hNrhnWKdlHNXre25v_sw7FUDFRU6gEVXN5ZbkA==
expires: Tue, 07 Feb 2023 01:49:14 GMT

GET
H2 200 search.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame BEC2 391 B
912 B 147ms
40ms Image
image/svg+xml 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

920a378947204498c122722933b3a4b67788a2b6fade8bd0d47cf830eeee0563

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
date: Mon, 06 Feb 2023 10:03:35 GMT
x-content-type-options: nosniff
age: 50688
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 391
x-xss-protection: 0
last-modified: Thu, 19 Dec 2019 14:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
vary: Accept-Encoding
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-type: image/svg+xml
cache-control: public, max-age=82800
accept-ranges: bytes
expires: Tue, 07 Feb 2023 09:03:35 GMT

GET
H2 200 chevron.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame BEC2 200 B
293 B 147ms
41ms Image
image/svg+xml 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23212121

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f6c0c84f6bd0256c33321eb67ef5a891d53391656adfad27cbf3af787be7873

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 06 Feb 2023 01:24:05 GMT
age: 81858
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 174
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
vary: Accept-Encoding
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-type: image/svg+xml
cache-control: public, max-age=82800
accept-ranges: bytes
expires: Tue, 07 Feb 2023 00:24:05 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AD63 143 B
166 B 41ms
39ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 325
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:02:58 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dc_pre=CMGDuZGPgv0CFRokBgAd628DOA;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfa...
adservice.google.com/ddm/fls/z/ Frame BCD0 42 B
63 B 85ms
85ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CMGDuZGPgv0CFRokBgAd628DOA;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F

Requested by

Host: 5139389.fls.doubleclick.net
URL: https://5139389.fls.doubleclick.net/activityi;dc_pre=CMGDuZGPgv0CFRokBgAd628DOA;src=5139389;type=fligh0;cat=fligh001;ord=9761954015158;gtm=45He3210;u15=undefined;~oref=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5139389.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 8E37 301 KB
85 KB 100ms
40ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=b4ea834646d7d81eede2fd02ea4e6e35

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7e80462746e8299f8c6051dd8d2c26c57de815ad9560c75ca94e229c74e909f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.travelstart.co.za/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 07 Feb 2023 00:08:23 GMT
content-md5: vtqHUuYm/OSPvxquvwa07A==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 86989
x-fb-rlafr: 0
x-fb-debug: Bv30dHQm3fli7uHSCmjLQzQTJ6cBaamByjLPAdVZf/dhfihiYm+pAF9Tp0p0YouxQy3sx59C/mFKOuudUejQCw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: f270ffef266e66a99597ff58b0427188
cross-origin-opener-policy: same-origin-allow-popups
etag: "0fa75876275df5c0cd19f5a1873769e3"
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Tue, 06 Feb 2024 22:16:59 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame D62F
Redirect Chain

https://gum.criteo.com/sid/json?origin=onetag&domain=www.travelstart.co.za&sn=ChromeSyncframe&so=0&topUrl=www.southafricacheapflights.com&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=gCj0EnxBeUVaZHdRZXkxSGV5dm5JWjVtd3VXdjNaN21qTlZXNUtnYlRWMlYvMnM0NTlaWHljbUtaaVpPVDZyNHUyZ1h0bzdyREs5THZ3NHcydExOZVBPMmd5eDFKd2pEdVg5VmJGYVJYNW85ODRsd3g0OHkzRml5YXF5WW...

451 B
668 B

151ms
45ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=gCj0EnxBeUVaZHdRZXkxSGV5dm5JWjVtd3VXdjNaN21qTlZXNUtnYlRWMlYvMnM0NTlaWHljbUtaaVpPVDZyNHUyZ1h0bzdyREs5THZ3NHcydExOZVBPMmd5eDFKd2pEdVg5VmJGYVJYNW85ODRsd3g0OHkzRml5YXF5WWZsa0dTL251VVY3MnFkL1JtYzl2aGJNUjhZeC9Zc0RiU0Q1M3AvR1dqWU9ZdDdFZXcwcTM1Zm1LTHlFQUhVa09QeDdCWlRhK3ZDZ3VrQ1daOUNnVFZzSEVoUGdyOUppREpDdkpWNUY5Z2xxcnhDVXRBaEdPYy9mMjZpOTRBeFFNbEsvVUsxZzliSmQ3UlI5aTN4VXZuZ0pBcncwQlgrc0ZmYjB3emp2VEYxcnhxRFRMaWlzTjZFaThreFVmaEpMWTZUMWJLTUhqaHw&cppv=2

Requested by

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a50f7abc893d7adcaa59ddd25bd12c2ae63755077d5abd126c123d56a001b445

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:22 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2648646
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:23 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=gCj0EnxBeUVaZHdRZXkxSGV5dm5JWjVtd3VXdjNaN21qTlZXNUtnYlRWMlYvMnM0NTlaWHljbUtaaVpPVDZyNHUyZ1h0bzdyREs5THZ3NHcydExOZVBPMmd5eDFKd2pEdVg5VmJGYVJYNW85ODRsd3g0OHkzRml5YXF5WWZsa0dTL251VVY3MnFkL1JtYzl2aGJNUjhZeC9Zc0RiU0Q1M3AvR1dqWU9ZdDdFZXcwcTM1Zm1LTHlFQUhVa09QeDdCWlRhK3ZDZ3VrQ1daOUNnVFZzSEVoUGdyOUppREpDdkpWNUY5Z2xxcnhDVXRBaEdPYy9mMjZpOTRBeFFNbEsvVUsxZzliSmQ3UlI5aTN4VXZuZ0pBcncwQlgrc0ZmYjB3emp2VEYxcnhxRFRMaWlzTjZFaThreFVmaEpMWTZUMWJLTUhqaHw&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 687502
content-length: 0
expires: 0

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/ Frame 8E37 115 KB
39 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/cb=gapi.loaded_0?le=scs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7722cf2a37addcff21e4f02d982f6d5e31c5a52424e289f33df6cae569b5ed4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 15:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 376250
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39730
x-xss-protection: 0
last-modified: Sat, 07 Jan 2023 15:19:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 02 Feb 2024 15:37:33 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C216
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

69ms
68ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:23 GMT
expires: Tue, 07 Feb 2023 00:08:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:23 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js Show response
pagead2.googlesyndication.com/bg/ Frame 7167 36 KB
14 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1b4fa762c0f3ec4067aeb7c830a07a3422749a1358742d77a94e8237fc86ed3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Sun, 05 Feb 2023 20:03:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 101114
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14278
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 05 Feb 2024 20:03:09 GMT

GET
H2 200 modules.bca0d1c28285412bb689.js Show response
script.hotjar.com/ Frame 8E37 260 KB
67 KB 131ms
45ms Script
application/javascript 13.224.189.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.bca0d1c28285412bb689.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.51 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-51.fra2.r.cloudfront.net

Software

Resource Hash

8a2eec716594a088e751fb0238d964df99bbab6d347cd0ad8f61316ae4caa0b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 13:10:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 dde0b4b1e223fa23670e93078a04c116.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 298697
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 67924
last-modified: Fri, 03 Feb 2023 13:09:45 GMT
etag: "e923aa360dc485b9df86355bd040c998"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: 6uuu_V6T28HNji16ebXKVluTE05MjZtOyJDbz5Xs1bGHcOf4_yb8kQ==

GET
H3 200 434606158173450 Show response
connect.facebook.net/signals/config/ Frame 8E37 377 KB
108 KB 117ms
117ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/434606158173450?v=2.9.95&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3fc59fd4cd1efc73555e0e4dcdd73bf4c3ea89fd0817635e57542078c0cd4539

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 07 Feb 2023 00:08:23 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: FVxHcwLsbYuG+eZ3rKgQ/ck8XNiHActBA/3DOkCOGQ6WIow8nDJMU/R0FvD24drVXKGPKjWNUs2yUVowwS/UnQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 5560926.js Show response
bat.bing.com/p/action/ Frame 8E37 0
119 B 138ms
137ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5560926.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Tue, 07 Feb 2023 00:08:23 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3A6AD728D69342AFACD9BED810E4F754 Ref B: FRA31EDGE0515 Ref C: 2023-02-07T00:08:23Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ Frame 8E37 0
286 B 66ms
64ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5560926&tm=gtm002&Ver=2&mid=079eb70d-fd29-486c-987e-c0ad3ba07cb5&sid=899088d0a67b11edbccdc198504a3118&vid=8990d330a67b11ed8ab60f84684dbb7f&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Search%20and%20Book%20Cheap%20Flights%20%7C%20Travelstart.co.za&kw=cheap%20flights,%20accommodation,%20flights,%20hotel,%20car,%20car%20hire,%20ailrine,%20popular%20airlines,%20alerts,%20affiliate,%20holiday,%20destinations,%20travel%20insurance,%20popular%20routes,%20flight%20routes,%20travel%20deals,%20flight%20deals,%20travel%20updates&p=https%3A%2F%2Fwww.southafricacheapflights.com%2F&r=&lt=1270&evt=pageLoad&ifm=1&sv=1&rn=329230

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 07 Feb 2023 00:08:23 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: ACC63203EBFD4794AB181C43D2D0B080 Ref B: FRA31EDGE0515 Ref C: 2023-02-07T00:08:23Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AD63
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

69ms
68ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:23 GMT
expires: Tue, 07 Feb 2023 00:08:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:23 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js Show response
pagead2.googlesyndication.com/bg/ Frame 63E0 36 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1b4fa762c0f3ec4067aeb7c830a07a3422749a1358742d77a94e8237fc86ed3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Sun, 05 Feb 2023 20:03:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 101114
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14278
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 05 Feb 2024 20:03:09 GMT

GET
H2 200 storage-frame-1.18.htm Show response
14507cd62.webengage.co/ Frame 9199 3 KB
2 KB 177ms
40ms Document
text/html 2600:9000:20eb:6800:8:cf94:88c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://14507cd62.webengage.co/storage-frame-1.18.htm?cdn=y&cbf=webengage-engagement-callback-frame&lc=14507cd62
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:6800:8:cf94:88c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 16c8ad014e255e48470f6856e3ac20f6050865f72e971417501057d4aeaddd98

Request headers

Referer: https://www.travelstart.co.za/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
age: 2195
cache-control: max-age=14400
content-encoding: gzip
content-type: text/html
date: Mon, 06 Feb 2023 23:31:48 GMT
etag: W/"60b76f62-d60"
expires: Tue, 07 Feb 2023 03:31:48 GMT
last-modified: Wed, 02 Jun 2021 11:45:38 GMT
server: nginx
vary: Accept-Encoding
via: 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
x-amz-cf-id: LQAiN5xMpk49ckVwvef92_wl6DZ6MaffAUoYHyvpLFhyIlMJA4FlhA==
x-amz-cf-pop: FRA2-C1
x-cache: Hit from cloudfront

GET
H2 200 iframe Show response
accounts.google.com/o/oauth2/ Frame 8321 280 B
1 KB 188ms
92ms Document
text/html 2a00:1450:4001:82a::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.IpWeeLsup8c.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-7vGeOZpyfcbeljIbxyJzXpK39XA/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b7bff8758ad308286ecd97baea62143dd78896d938f2869bcf570002e848f5ad

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport script-src 'report-sample' 'nonce-5wmWRVnsC2PsCwe5Pyo0Qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.travelstart.co.za/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport script-src 'report-sample' 'nonce-5wmWRVnsC2PsCwe5Pyo0Qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin; report-to="IdpIFrameHttp"
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:23 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"IdpIFrameHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdpIFrameHttp/external"}]}
server: ESF
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 box-e031119f9e9e307a08fa610f85dbfb52.html Show response
vars.hotjar.com/ Frame 8659 2 KB
1 KB 125ms
40ms Document
text/html 13.224.189.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vars.hotjar.com/box-e031119f9e9e307a08fa610f85dbfb52.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.67 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-67.fra2.r.cloudfront.net

Software

Resource Hash

f92333a45b532bdb5248178674b041b1c35edfd33a55df48192256f0bfe49e4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://www.travelstart.co.za/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 298697
cache-control: max-age=31536000
content-encoding: br
content-length: 1034
content-type: text/html
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 03 Feb 2023 13:10:06 GMT
etag: "112fdf47cdb80b9ce3d033ed09717460"
last-modified: Fri, 03 Feb 2023 13:09:45 GMT
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
x-amz-cf-id: wcxwAbv0zanD8G2PDRFNvBaajfH2SMdm4qobTGhOQh3D79Zgk4_gag==
x-amz-cf-pop: FRA2-C1
x-cache: Hit from cloudfront
x-robots-tag: none

GET
H2 200 /
www.facebook.com/tr/ Frame 8E37 0
185 B 126ms
41ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=242594945943762&ev=fb_page_view&dl=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F&rl=https%3A%2F%2Fwww.southafricacheapflights.com%2F&if=true&ts=1675728503851&sw=1600&sh=1200&at=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 07 Feb 2023 00:08:23 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3AB7 42 B
174 B 78ms
78ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssppcrHTY3v_YVpxZ2dZWk8Hzp_HZLjMxZ9W4texb8So3_LYycDAJZtKAxPjeSLIH-Y7s4_71YDaxNPXFpJjYOEZpUfAt6A2Qw8jVwMxvzCDZSHkRd7rUgjO0iLrG9taTgJUqjjtQ&sai=AMfl-YQzvQ1vIHs4lvFid-2IEMbyV9xj64MeF9kf65Pq5Zg17VXGgRR5jamR86pBw-B-SQVQAyLwucCuMuiY&sig=Cg0ArKJSzDx2X97F7HPqEAE&cid=CAQSGwDUE5ymHIAGnQVjTdXIz9yBXTxXYceQ-Lx8OxgB&id=lidar2&mcvt=1086&p=0,0,280,762&mtos=1086,1086,1086,1086,1086&tos=1086,0,0,0,0&v=20230201&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=3349968481&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1675728501499&rpt=1346&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 event Show response
sslwidget.criteo.com/ Frame 8E37 8 KB
4 KB 309ms
164ms Script
application/x-javascript 178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://sslwidget.criteo.com/event?a=11171&v=5.13.0&p0=e%3Dce%26m%3D%255B%255D&p1=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Fwww.southafricacheapflights.com&p2=e%3Dvh&p3=e%3Ddis&bundle=Eysi7F8zNFNVTHM3QUtsbVhRMmh1ZTJ3SmxVZklLdXA2JTJCWDhla3VrN3JoV3J4bDZ4bHpjVEUwaTF4cHhPRDJFb21SZG1OZyUyQk1SNWJYTnlTMWN0ckFYcEV5UWF0bWNLaDVnaHFLRGNEbnVyJTJGYmlhN3FJNUMzWWpiejhkTjMybkNzVDA5NFVtUGtjaFV0JTJCTE13elk4dHJMcFJVQ1ZIJTJCSVVIcE9vaDU4blVRY01jRmpNJTNE&tld=www.travelstart.co.za&dy=1&fu=https%253A%252F%252Fwww.southafricacheapflights.com&pu=https%253A%252F%252Fwww.southafricacheapflights.com&dtycbr=47427

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

87f7cef0da90d0b53fedf2e27eb16bbdf62e0fac24edb637f8769f31cc2f892e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Kestrel
content-type: application/x-javascript
access-control-allow-origin: *
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 14984474
timing-allow-origin: *
expires: 0

GET
H2 200 /
www.facebook.com/tr/ Frame 8E37 0
54 B 40ms
40ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=434606158173450&ev=PageView&dl=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F&rl=https%3A%2F%2Fwww.southafricacheapflights.com%2F&if=true&ts=1675728504033&sw=1600&sh=1200&v=2.9.95&r=stable&ec=0&o=30&cs_est=true&it=1675728503728&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 07 Feb 2023 00:08:24 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 400 cspreport
accounts.google.com/_/IdpIFrameHttp/ Frame 8321 2 KB
910 B 57ms
55ms Other
text/html 2a00:1450:4001:82a::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/_/IdpIFrameHttp/cspreport

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

db4ac88c77d30ab0b76928ed95745c32f317aed18165cd10c4d3d5a0ba0c2833

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 m=base Show response
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.de.2bNLG_CYMlY.es5.O/d=1/rs=AOaEmlHoEX1rtvoTEo2jeI_sUHF0Jv0r-A/ Frame 8321 100 KB
34 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.de.2bNLG_CYMlY.es5.O/d=1/rs=AOaEmlHoEX1rtvoTEo2jeI_sUHF0Jv0r-A/m=base

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b075dc2bf38f54ee71c7a49664ac11eb2652436f855d285e5485675e0ff1f327

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 23:12:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3350
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35052
x-xss-protection: 0
last-modified: Sat, 28 Jan 2023 03:39:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/identity-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/identity-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Feb 2024 23:12:34 GMT

GET
H2 200 v4.js Show response
wsdk-files.webengage.com/webengage/14507cd62/ Frame 9199 5 KB
2 KB 466ms
457ms Script
application/x-javascript 2606:4700::6812:1c93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://wsdk-files.webengage.com/webengage/14507cd62/v4.js
Requested by: Host: 14507cd62.webengage.co
URL: https://14507cd62.webengage.co/storage-frame-1.18.htm?cdn=y&cbf=webengage-engagement-callback-frame&lc=14507cd62
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1c93 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3aec906fabbe09d9b7710a2e35a231a1070e6add00aecd4ad7c6509e3d2d263

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://14507cd62.webengage.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
content-encoding: gzip
via: 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront)
x-amz-version-id: CzdhmynfJIt_rJS2Tfpr9VGJ59ujqYd9
cf-cache-status: REVALIDATED
x-amz-cf-pop: FRA56-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 1784
last-modified: Thu, 02 Feb 2023 13:04:36 GMT
server: cloudflare
etag: "a7f8211dd670a132087c58e3f3a4f76d"
vary: Accept-Encoding
content-type: application/x-javascript; charset=UTF-8
cache-control: public, max-age=60, must-revalidate
accept-ranges: bytes
cf-ray: 7957e40e680b9295-FRA
x-amz-cf-id: Yy3p18C-1UYgQZcpTqEP0s7qlnD4IJc5nHCZB_YMJrFxRy8EFsAsaw==

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/2933028/ Frame 8E37 148 B
323 B 289ms
168ms XHR
application/json 54.229.40.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/2933028/visit-data?sv=6
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.40.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-40-207.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 07664fd6a9195b3edd30b67c88838d1322752e5ae983c4bca5ae5fad4b6b4f34

Request headers

Referer: https://www.travelstart.co.za/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
content-encoding: br
vary: Accept-Encoding
access-control-max-age: 86400
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H2 204 2933028 Show response
vc.hotjar.io/sessions/ Frame 8E37 0
257 B 252ms
149ms XHR
text/plain 13.225.78.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/2933028?s=0.25&r=0.24166094194907872
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-105.fra2.r.cloudfront.net
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
via: 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront)
server: Python/3.7 aiohttp/3.5.4
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-id: 4j-BuZORkeoW-gl6bI5zs71FK-x7L50n-51qBZQk1xABgnvFcCqm8g==

GET
H3 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame 8321 49 B
94 B 163ms
163ms XHR
application/json 2a00:1450:4001:82a::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fwww.travelstart.co.za&client_id=119943617884-q8pjfsgga9i4qndfk388b2kbcdhtgq9j.apps.googleusercontent.com

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.IdpIFrameHttp.de.2bNLG_CYMlY.es5.O/d=1/rs=AOaEmlHoEX1rtvoTEo2jeI_sUHF0Jv0r-A/m=base

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4836b6031bc4af96767f0121fa458714583340054aea6338ef99a1bc4011f43b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport, script-src 'report-sample' 'nonce-LLiXaMJXpuBzsNqyEpbbkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
X-Requested-With: XmlHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /_/IdpIFrameHttp/cspreport, script-src 'report-sample' 'nonce-LLiXaMJXpuBzsNqyEpbbkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdpIFrameHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdpIFrameHttp/cspreport/allowlist
x-content-type-options: nosniff
date: Mon, 06 Feb 2023 23:54:21 GMT
content-encoding: gzip
age: 843
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Origin
content-type: application/json; charset=utf-8
cache-control: public, max-age=3600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Tue, 07 Feb 2023 00:54:21 GMT

GET
H2 200 nr-spa-1215.min.js Show response
js-agent.newrelic.com/ Frame 8E37 47 KB
18 KB 127ms
39ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-spa-1215.min.js
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dd2d8d288526b88b0eae53168e31b4092acf39ed38d40ffcbc6d0ab2f7a4aa66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-amz-version-id: zcmP9QP8YWQtiPZETZozJGQXbXQvWuWT
content-encoding: gzip
via: 1.1 varnish
date: Tue, 07 Feb 2023 00:08:24 GMT
x-amz-request-id: 6RZ941SMZWWN6R43
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 17465
x-amz-id-2: jef2Y9v0nNSM/wupXW9S0sCLQebZib56961dIq5TnVgjGeUYRB8WJPS3PT5c7ThUu+MjipzUGYof8GBY++SRoQ==
x-served-by: cache-hhn-etou8220069-HHN
last-modified: Mon, 24 Jan 2022 22:13:54 GMT
server: AmazonS3
x-timer: S1675728504.415211,VS0,VE0
etag: "7e1862f7a390ed9fc02c299216395547"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 758

GET
H2 200 twk-main.js Show response
embed.tawk.to/_s/v4/app/63b77dcd282/js/ Frame 8E37 121 B
293 B 47ms
45ms Script
application/javascript 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/63b77dcd282/js/twk-main.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

705186becc9e0a306a6b4867ae2768aa9dd3b8c12393d9f9c52029e9a6fcf31c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.travelstart.co.za/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 2385607
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 06 Jan 2023 01:49:34 GMT
server: cloudflare
etag: W/"da5bb1dc647470204df0e49f5afac2de"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 7957e4100d0e9c10-FRA

GET
H2 200 twk-vendor.js Show response
embed.tawk.to/_s/v4/app/63b77dcd282/js/ Frame 8E37 76 KB
27 KB 50ms
48ms Script
application/javascript 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/63b77dcd282/js/twk-vendor.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5958b8f2069b0a3292ed7a9db46b8109adac7e81591238557125893ee7e87bb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.travelstart.co.za/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 2385607
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 06 Jan 2023 01:49:34 GMT
server: cloudflare
etag: W/"7dcb496e4882926f93f2e73fa87062c0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 7957e4100d109c10-FRA

GET
H2 200 twk-chunk-vendors.js Show response
embed.tawk.to/_s/v4/app/63b77dcd282/js/ Frame 8E37 206 KB
61 KB 88ms
87ms Script
application/javascript 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/63b77dcd282/js/twk-chunk-vendors.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

299a4f2bad31c68a87c725376227e4e71d3fa3be5ac21776509b6a526bfd603b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.travelstart.co.za/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 2385607
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 06 Jan 2023 01:49:34 GMT
server: cloudflare
etag: W/"70dac54eca3bb2143032bc4db3237623"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 7957e4100d119c10-FRA

GET
H2 200 twk-chunk-common.js Show response
embed.tawk.to/_s/v4/app/63b77dcd282/js/ Frame 8E37 192 KB
40 KB 59ms
58ms Script
application/javascript 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/63b77dcd282/js/twk-chunk-common.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e76be61057b7d805440ba2693d2c357f9a828fa8bda74170b9ac70b58af626d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.travelstart.co.za/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 2385607
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 06 Jan 2023 01:49:34 GMT
server: cloudflare
etag: W/"385105148a50079bafff97e9c9476109"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 7957e4101d129c10-FRA

GET
H2 200 twk-runtime.js Show response
embed.tawk.to/_s/v4/app/63b77dcd282/js/ Frame 8E37 2 KB
1 KB 47ms
46ms Script
application/javascript 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/63b77dcd282/js/twk-runtime.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da3edd648fc579bc07c4b1b1bb3ba1e8258ae308049a311e5966464295eb0e51

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.travelstart.co.za/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 2385607
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 06 Jan 2023 01:49:34 GMT
server: cloudflare
etag: W/"de21d01e9f8b6cc35ea67267d0ba80ec"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 7957e4101d139c10-FRA

GET
H2 200 twk-app.js Show response
embed.tawk.to/_s/v4/app/63b77dcd282/js/ Frame 8E37 151 B
207 B 87ms
86ms Script
application/javascript 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/63b77dcd282/js/twk-app.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13cf82e6f9d48221cd55f8b3c3d206f7bdb83f291034b478e484ccfef7d500dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.travelstart.co.za/
Origin: https://www.travelstart.co.za
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 2385607
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 06 Jan 2023 01:49:34 GMT
server: cloudflare
etag: W/"e736e189edb5d0d9d5b8e7f23dd9114a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 7957e4101d149c10-FRA

POST
H3 204 rum Show response
www.travelstart.co.za/cdn-cgi/ Frame 8E37 0
145 B 46ms
40ms XHR
text/plain 2606:4700::6813:b007
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.travelstart.co.za/cdn-cgi/rum?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:b007 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.travelstart.co.za/?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https:%2F%2Fwww.southafricacheapflights.com%2F
tracestate: 153095@nr=0-1-153095-1507133974-2c1545654200f08b----1675728504340
traceparent: 00-4215874688d1b824ccc59fa0dc09a880-2c1545654200f08b-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjE1MzA5NSIsImFwIjoiMTUwNzEzMzk3NCIsImlkIjoiMmMxNTQ1NjU0MjAwZjA4YiIsInRyIjoiNDIxNTg3NDY4OGQxYjgyNGNjYzU5ZmEwZGMwOWE4ODAiLCJ0aSI6MTY3NTcyODUwNDM0MH19
content-type: application/json

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.travelstart.co.za
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 7957e4103bbf2c26-FRA

GET
H2

200

sync
x.bidswitch.net/ul_cb/ Frame 0295
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=46&user_id=k-uVZB9q4K_LR51UdJ8yRcihDzt5Q3hgSE-3W6Uw&expires=30
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-uVZB9q4K_LR51UdJ8yRcihDzt5Q3hgSE-3W6Uw&expires=30

43 B
345 B

42ms
41ms

Image
image/gif

3.76.151.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-uVZB9q4K_LR51UdJ8yRcihDzt5Q3hgSE-3W6Uw&expires=30
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Server: 3.76.151.8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-76-151-8.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-uVZB9q4K_LR51UdJ8yRcihDzt5Q3hgSE-3W6Uw&expires=30
date: Tue, 07 Feb 2023 00:08:24 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 0295
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-k98Ocq4K_LR51UdJ8yRcihDzt5RzLiJdx0DsyQ&google_cm&google_hm=ay1rOThPY3E0S19MUjUxVWRKOHlSY2loRHp0NVJ6TGlKZ...
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-k98Ocq4K_LR51UdJ8yRcihDzt5RzLiJdx0DsyQ&google_gid=CAESENfdU0aEOCNiCrvpWCpehVY&google_cver=1&google_ula=913071,0

43 B
370 B

115ms
49ms

Image
image/gif

178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-k98Ocq4K_LR51UdJ8yRcihDzt5RzLiJdx0DsyQ&google_gid=CAESENfdU0aEOCNiCrvpWCpehVY&google_cver=1&google_ula=913071,0

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Server

178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:23 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1019079
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-k98Ocq4K_LR51UdJ8yRcihDzt5RzLiJdx0DsyQ&google_gid=CAESENfdU0aEOCNiCrvpWCpehVY&google_cver=1&google_ula=913071,0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 398
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 0295
Redirect Chain

https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=8575157591724207535

43 B
370 B

95ms
51ms

Image
image/gif

178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=8575157591724207535

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Server

178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1792343
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Tue, 07 Feb 2023 00:08:24 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e4c6d845-a385-48d9-a191-da1cc8e40085
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=8575157591724207535
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cksync.php
contextual.media.net/ Frame 0295 237 B
978 B 268ms
144ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-Ms-Jw64K_LR51UdJ8yRcihDzt5S-E9YULce78Q

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

11cb2c0e70f91c6a0326cf4a4f9fa1b177c14efba6b56bf7535624b9c7bce990

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 07 Feb 2023 00:08:24 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 237
x-mnet-hl2: E
expires: Tue, 07 Feb 2023 00:08:24 GMT

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame 0295 0
145 B 571ms
120ms Image
text/plain 64.202.112.63
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-d6fpUq4K_LR51UdJ8yRcihDzt5QBWtZ8n2vzeA
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.63 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Tue, 07 Feb 2023 00:08:24 GMT
Cache-Control: no-cache
X-TraceId: fd21112b3ba499f17f56885b81132eb3
Content-Length: 0

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame 0295 0
239 B 252ms
42ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-6AcQ4K4K_LR51UdJ8yRcihDzt5Q6TCHpsE4nRg&expires=30
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: f5982f4f9cc79eb2b489dda8b92e3144
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 204 v1
match.sharethrough.com/sync/ Frame 0295 0
35 B 143ms
41ms Image
text/plain 18.158.43.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-fhrps64K_LR51UdJ8yRcihDzt5S2_qyBhOsdsg
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.158.43.18 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-43-18.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 0295 43 B
163 B 382ms
50ms Image
image/gif 185.86.138.142
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-VGoBxq4K_LR51UdJ8yRcihDzt5R3jWkHON2LrQ
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.142 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H2 200 /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 0295 0
99 B 156ms
44ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-AJBZda4K_LR51UdJ8yRcihDzt5SGazEH1VR-QQ
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 41550

GET
H2 200 um
criteo-sync.teads.tv/ Frame 0295 23 B
172 B 297ms
66ms Image
image/gif 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-sync.teads.tv/um?eid=80&uid=k-TY2zya4K_LR51UdJ8yRcihDzt5RCGoyJQy0w-w
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

expires: Tue, 07 Feb 2023 00:08:24 GMT
pragma: no-cache
date: Tue, 07 Feb 2023 00:08:24 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

GET
H2 200 xuid
eb2.3lift.com/ Frame 0295 37 B
140 B 229ms
40ms Image
image/gif 76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2711&xuid=k-hrqHv64K_LR51UdJ8yRcihDzt5SpEo1HEQeZFQ&dongle=013b
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H2

204

sync
ups.analytics.yahoo.com/ups/58301/ Frame 0295
Redirect Chain

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-aWPmmq4K_LR51UdJ8yRcihDzt5TYUbrubYWWjw
https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-aWPmmq4K_LR51UdJ8yRcihDzt5TYUbrubYWWjw&verify=true

0
121 B

50ms
49ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-aWPmmq4K_LR51UdJ8yRcihDzt5TYUbrubYWWjw&verify=true

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-aWPmmq4K_LR51UdJ8yRcihDzt5TYUbrubYWWjw&verify=true
date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 pixel
cm.adform.net/ Frame 0295 43 B
163 B 172ms
39ms Image
image/gif 37.157.4.24
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/pixel?adform_pid=15&adform_pc=k-auruFq4K_LR51UdJ8yRcihDzt5Q9AxbF8Ia_8w
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.4.24 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
last-modified: Wed, 11 Oct 2017 13:39:07 GMT
server: nginx
accept-ranges: bytes
etag: "59de1efb-2b"
content-length: 43
content-type: image/gif

GET
H2 200 sync
visitor.omnitagjs.com/visitor/ Frame 0295 49 B
235 B 173ms
51ms Image
image/gif 185.255.84.153
IGUANE-

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://visitor.omnitagjs.com/visitor/sync?uid=732efe97317e6352de4c1caf24b5064b&name=CRITEO&visitor=k-J3u6_64K_LR51UdJ8yRcihDzt5TEaEyajl3-Uw

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.153 , France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:24 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
content-length: 49
expires: 0

GET
H2

200

rum
r.casalemedia.com/ Frame 0295
Redirect Chain

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-qGzoIK4K_LR51UdJ8yRcihDzt5TcuDJVnmb75w
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-qGzoIK4K_LR51UdJ8yRcihDzt5TcuDJVnmb75w&C=1

43 B
327 B

57ms
56ms

Image
image/gif

104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-qGzoIK4K_LR51UdJ8yRcihDzt5TcuDJVnmb75w&C=1
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lgCUhDDp3RVk%2BSN3HH7ebpJ5gM6k91R4mWLxSqTE1bnHYXYTBXj0bR47N75DlDO1pq5XfADinMQM26emOE0Fhy%2BeuRMPIT3GwohIniAI%2BNCaxV1ywhRYE%2FqyOnDJ6qzTsdFP"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 7957e412fc4b5c1a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0vgYiLwtsHg1cj1oZfLLR7RhSr7BQBbSdoNs4mxHFLs%2FxMgJ7ZDOJBXnGQ%2Bu0kLMyP0nJlbZ2hjLx26o16K9wuAbQDbz3m3i0A30Bs%2BlvdDQW%2FeBZmntSdCvoJ9QFnQYeM6O"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=20&external_user_id=k-qGzoIK4K_LR51UdJ8yRcihDzt5TcuDJVnmb75w&C=1
cache-control: no-cache
cf-ray: 7957e412ac145c1a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame 0295
Redirect Chain

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=CVCqIBE6brHM8gRMjYa98ZEI4NZ8Ylvo
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=CVCqIBE6brHM8gRMjYa98ZEI4NZ8Ylvo

42 B
942 B

57ms
57ms

Image
image/gif

34.251.149.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=CVCqIBE6brHM8gRMjYa98ZEI4NZ8Ylvo

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

HTTP/1.1

Server

34.251.149.144 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-251-149-144.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v045-07e4ed132.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 8aS5CHsdQ7I=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v045-0ba4161da.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: O8WALIdRRC4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=CVCqIBE6brHM8gRMjYa98ZEI4NZ8Ylvo
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200 9.gif
id5-sync.com/s/966/ Frame 0295 43 B
1 KB 147ms
42ms Image
image/gif 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/s/966/9.gif?puid=k-BgCHeq4K_LR51UdJ8yRcihDzt5SLwy4eM7wqGg

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Tue, 07 Feb 2023 00:08:23 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame 0295
Redirect Chain

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-k2-PJq4K_LR51UdJ8yRcihDzt5R4h6VwH5MlwQ
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-k2-PJq4K_LR51UdJ8yRcihDzt5R4h6VwH5MlwQ

43 B
448 B

56ms
56ms

Image
image/gif

52.16.200.203
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-k2-PJq4K_LR51UdJ8yRcihDzt5R4h6VwH5MlwQ
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Server: 52.16.200.203 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-200-203.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 07 Feb 2023 00:08:25 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-k2-PJq4K_LR51UdJ8yRcihDzt5R4h6VwH5MlwQ
date: Tue, 07 Feb 2023 00:08:25 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 200 sync
matching.ivitrack.com/ Frame 0295 42 B
274 B 145ms
48ms Image
image/gif 34.117.157.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://matching.ivitrack.com/sync?realm=criteo&uid=k-tKO0sq4K_LR51UdJ8yRcihDzt5TmNNqcxBI3Og
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.157.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 22.157.117.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:23 GMT
x-envoy-decorator-operation: tag-manager.programmatic.svc.cluster.local:3000/*
via: 1.1 google
server: istio-envoy
content-type: image/gif
cache-control: public, max-age=86400
x-envoy-upstream-service-time: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 push
exchange.mediavine.com/usersync/ Frame 0295 0
880 B 151ms
42ms Image
text/html 3.123.113.206
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-UwOaXq4K_LR51UdJ8yRcihDzt5T_ibMj3Bdirw
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.113.206 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-113-206.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
cache-control: private, no-cache
access-control-allow-credentials: true
content-encoding: gzip
vary: Origin, Accept-Encoding
content-type: text/html; charset=utf-8

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 0295 42 B
580 B 169ms
46ms Image
image/gif 185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-ImeX364K_LR51UdJ8yRcihDzt5RzrwU_rDj2Zw
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 07 Feb 2023 00:08:24 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 sync
criteo-partners.tremorhub.com/ Frame 0295 43 B
183 B 371ms
116ms Image
image/gif 2600:1f18:612b:4216:59f0:7d1c:f2a3:a394
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-partners.tremorhub.com/sync?UICR=k-09wSaq4K_LR51UdJ8yRcihDzt5QyS4Fvua4Zqw
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4216:59f0:7d1c:f2a3:a394 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Tue, 07 Feb 2023 00:08:25 GMT
server: Apache-Coyote/1.1
content-type: image/gif

GET
H2 200 getusermatch.php
a.twiago.com/rtb/ Frame 0295 43 B
153 B 112ms
38ms Image
image/gif 85.215.5.31
CRONON-BERLIN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.twiago.com/rtb/getusermatch.php?dataid=6&external_user_id=k-8968I64K_LR51UdJ8yRcihDzt5R9TLSXscggHw
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.215.5.31 Berlin, Germany, ASN6786 (CRONON-BERLIN-AS, DE),
Reverse DNS
Software: Apache / PHP/7.3.30
Resource Hash: 5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 07 Feb 2023 00:08:24 GMT
server: Apache
x-powered-by: PHP/7.3.30
content-length: 43
content-type: image/gif

GET
H/1.1 204
No Content m
ad.yieldlab.net/ Frame 0295 0
525 B 165ms
54ms Image
text/plain 2.17.187.27
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.yieldlab.net/m?dt_id=8664&ext_id=k-Lm5_Ma4K_LR51UdJ8yRcihDzt5REFSVqiFKuZw

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.17.187.27 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-17-187-27.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 07 Feb 2023 00:08:24 GMT
x-content-type-options: nosniff
x-frame-options: DENY
Cache-Control: no-store,no-cache,max-age=-3600,must-revalidate,post-check=0,pre-check=0
Connection: keep-alive
x-xss-protection: 1; mode=block
x-application-context: application
Expires: Mon, 06 Feb 2023 00:08:24 GMT

GET
H2 204 put
e1.emxdgt.com/ Frame 0295 0
55 B 175ms
40ms Image
text/html 3.71.169.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e1.emxdgt.com/put?d=d53&uid=k-QD2zp64K_LR51UdJ8yRcihDzt5R9FFBTg1Ht8g
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.71.169.66 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-71-169-66.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
content-length: 0
content-type: text/html

GET
H/1.1 200
OK 843ec445c1 Show response
bam-cell.nr-data.net/1/ Frame 8E37 49 B
955 B 691ms
575ms Script
text/javascript 162.247.241.2
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/1/843ec445c1?a=1507133974&sa=1&v=1215.1253ab8&t=Unnamed%20Transaction&rst=2947&ck=1&ref=https://www.travelstart.co.za/&be=386&fe=2805&dc=1270&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1675728501504,%22n%22:0,%22f%22:2,%22dn%22:2,%22dne%22:2,%22c%22:2,%22ce%22:2,%22rq%22:3,%22rp%22:366,%22rpe%22:369,%22dl%22:370,%22di%22:667,%22ds%22:1270,%22de%22:1270,%22dc%22:2805,%22l%22:2805,%22le%22:2827%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.2 Lake Oswego, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Tue, 07 Feb 2023 00:08:25 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XPzXB4Ydreb2Uxx5lUBfRXj53ChejqAqiQxRT%2BfhmNqUauvS08FiQCLXO08HdssA6TZ3or7W9grwjPJgfGEMB%2F%2Fb6FSK4OvuXUKEEtv8VakVa6rjvthNbhJ4np7JHJhegdsMgBKA"}],"group":"cf-nel","max_age":604800}
Vary: Accept-Encoding
access-control-allow-credentials: true
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
CF-Ray: 7957e4140a0d2c53-FRA

GET
H2 200 widget-settings Show response
va.tawk.to/v1/ Frame 8E37 2 KB
1 KB 60ms
48ms Fetch
application/json 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/v1/widget-settings?propertyId=590b02ae4ac4446b24a6d2d2&widgetId=1eq7s6k31&sv=undefined

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6f8950648d020769b6cbd846e54f2c1ae6e76f9516bea28c0431395e5c30b3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 552
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: visitor-application-preemptive-dzp8
server: cloudflare
etag: W/"2-261-1"
vary: Accept-Encoding
access-control-allow-methods: GET,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=7200, s-maxage=1800
cf-ray: 7957e4114dc39c10-FRA
access-control-allow-headers: content-type,x-tawk-token

POST
H3 400 start Show response
va.tawk.to/v1/session/ Frame 8E37 60 B
337 B 252ms
251ms Fetch
application/json 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/v1/session/start

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

138180bb51412a7b5c7d22ac7aeff4b8450080a6588984807afa9618dafff7fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.travelstart.co.za/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/json; charset=utf-8

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST,OPTIONS
content-type: application/json
access-control-allow-origin: https://www.travelstart.co.za
access-control-allow-credentials: true
cf-ray: 7957e412593e9067-FRA
access-control-allow-headers: content-type,x-tawk-token
content-length: 60
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: visitor-application-preemptive-rp73

OPTIONS
H2 200 start
va.tawk.to/v1/session/ Frame 0
0 172ms
166ms Preflight 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/v1/session/start

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.travelstart.co.za
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-tawk-token
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.travelstart.co.za
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7957e4114dc19c10-FRA
date: Tue, 07 Feb 2023 00:08:24 GMT
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
x-served-by: visitor-application-preemptive-xwrd

GET
H2 200 upf.js Show response
c.webengage.com/ Frame 8E37 1 KB
999 B 367ms
120ms Script
application/javascript 3.229.224.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c.webengage.com/upf.js?lp=https%3A%2F%2Fwww.travelstart.co.za%2F%3Fsearch%3Dfalse%26show_banners%3Dfalse%26log%3Dfalse%26affId%3D1236946%26language%3D%26affCampaign%3D%26utm_source%3Daffiliate%26utm_medium%3D1236946%26isiframe%3Dtrue%26landing_page%3Dfalse%26iframeVersion%3D11%26host%3Dhttps%3A%252F%252Fwww.southafricacheapflights.com%252F&rf=https%3A%2F%2Fwww.southafricacheapflights.com%2F&geo=y&jsonp=_we_jsonp_global_cb_1675728504526

Requested by

Host: ssl.widgets.webengage.com
URL: https://ssl.widgets.webengage.com/js/webengage-min-v-6.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.229.224.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-229-224-106.compute-1.amazonaws.com

Software

Resource Hash

21676115f4896349b2a2199631f9512bf2e2dc92868634a3d8857afd08bf8df6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:25 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-dns-prefetch-control: off
x-xss-protection: 1; mode=block
pragma: no-cache
x-download-options: noopen
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With,content-type
expires: 0

POST
H3 200 / Show response
www.facebook.com/tr/ Frame B012 0
18 B 47ms
42ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.travelstart.co.za
Referer: https://www.travelstart.co.za/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.travelstart.co.za
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:24 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 en.js Show response
embed.tawk.to/_s/v4/app/63b77dcd282/languages/ Frame 8E37 16 KB
4 KB 93ms
51ms Script
application/javascript 2606:4700:10::6816:1883
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/63b77dcd282/languages/en.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/63b77dcd282/js/twk-chunk-common.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:1883 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e924ffe8bcc65483510a22a7286bd6d4d204e72ffe5927eec50158f7a7be50c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 2385811
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 06 Jan 2023 01:49:34 GMT
server: cloudflare
etag: W/"585ba00b2c167b90c210161454f843b5"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 7957e411d8fc9067-FRA

GET
H3 200 web Show response
loco.travelstart.com/translations/ Frame 8E37 149 KB
38 KB 99ms
99ms XHR
application/json 104.19.160.97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loco.travelstart.com/translations/web?country=ZA&language=en&
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.160.97 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31e6c6c8223b3c233a3e4e2b3f8ecd65688e32dd743b74686661a1c5678dc1a7

Request headers

Content-Type: application/json
Accept: application/json
TS-country: ZA
Referer: https://www.travelstart.co.za/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
TS-language: en

Response headers

date: Tue, 07 Feb 2023 00:08:24 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.travelstart.co.za
access-control-allow-credentials: true
cf-ray: 7957e412faa769a3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-application-context: loco:production:8080

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4C62 42 B
64 B 80ms
80ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvURMaZ23eUtxz5vQinhXnuDIzdUed8gMArdxj01fXZz_a7mU7UMkoq_uXbUh69XashzkKQM-tTv-6KoEntcxX-9EDw6n3yMK-AggkqiC-grHDhLz1whwVzoZ_AIBM4lTp58dLqfQ&sai=AMfl-YQYXZRx6R2PLvEMmLBNmUm9ujbn6hSrYmHC_KxNkQbWaeCA-bi0oa4hQCeWAwJNL_zWtaiZKR_MrN9T&sig=Cg0ArKJSzHAAbssQL_wKEAE&cid=CAQSGwDUE5ymZ4sLItCa72HONQ3DRIny18mkMGUiohgB&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230201&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1675728502235&rpt=1371&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H3 200 web
loco.travelstart.com/translations/ Frame 0
0 155ms
155ms Preflight 104.19.160.97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://loco.travelstart.com/translations/web?country=ZA&language=en&
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.160.97 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,ts-country,ts-language
Access-Control-Request-Method: GET
Origin: https://www.travelstart.co.za
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type, ts-country, ts-language
access-control-allow-methods: GET,HEAD,POST
access-control-allow-origin: https://www.travelstart.co.za
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7957e4120a0169a3-FRA
content-length: 0
date: Tue, 07 Feb 2023 00:08:24 GMT
server: cloudflare
vary: Origin
x-application-context: loco:production:8080

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 0295
Redirect Chain

https://gum.criteo.com/sync?c=83&r=1&a=1&u=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcriteo%26partner_uid%3D%40USERID%40
https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=cDMWoe_ZQ_k22PYO9f_q8KuYFv8-UY-m

0
338 B

197ms
55ms

Image
text/plain

54.195.73.77
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=cDMWoe_ZQ_k22PYO9f_q8KuYFv8-UY-m
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Server: 54.195.73.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-195-73-77.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: beacon-n004-dub-prod.krxd.net
date: Tue, 07 Feb 2023 00:08:24 GMT
cache-control: private, no-cache, no-store
x-request-time: D=30 t=1675728504
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=cDMWoe_ZQ_k22PYO9f_q8KuYFv8-UY-m
date: Tue, 07 Feb 2023 00:08:23 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 1164491
content-length: 0

GET
H2

200

cs
s.thebrighttag.com/ Frame 0295
Redirect Chain

https://gum.criteo.com/sync?c=10&r=1&u=https%3A%2F%2Fs.thebrighttag.com%2Fcs%3Fbtt%3D0%26tp%3Dcr%26uid%3D%40USERID%40
https://s.thebrighttag.com/cs?btt=0&tp=cr&uid=JZCsDHqWDATa4oaV0C6V6NyYm1aMFcWh

35 B
268 B

402ms
129ms

Image
image/gif

3.16.134.16
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.thebrighttag.com/cs?btt=0&tp=cr&uid=JZCsDHqWDATa4oaV0C6V6NyYm1aMFcWh
Requested by: Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/
Protocol: H2
Server: 3.16.134.16 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-16-134-16.us-east-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Feb 2023 00:08:25 GMT
x-bt-requestid: 8a816f00-a67b-11ed-a588-0000ac170005
server: nginx
content-type: image/gif
access-control-allow-origin
p3p: CP=NOI DSP COR NID
cache-control: private, must-revalidate
content-length: 35
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.thebrighttag.com/cs?btt=0&tp=cr&uid=JZCsDHqWDATa4oaV0C6V6NyYm1aMFcWh
date: Tue, 07 Feb 2023 00:08:24 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 1077452
content-length: 0

GET
H2 200 ~hg3cbc.js Show response
wsdk-files.webengage.com/webengage/14507cd62/ Frame 8E37 1 KB
823 B 47ms
47ms Script
application/x-javascript 2606:4700::6812:1c93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://wsdk-files.webengage.com/webengage/14507cd62/~hg3cbc.js?r=1596449507000
Requested by: Host: ssl.widgets.webengage.com
URL: https://ssl.widgets.webengage.com/js/webengage-min-v-6.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1c93 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa8fe140511c45be63353c54c0fc858db66fb6008068248ac12720b6abde0ea5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.travelstart.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:25 GMT
content-encoding: gzip
via: 1.1 fdc45b521af7652438141328494a79d2.cloudfront.net (CloudFront)
x-amz-version-id: .zwVt.jwTkSUN45ZQki_6_NoNtdRH2ae
cf-cache-status: HIT
x-amz-cf-pop: FRA56-C2
age: 55573
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 526
last-modified: Tue, 04 Aug 2020 05:22:34 GMT
server: cloudflare
etag: "a7d7375345f3e75910f7ab99ef27a9ba"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 7957e415ebba9295-FRA
x-amz-cf-id: Lj6LFDEojft5tqt1kYr1jW2jWoDjueIKYIo_x4Ost963oqZTHtJYVg==

GET
H3 204 gen_204
www.google.com/afs/ 0
19 B 62ms
61ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/afs/gen_204?client=pub-3205907082861840&output=uds_ads_only&zx=p66makjimakf&aqid=dpbhY8znH4-ArATJ7qWIBg&psid=5134551505&pbt=bs&adbx=235&adby=686.1875&adbh=233&adbw=752&adbah=37%2C37%2C37%2C37%2C37&adbn=master-1&eawp=partner-pub-3205907082861840&errv=503972142&csala=383%7C16%7C391%7C598%7C316&lle=0&llm=1000&ifv=1&usr=1

Requested by

Host: www.southafricacheapflights.com
URL: https://www.southafricacheapflights.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:25 GMT
server: gws
x-frame-options: SAMEORIGIN
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-type: text/html; charset=UTF-8
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy: unload=()
origin-trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0=
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="gws"

POST
H2 200 l4.jpg
c.webengage.com/ Frame 8E37 43 B
398 B 118ms
118ms Ping
image/gif 3.229.224.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://c.webengage.com/l4.jpg

Requested by

Host: ssl.widgets.webengage.com
URL: https://ssl.widgets.webengage.com/js/webengage-min-v-6.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.229.224.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-229-224-106.compute-1.amazonaws.com

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.travelstart.co.za/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 07 Feb 2023 00:08:25 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-download-options: noopen
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: image/gif
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,content-type
x-xss-protection: 1; mode=block

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 250ms
249ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230202&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0073505ef9a8f71110e4cc115267942a7561e685f0d788aab6f7ce02fc1409cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11240
x-xss-protection: 0

POST
H/1.1 200
OK 843ec445c1 Show response
bam-cell.nr-data.net/events/1/ Frame 8E37 24 B
747 B 269ms
268ms XHR
image/gif 162.247.241.2
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/events/1/843ec445c1?a=1507133974&sa=1&v=1215.1253ab8&t=Unnamed%20Transaction&rst=4034&ck=1&ref=https://www.travelstart.co.za/
Requested by: Host: www.travelstart.co.za
URL: https://www.travelstart.co.za/search-on-index?search=false&show_banners=false&log=false&affId=1236946&language=&affCampaign=&utm_source=affiliate&utm_medium=1236946&isiframe=true&landing_page=false&iframeVersion=11&host=https://www.southafricacheapflights.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.2 Lake Oswego, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://www.travelstart.co.za/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 07 Feb 2023 00:08:25 GMT
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.travelstart.co.za
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tBDssirlhLumgqRAp7hpXioQrUZuOKg5xGvu3OaonQT4F6P6vlBPJl%2FQ0eqiVVC23nfsKlxp0KfOPkiht6%2Fg5NEKWMb%2BU%2BjXv%2BFjnc2%2F%2Fe1aYlXo1Eiq1YKFt74qrWnnXet6JJ5C"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 7957e417bc2c2c53-FRA
Content-Length: 24

GET
H3 204 gen_204
www.google.com/afs/ 0
19 B 63ms
63ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/afs/gen_204?client=pub-3205907082861840&output=uds_ads_only&zx=746bmgo4j99y&aqid=dpbhY8znH4-ArATJ7qWIBg&psid=5134551505&pbt=bv&adbx=235&adby=686.1875&adbh=233&adbw=752&adbah=37%2C37%2C37%2C37%2C37&adbn=master-1&eawp=partner-pub-3205907082861840&errv=503972142&csala=383%7C16%7C391%7C598%7C316&lle=0&llm=1000&ifv=1&usr=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:25 GMT
server: gws
x-frame-options: SAMEORIGIN
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-type: text/html; charset=UTF-8
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy: unload=()
origin-trial: AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0=
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="gws"

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 07 Feb 2023 00:08:25 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1B1E 13 KB
5 KB 42ms
41ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.southafricacheapflights.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 7396
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 06 Feb 2023 22:05:09 GMT
expires: Tue, 06 Feb 2024 22:05:09 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 5489 783 B
534 B 51ms
51ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f2ead2363cd5f13e7b75ba90382d7aba3ebc751aee825c804a46771336e47ea8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-G7GCf7oFhSjae2LKF0tsUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.southafricacheapflights.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-G7GCf7oFhSjae2LKF0tsUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 07 Feb 2023 00:08:25 GMT
expires: Tue, 07 Feb 2023 00:08:25 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js Show response
pagead2.googlesyndication.com/bg/ Frame 1B1E 36 KB
14 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4bT6diwPPsQGeut8gwoHo0InSaE1h0LXepToI3_IbtM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1b4fa762c0f3ec4067aeb7c830a07a3422749a1358742d77a94e8237fc86ed3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Sun, 05 Feb 2023 20:03:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 101116
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14278
x-xss-protection: 0
last-modified: Mon, 30 Jan 2023 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 05 Feb 2024 20:03:09 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 5489 0
0 76ms
75ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230202&jk=1112848247560789&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1B1E 0
10 B 40ms
40ms Image
text/plain 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?29DOGw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 07 Feb 2023 00:08:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 76ms
76ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230202&jk=1112848247560789&bg=!HxylHFjNAAaq5O5FiuQ7ACkAdvg8WqPcMPtDGqJGklIi7YXG9eddcfkNQzlJfVdJcPPRqO9JMJoHPgIAAABHUgAAAAJoAQeZAqidldFN2H6mVHpzbjDXt-rn2NsdCALxu3DL3ADyVEzsl5ktB8OPA7iBVKzNpsabz1KshaT3u_4qcyyyj6p8HpnSiFZRChY-hFKdleXBCzLXMWzKruDkpCGnHhWQVMcDwIeB_olC3aIU7G2CaQ5qnn6_d2dQcwfZjaqy485uhyGwr911Z1mAukm-fvxhqsRTII7wJfF_kMvjFLKHN-X-xKHDNVznLM5Bis7vH8c9sMXx2dwkyZq8_iYCETGzIVnV_veub2yzMRH80mvl-Um92LLW71WyvuB_Rx7ImoZq8h3Yo6Qq61qWNjRUZi45miDt6pYUUk_asVSnqUFdGLahz1r-6R2vjgoC6hrEOT7XOOVXUh8tcHPDbw8FR89HlqACXVcKlB3T_lA1is7wBPuOogaHTpaS6r5tWxDGQFC1yrvxT6PFTMD-QFNzhfvNi11D8c3XPxrLG2-Ctv2OzMDz051aTM8bMLhUmMwC-JlxldUPB3KeAViW6iYMe3IztjHiKTBz6biCRK68ORMsO1lUtxaw63qdlQr9jEy3iXKI6YEdIdtPGWDKcFAt3I_7NkveDY-gMMzB4p5iCYoolDwoIa8h7B3x5rcsUdNDHMyqMndafMiYX-7V2MitiKSMFCVfxbPK_vZf22xJ6iNC8Q0WsLC9inJKrBRrXohMr7_MgywrgMnrtMs_I22rQS1HXCq_mxsEPiSUeGv7nUqDxeIEZKk6-AK3XQo8xGKjHp4o2cnGzIhLsIkp-s4ZTJkGWIZx1nS8f-RzMSMQ-yILpcvQpe7biGTQ_kSYTp1ICCMM_BeJUcm07uFLy_ONcaFluwVWCQ20-UuDR6MIKyOnADpnckN5f5SnXTthjA_liRMGVZxUn3WfKqTguD14rJ-QZNqo79O42DKOcrni2A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.southafricacheapflights.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

226 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

55 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.southafricacheapflights.com/	1970-01-20 19:04:48	Name: _ga Value: GA1.2.223379191.1675728501
.southafricacheapflights.com/	1970-01-20 09:30:14	Name: _gid Value: GA1.2.639079244.1675728501
.southafricacheapflights.com/	1970-01-20 09:28:48	Name: _gat_gtag_UA_12368874_30 Value: 1
.avsplow.com/	1970-01-20 18:14:24	Name: nuid Value: c835c536-5052-489e-aacc-d27145bfde4a
.southafricacheapflights.com/	1970-01-20 18:50:24	Name: __gads Value: ID=3386f46889bbd1c0-224ad156a2db00d0:T=1675728501:RT=1675728501:S=ALNI_MZEsfstRYN17H6HX7f4Lrhc7ra3tA
.southafricacheapflights.com/	1970-01-20 18:50:24	Name: __gpi Value: UID=00000bb13088905f:T=1675728501:RT=1675728501:S=ALNI_MZiReCluFDJQ4XwvTbU7kGSToOi8Q
www.travelstart.co.za/	1970-01-20 09:38:53	Name: AWSALBCORS Value: ihiZskr+dyQlwoevY/fh3bpwsyZOuynSL9Msxgx0xBvjRCk+HQpcEWr/VYrdzuMfUcIByIRHK6jQds9kx38ag0kxjLj16b2Akl5VTs9bcVLXFQZBTkUqiDaaN0z9
.doubleclick.net/	1970-01-20 18:50:24	Name: IDE Value: AHWqTUmcsjX8SP46WYSchzEEVDqaGBxBLnVn0AOdZTezxSrVzqGUd6DMJ30_fMU0NFk
.doubleclick.net/	1970-01-20 09:28:52	Name: DSID Value: NO_DATA
.google.com/	1970-01-20 13:52:19	Name: NID Value: 511=EL9JzBgULD03e22l4YyGKQULQhLDEyb02EwxMr-BcwPjPyj91AEhi4I9m0klNWRsqFIyUucE8Wbwk8ZjUkjDycdSRk9d99rbHr2Ok_QPxIS2hT4vYQyFBf7CGslvsYR1sONz-F-DZ4tcR-hAeuxqEgSWVlINNk2LCJNE3TQM6JE
.southafricacheapflights.com/	1970-01-20 18:50:24	Name: __gsas Value: ID=4e9aa7f92adb2a26:T=1675728502:S=ALNI_MaeFnkW0zPw6nJ-3dMBv83QsLndLg
.criteo.com/	1970-01-20 18:50:24	Name: uid Value: c1e6bd09-bc8a-48a2-99d5-64e21d82f2fc
.bing.com/	1970-01-20 18:50:24	Name: MUID Value: 2EDF9175FDA36D90120183C4FC286C8A
.travelstart.co.za/	1970-01-20 18:14:24	Name: _hjSessionUser_2933028 Value: eyJpZCI6IjQ0N2Y5ZDI0LTJlN2EtNWQ5OC1iNzY0LTVhZThjNDA5MjAyZSIsImNyZWF0ZWQiOjE2NzU3Mjg1MDQwMTUsImV4aXN0aW5nIjpmYWxzZX0=
.travelstart.co.za/	1970-01-20 09:28:50	Name: _hjFirstSeen Value: 1
www.travelstart.co.za/	1970-01-20 09:28:48	Name: _hjIncludedInSessionSample Value: 0
.travelstart.co.za/	1970-01-20 09:28:50	Name: _hjSession_2933028 Value: eyJpZCI6IjhkZTlmMjYyLWMyODEtNGYyOS04YWU2LTM0NGE5MjdlN2RkMyIsImNyZWF0ZWQiOjE2NzU3Mjg1MDQwNDYsImluU2FtcGxlIjpmYWxzZX0=
www.travelstart.co.za/	1970-01-20 09:28:48	Name: _hjIncludedInPageviewSample Value: 1
.travelstart.co.za/	1970-01-20 09:28:50	Name: _hjAbsoluteSessionInProgress Value: 1
www.travelstart.co.za/	1969-12-31 23:59:59	Name: _hjHasCachedUserAttributes Value: true
.adnxs.com/	1970-01-20 11:38:24	Name: uuid2 Value: 8575157591724207535
www.travelstart.co.za/	1969-12-31 23:59:59	Name: twk_idm_key Value: Z3JbaSdciN-vw9YvRe4Op
.bidswitch.net/	1970-01-20 18:14:24	Name: tuuid Value: 29377710-9f71-4d9a-94bf-ec546ed930b6
.bidswitch.net/	1970-01-20 18:14:24	Name: c Value: 1675728504
.bidswitch.net/	1970-01-20 18:14:24	Name: tuuid_lu Value: 1675728504
.media.net/	1970-01-20 18:14:24	Name: visitor-id Value: 3187301049085233000V10
.media.net/	1970-01-20 10:12:00	Name: data-c-ts Value: 1675728504
.media.net/	1970-01-20 10:12:00	Name: data-c Value: k-Ms-Jw64K_LR51UdJ8yRcihDzt5S-E9YULce78Q~~3
.demdex.net/	1970-01-20 13:48:00	Name: demdex Value: 91316290971863793881851964596793131957
.dpm.demdex.net/	1970-01-20 13:48:00	Name: dpm Value: 91316290971863793881851964596793131957
.casalemedia.com/	1970-01-20 18:14:24	Name: CMID Value: Y.GWeBBdgSEbYwGULcLm9gAA
.casalemedia.com/	1970-01-20 11:38:24	Name: CMPS Value: 5173
.casalemedia.com/	1970-01-20 11:38:24	Name: CMPRO Value: 5173
.yahoo.com/	1970-01-20 18:14:46	Name: A3 Value: d=AQABBHiW4WMCEGPApKzImY1RYACZVomqdQ0FEgEBAQHn4mPrYwAAAAAA_eMAAA&S=AQAAAgW-HDbDvGTQ5GVDsV0JLJ8
.id5-sync.com/	1970-01-20 09:28:48	Name: cf Value:
.id5-sync.com/	1970-01-20 09:28:48	Name: cip Value:
.id5-sync.com/	1970-01-20 09:28:48	Name: cnac Value:
.id5-sync.com/	1970-01-20 09:28:48	Name: car Value:
.id5-sync.com/	1970-01-20 09:28:48	Name: gdpr Value:
.id5-sync.com/	1970-01-20 09:28:48	Name: callback Value:
.analytics.yahoo.com/	1970-01-20 18:14:24	Name: IDSYNC Value: 18zh~29uo
exchange.mediavine.com/	1970-01-20 09:48:58	Name: mv_tokens Value: %7B%22mv_uuid%22%3A%228a394270-a67b-11ed-9683-9bbee025015e%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 09:48:58	Name: mv_tokens_eu-v1 Value: %7B%22mv_uuid%22%3A%228a394270-a67b-11ed-9683-9bbee025015e%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 09:48:58	Name: am_tokens Value: %7B%22mv_uuid%22%3A%228a394270-a67b-11ed-9683-9bbee025015e%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 09:48:58	Name: am_tokens_eu-v1 Value: %7B%22mv_uuid%22%3A%228a394270-a67b-11ed-9683-9bbee025015e%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 09:48:58	Name: criteo Value: %7B%22id%22%3A%22k-UwOaXq4K_LR51UdJ8yRcihDzt5T_ibMj3Bdirw%22%2C%22version%22%3A%22criteo%22%7D
.pubmatic.com/	1970-01-20 10:12:00	Name: KRTBCOOKIE_97 Value: 3385-uid:k-ImeX364K_LR51UdJ8yRcihDzt5RzrwU_rDj2Zw&KRTB&23144-uid:k-ImeX364K_LR51UdJ8yRcihDzt5RzrwU_rDj2Zw&KRTB&23286-uid:k-ImeX364K_LR51UdJ8yRcihDzt5RzrwU_rDj2Zw&KRTB&23287-uid:k-ImeX364K_LR51UdJ8yRcihDzt5RzrwU_rDj2Zw
.pubmatic.com/	1970-01-20 10:12:00	Name: PugT Value: 1675728504
www.travelstart.co.za/	1969-12-31 23:59:59	Name: TawkConnectionTime Value: 0
.krxd.net/	1970-01-20 13:48:00	Name: _kuid_ Value: PXUHwAFs
.360yield.com/	1970-01-20 11:38:24	Name: tuuid Value: 74ba40b3-d2ab-466c-81cd-96530cd3e607
.360yield.com/	1970-01-20 11:38:24	Name: tuuid_lu Value: 1675728505
.360yield.com/	1970-01-20 11:38:24	Name: um Value: !38,FLnBKDNfHQjAe7A7df-1OMKAvG2eHcTCI2C8Gfywm3GyHHlJORUhMaYdgUxKHgk-ejcNRjAw,1683504505
.360yield.com/	1970-01-20 11:38:24	Name: umeh Value: !38,0,1737936505,-1
.nr-data.net/	1969-12-31 23:59:59	Name: JSESSIONID Value: 5b86dc06478f9e02

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://accounts.google.com/_/IdpIFrameHttp/cspreport Message: Failed to load resource: the server responded with a status of 400 ()
network	error	URL: https://va.tawk.to/v1/session/start Message: Failed to load resource: the server responded with a status of 400 ()
javascript	warning	URL: https://googleads.g.doubleclick.net/pagead/html/r20230202/r20110914/zrt_lookup.html?fsb=1#RS-1-&adk=1812271801&client=ca-pub-3205907082861840&fa=1&ifi=4&uci=a!4&btvi=1&xpc=axLJ9m0ESJ&p=https%3A//www.southafricacheapflights.com Message: The resource https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

14507cd62.webengage.co
5139389.fls.doubleclick.net
a.twiago.com
accounts.google.com
ad.360yield.com
ad.yieldlab.net
adservice.google.com
adservice.google.de
afs.googleusercontent.com
api.country.is
apis.google.com
app.feedblitz.com
assets.feedblitz.com
assets.feedblitzstatic.com
avsplow.com
bam-cell.nr-data.net
bat.bing.com
beacon.krxd.net
c.webengage.com
cm.adform.net
cm.g.doubleclick.net
connect.facebook.net
contextual.media.net
criteo-partners.tremorhub.com
criteo-sync.teads.tv
dis.criteo.com
dpm.demdex.net
dtm-dre.platform.hicloud.com
dynamic.criteo.com
e1.emxdgt.com
eb2.3lift.com
embed.tawk.to
exchange.mediavine.com
fonts.googleapis.com
fonts.gstatic.com
forms.feedblitz.com
googleads.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
id5-sync.com
in.hotjar.com
js-agent.newrelic.com
loco.travelstart.com
match.sharethrough.com
matching.ivitrack.com
mug.criteo.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.rubiconproject.com
r.casalemedia.com
rtb-csync.smartadserver.com
s.thebrighttag.com
script.hotjar.com
simage2.pubmatic.com
southafricacheapflights.b-cdn.net
southafricacheapflights.com
ssl.widgets.webengage.com
sslwidget.criteo.com
st.avsplow.com
static.cloudflareinsights.com
static.criteo.net
static.hotjar.com
sync-t1.taboola.com
sync.outbrain.com
tpc.googlesyndication.com
ups.analytics.yahoo.com
va.tawk.to
vars.hotjar.com
vc.hotjar.io
visitor.omnitagjs.com
wapi.travelstart.com
wsdk-files.webengage.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.southafricacheapflights.com
www.travelpayouts.com
www.travelstart.co.za
www.travelstart.com
x.bidswitch.net
104.111.217.42
104.18.33.19
104.19.160.97
13.224.189.18
13.224.189.51
13.224.189.67
13.224.189.9
13.225.78.103
13.225.78.105
13.225.78.40
141.226.228.48
142.250.185.102
142.250.186.162
151.101.130.137
162.19.138.118
162.247.241.2
172.255.224.36
176.34.212.241
178.250.0.163
178.250.2.146
18.158.43.18
185.106.81.236
185.255.84.153
185.64.189.110
185.86.138.142
185.89.211.116
2.17.187.27
2.18.235.93
216.58.212.130
2400:52e0:1e00::713:1
2600:1f18:612b:4216:59f0:7d1c:f2a3:a394
2600:9000:20eb:6800:8:cf94:88c0:93a1
2606:4700:10::6816:1883
2606:4700:20::681a:e2
2606:4700:20::ac43:44ed
2606:4700:3031::ac43:c7cd
2606:4700::6810:3965
2606:4700::6812:1c93
2606:4700::6813:b007
2620:1ec:c11::200
2a00:1450:4001:801::2002
2a00:1450:4001:808::2001
2a00:1450:4001:808::200e
2a00:1450:4001:80b::200a
2a00:1450:4001:80f::2002
2a00:1450:4001:828::2004
2a00:1450:4001:829::2002
2a00:1450:4001:829::2003
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::200d
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2002
2a00:1450:4001:830::2008
2a00:1450:4001:831::2002
2a02:2638:1::13
2a02:2638:1::3
2a02:2638:1::d
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
3.123.113.206
3.126.56.137
3.16.134.16
3.229.224.106
3.71.169.66
3.76.151.8
34.117.157.22
34.251.149.144
37.157.4.24
52.16.200.203
54.195.73.77
54.229.40.207
64.202.112.63
69.173.144.139
74.208.14.106
76.223.111.18
80.158.18.121
85.215.5.31
0073505ef9a8f71110e4cc115267942a7561e685f0d788aab6f7ce02fc1409cf
0250fbd11ea83c65333d1ffaedcefcbde9de63202d2f1d23b29f4d18ea17d105
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
07664fd6a9195b3edd30b67c88838d1322752e5ae983c4bca5ae5fad4b6b4f34
07970172ef078d9a58aa9ed9e9b54dd1cfbfec021be21b0d0fc7484c5fd5a58a
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0cad61b5cca684b36a95e7fc00c5612a52b881e1c5ff0d0b9398a25b3fea872f
0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3
0f6c0c84f6bd0256c33321eb67ef5a891d53391656adfad27cbf3af787be7873
114169a02f247c62d4a76c05ba1fa054b1f80e1fcab845363ae415f50c4c66c4
11cb2c0e70f91c6a0326cf4a4f9fa1b177c14efba6b56bf7535624b9c7bce990
123fe4944eb0f80e31d33112895744634c8b24e1a754588cbac964a0ce6a91cb
12dce92a8b28e26e0c667ea62a022051c168a89a0d375aa06c522b4462050fd1
138180bb51412a7b5c7d22ac7aeff4b8450080a6588984807afa9618dafff7fb
13cf82e6f9d48221cd55f8b3c3d206f7bdb83f291034b478e484ccfef7d500dd
16c8ad014e255e48470f6856e3ac20f6050865f72e971417501057d4aeaddd98
17dfd1e7e55698bdc34982e02dce6c617f4bf84f120a931b7b309f1aa0351bdc
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1caae31a6a05aa0be067b968fb12c9421ee72184a2a2db915a54d3330f7be923
1d26490f083b209ef29e08d092649725edf15ac2b33ad62fdeaafd37f7d79d6f
1e3c6d48c9c7dbb7c899dbb021ebba1e8047cdd95b06226fcb75b505d7b62829
21676115f4896349b2a2199631f9512bf2e2dc92868634a3d8857afd08bf8df6
21bee4db5c786a6c79fac54502db966b828e8374a52a6aafa0cae9f41c8ce63a
21ea2a02b229aa1e5a38d21816119b839221f69029e3c5dbba7856b29060da56
229d27626fbe0fa82d67c235d27ab08c67fb6635c3d3a58f153bac7ee999761b
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2959c57705d19212277cf18dde75362abe945255599c461ff8b963c64b30bae1
299a4f2bad31c68a87c725376227e4e71d3fa3be5ac21776509b6a526bfd603b
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b987833855741a74ca43f6003d83d784ed04ff8a496ea912ea48a1433f87f84
2bf373aab01a96fddf0099658b27e2eefb64c4aac7061d97d629fd7ca9a42534
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31e6c6c8223b3c233a3e4e2b3f8ecd65688e32dd743b74686661a1c5678dc1a7
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
34733e6f59010024c036b2a25e711808ef85bfcca8e1afd607ba34bfa762bfb6
39043cb6354e318af6f4f37b70b1a057b485f6e367ad9b578901185cbfe8c06a
3cbede3acf5a4c0b3cf99c55649b1bba8a5b71b593578dffb4891215480bae60
3f04b15a548a85e8d8d0ca4d5cb8ca077d0f3a9008f5a7fb54bcc72aea4e0dad
3f53150c39bf768c46efc688b616a93ec4b238a5e83e9edfe20f2d63b8f69f31
3fc59fd4cd1efc73555e0e4dcdd73bf4c3ea89fd0817635e57542078c0cd4539
4025427a412a2ac1fa7fbf7065460308f9e0ddd7fbff0eb67e5e97ecd8ccb6c8
4836b6031bc4af96767f0121fa458714583340054aea6338ef99a1bc4011f43b
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
562722d5e9bb0f13fff5ba234654a50412130eec7684cbb472666e51df5a66db
5627529e11b9dc9abd9754a8011415cb5244d37c15cecfafc2c05ba533c1340e
56e50f59a70b88d40b861711564aa935c41c01ee3664d7848d29998f0feff301
5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc
5958b8f2069b0a3292ed7a9db46b8109adac7e81591238557125893ee7e87bb7
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5adeb96ad5450c8215350b0e3f8e40ebcdb4d8ee93e041312965acbcf56dfa16
5b07e35be371eb04bde074bfeabb4822494db88cbb22a580dcbc4886bfbc7772
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5ee8198b98d57f4994d281b1b1af08e6141f140f647e1bd2e9c8302ae6d715ff
60ab96ffcc7088d7d52879c525475923f1799a673f35983481d69fb102f7a027
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
675575eb734b5114526cdc1cc9116bea0e2189e9351700944375af81e226f62d
6b597bf422617af67b2ffe3e420f0fd2d9a01a3b95020e368c57b2a131151158
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6e675ff448ac52856833527d6cbbf50b25726cacc7e219710dfdd652374404ab
705186becc9e0a306a6b4867ae2768aa9dd3b8c12393d9f9c52029e9a6fcf31c
742fc3808a614fc993365a8a71f5ae1d170ed88ddaee326dc933fa7073828eae
7562674dfc24ab1a2386f298bc81770f94fed5af3d05a144e74c3ab8f6abf6bb
75fc384c8b2f47fcbdc7291162c2e8a3879a67a82e2b3db3067684ff852206ce
773d6b46b2648bbf427beb7fd078c23eee573eb0029a6d69b31771113a32aef5
7a3b08a66fcfde2c7b538d11e1ef15916e46d007832f2a40629c1150c0090e5a
7aba1186b73911d9422fbdef504b34963dc896c16c53daacb94c06d304b3653c
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
7e80462746e8299f8c6051dd8d2c26c57de815ad9560c75ca94e229c74e909f5
812ba2d5353ea618586a36175932a14fd1c665f4a570cc3c0124d86045a14292
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85de210bb4b6289104d74761f7ea415c75a98061f7a26ad291c8d56b9b92e6b0
85ded2f008c94dc48accbeaa127fe3e625f57df66e387648caca7e3228203518
87f7cef0da90d0b53fedf2e27eb16bbdf62e0fac24edb637f8769f31cc2f892e
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a2eec716594a088e751fb0238d964df99bbab6d347cd0ad8f61316ae4caa0b9
920a378947204498c122722933b3a4b67788a2b6fade8bd0d47cf830eeee0563
9210bc824ca636dcdea6a9faac00dfd4beeb04eeecaa18fd92975ddd19d609f0
932dd24628d630a4c594d750036839378e17685dd56ce566c6ab597724dacafd
94e85586b47ae1cf74156a2733affac5d712a52cb9ea32e4fa496f9ec2e82ff5
9648446cf73c35ef331ed5fc53fb53b06f5cdb11af3d7b64f5d54ae24758b449
98a03cded6a2bd3976ad215e9f51af528f6be61edf3666ea4656e35a87f13687
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
9dee02aeeb0625ae8a1a727868168f660124d1b79129a6a21408d7555f94f717
9f6bc46e2a599c6d4e0950823024b3ced07ae54f83dc8138782f31a022d703a5
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a50c54766e77ea53b2b04a686d9ab4cf0e0fcf639eb2d0de00f329f1b8451287
a50f7abc893d7adcaa59ddd25bd12c2ae63755077d5abd126c123d56a001b445
a69940b6cef172f1cab443d8755463509d21cc9a4c3b61b9fd2846b79d3bab8d
a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940
a91393eb4cc1ccf9c54f913a8282c0a3de79fdabaa66edcc4f17415e7fd26e9f
abc9faa4970e07db7d506d6b2a98e4c86223be305c7541ced54ea2e15f99a76e
b075dc2bf38f54ee71c7a49664ac11eb2652436f855d285e5485675e0ff1f327
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4e7aac2f5069feb2cc85d59e918f39a0ce30244ee0eba030f761b4f2cb357d4
b6f8950648d020769b6cbd846e54f2c1ae6e76f9516bea28c0431395e5c30b3a
b7722cf2a37addcff21e4f02d982f6d5e31c5a52424e289f33df6cae569b5ed4
b7bff8758ad308286ecd97baea62143dd78896d938f2869bcf570002e848f5ad
ba0889bd87875c092e5fd5615a70d76c4512c700f8dc99d77c25c400f66a3df9
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbd1f3bd76f9bcf6e437c1ab9206d2a3079a6e0c34cf3d41e4bcbf4802837685
c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236
c22b83b631a5293a1acd2dd2e6e8d19f254d46990b5e2115d572fc24a6a2c461
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c68c4b9e0e06802bd415f664bde3e325f969e439013bf8d0eded8d9f9e22b922
c8011851570e5733721ce3f317e6135903f844321d853b26f2e78fa3689c5fb3
c90fa7f2b86e88bc876a28a908c00565250cfbdce151c8f3e5800bf98fa394c0
c97a353b7c3d34c96ef920afab9b0240e8f56e7c3c7d327ebb332acb613d66eb
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
cd67ee7ca8d8e8492d61c34033243e78d6f478551aaba5ee30367cc47c53f4e0
ce9f02f84b0052a69d7e4da4c1c5dc60595ce4d3974f0c4ddd68fa5cfb94c26b
cf0bd3c60a3f9faabb9c6bfedc2c198d622e7cc0e835ace3763e13ad0e742bf0
d0f07190791630edc058ad6e5a33a3cda6a8f85c470e593ce0bbed46ffec148b
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
d1ff0de8bc0eef53396c02f1c428f62b25f05306692a9eed14a09e02a77af0ea
d32c95cfd4ea4275c6ed68ab8447aca69da5a64cb5ad42e81688fac44dd1e22d
d3bb7f5958170cc19b125c07a1505cc233dcea3b3966c5934e6005d2cb12d636
d402540423e7ba6ade84a095ecb190d89749b53aca129eaaffb0837f4aff248d
da3edd648fc579bc07c4b1b1bb3ba1e8258ae308049a311e5966464295eb0e51
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
db4ac88c77d30ab0b76928ed95745c32f317aed18165cd10c4d3d5a0ba0c2833
dd2d8d288526b88b0eae53168e31b4092acf39ed38d40ffcbc6d0ab2f7a4aa66
e1b4fa762c0f3ec4067aeb7c830a07a3422749a1358742d77a94e8237fc86ed3
e2506986c6f53bd6740ed8fea43dd6a1a42d9429533c20ece438d973c4e6bf3e
e345df69bc7e03c6fb150a526675c88e4bed7136aa3b1eb21f68f1a6a4204d23
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4daa303c0637f84d8f83bcfc80a1fd002e8eeb538e2f91f7ea7dcac755920d9
e76be61057b7d805440ba2693d2c357f9a828fa8bda74170b9ac70b58af626d7
e924ffe8bcc65483510a22a7286bd6d4d204e72ffe5927eec50158f7a7be50c0
ee0ea76e7b5536eef65c7059d682ed54d2873f1ff9a7e91a87c55f5452d03421
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2ead2363cd5f13e7b75ba90382d7aba3ebc751aee825c804a46771336e47ea8
f3aec906fabbe09d9b7710a2e35a231a1070e6add00aecd4ad7c6509e3d2d263
f4e45646f18c229b08f34cf4c3401f56e57a36cf5e2eb2c08acd9cd641750f8c
f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f
f78076c88dc1857960ecdcb0b9e32d22ec71921e25bfbbd4ea5285c33d8606c9
f92333a45b532bdb5248178674b041b1c35edfd33a55df48192256f0bfe49e4e
fa88afa82ef67bdb0daeedafd49158952580d4b5d0a8c5da988dd16fbe70f1c2
fa8fe140511c45be63353c54c0fc858db66fb6008068248ac12720b6abde0ea5
fadd2893a492d84b3424a4aaf6c8f7dc6687c76ee54c74e2cc11842176a9a67d
fba8688323036b2ccff912e8ed1128c42a361c2f2a4397c85363cc1ec453dcaf
fd338f829b37a85daaccdfd14453413263221708c477ff625bd998a16c7482f8
fe6c5a49c6fad7e4eb29bbd8047bad07161797648fe74a1f6ccc4dc7688ba16e

www.southafricacheapflights.com Open in urlscan Pro 2606:4700:3031::ac43:c7cd Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

221 Requests

94 %HTTPS

41 %IPv6

60 Domains

85 Subdomains

78 IPs

9 Countries

3644 kBTransfer

13465 kBSize

55 Cookies

3 Outgoing links

Page URL History

Redirected requests

221 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

www.southafricacheapflights.com Open in urlscan Pro
2606:4700:3031::ac43:c7cd Public Scan

Screenshot
Live screenshot

Full Image

221
Requests

94 %
HTTPS

41 %
IPv6

60
Domains

85
Subdomains

78
IPs

9
Countries

3644 kB
Transfer

13465 kB
Size

55
Cookies

221 HTTP transactions
10 data transactions