URL: https://hotels.bookingdwin.com/
Submission: On October 10 via automatic, source certstream-suspicious

Summary

This website contacted 10 IPs in 3 countries across 9 domains to perform 17 HTTP transactions. The main IP is 188.42.196.67, located in Luxembourg and belongs to SERVERS - Servers.com, Inc., US. The main domain is hotels.bookingdwin.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 10th 2018. Valid for: 3 months.
This is the only time hotels.bookingdwin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 188.42.196.67 7979 (SERVERS)
1 204.197.247.162 63410 (PRIVATESY...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2400:cb00:204... 13335 (CLOUDFLAR...)
4 23.108.212.76 7979 (SERVERS)
2 35.201.81.77 15169 (GOOGLE)
17 10
Domain Requested by
4 mamka.aviasales.ru hotels.bookingdwin.com
4 hotels.bookingdwin.com hotels.bookingdwin.com
2 api.rollbar.com cdnjs.cloudflare.com
2 www.google-analytics.com 1 redirects www.googletagmanager.com
1 cdnjs.cloudflare.com hotels.bookingdwin.com
1 stats.g.doubleclick.net hotels.bookingdwin.com
1 fonts.gstatic.com hotels.bookingdwin.com
1 www.googletagmanager.com hotels.bookingdwin.com
1 fonts.googleapis.com hotels.bookingdwin.com
1 bookingdwin.com hotels.bookingdwin.com
17 10

This site contains links to these domains. Also see Links.

Domain
bookingdwin.com
Subject Issuer Validity Valid
hotels.bookingdwin.com
Let's Encrypt Authority X3
2018-10-10 -
2019-01-08
3 months crt.sh
bookingdwin.com
cPanel, Inc. Certification Authority
2018-10-07 -
2019-01-05
3 months crt.sh
*.googleapis.com
Google Internet Authority G3
2018-09-18 -
2018-12-11
3 months crt.sh
*.google-analytics.com
Google Internet Authority G3
2018-09-18 -
2018-12-11
3 months crt.sh
*.google.com
Google Internet Authority G3
2018-09-18 -
2018-12-11
3 months crt.sh
*.g.doubleclick.net
Google Internet Authority G3
2018-09-18 -
2018-12-11
3 months crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2018-09-22 -
2019-03-31
6 months crt.sh
*.aviasales.ru
COMODO RSA Domain Validation Secure Server CA
2016-07-15 -
2019-08-28
3 years crt.sh
api.rollbar.com
DigiCert SHA2 Secure Server CA
2017-04-19 -
2020-07-15
3 years crt.sh

This page contains 1 frames:

Primary Page: https://hotels.bookingdwin.com/
Frame ID: D322FC457EC2E08318647D94012AE21F
Requests: 17 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i

Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i

Page Statistics

17
Requests

100 %
HTTPS

60 %
IPv6

9
Domains

10
Subdomains

10
IPs

3
Countries

771 kB
Transfer

3027 kB
Size

9
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8
  • https://www.google-analytics.com/r/collect?v=1&_v=j70&a=516770434&t=pageview&_s=1&dl=https%3A%2F%2Fhotels.bookingdwin.com%2F&ul=en-us&de=UTF-8&dt=The%20best%20hotels%20search&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=31110865&gjid=598209406&cid=1397005240.1539155013&tid=UA-70090146-9&_gid=867334821.1539155013&_r=1&gtm=Ga1M47KB56&z=843736640 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-70090146-9&cid=1397005240.1539155013&jid=31110865&_gid=867334821.1539155013&gjid=598209406&_v=j70&z=843736640

17 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
hotels.bookingdwin.com/
23 KB
7 KB
Document
General
Full URL
https://hotels.bookingdwin.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
188.42.196.67 , Luxembourg, ASN7979 (SERVERS - Servers.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
3844f6e00e1f78579cdc4db2c682316164f0723d668d5473402cd0925f35ea88
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
hotels.bookingdwin.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200 200 OK
server
nginx
date
Wed, 10 Oct 2018 07:03:33 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding Accept-Encoding
cache-control
no-cache
etag
W/"4a551f7710e1ea008323425d60d5800e"
set-cookie
remember_token=; path=/; expires=Thu, 10 Oct 2019 07:03:33 -0000 auid_tp=CtY4vlu9pEWElgzjPp4rAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/ auid_ab=fwAAAVu9pEWEXgzfCclHAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/ wl_auid=CtY4vlu9pEWEbgzgIVEgAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/
x-content-type-options
nosniff
x-request-id
65932aac6a956e9b9ccf67666ed9680a 65932aac6a956e9b9ccf67666ed9680a
x-runtime
0.083079
x-ua-compatible
chrome=1
x-xss-protection
1; mode=block
expires
Wed, 10 Oct 2018 07:03:32 GMT
content-encoding
gzip
main.en.js
hotels.bookingdwin.com/
763 KB
176 KB
Script
General
Full URL
https://hotels.bookingdwin.com/main.en.js?r=0.9782618784325626
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
188.42.196.67 , Luxembourg, ASN7979 (SERVERS - Servers.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
3fb8ef164289e8672dbe97c35d5e3bdceb60f4714ad619ca2dfa82110efe7b90

Request headers

:path
/main.en.js?r=0.9782618784325626
pragma
no-cache
cookie
remember_token=; auid_tp=CtY4vlu9pEWElgzjPp4rAg==; auid_ab=fwAAAVu9pEWEXgzfCclHAg==; wl_auid=CtY4vlu9pEWEbgzgIVEgAg==
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
hotels.bookingdwin.com
referer
https://hotels.bookingdwin.com/
:scheme
https
:method
GET
Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 10 Oct 2018 07:03:33 GMT
content-encoding
gzip
last-modified
Thu, 06 Sep 2018 10:30:18 GMT
server
nginx
etag
"5b9101ba-2be4e"
content-type
application/javascript; charset=utf-8
status
200
content-length
179790
main.css
hotels.bookingdwin.com/
2 MB
443 KB
Stylesheet
General
Full URL
https://hotels.bookingdwin.com/main.css?r=0.5185441343104271
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
188.42.196.67 , Luxembourg, ASN7979 (SERVERS - Servers.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
dce708c89f8d8614fe57aa8313eeb619ecc26fe326dacb61bf3196da04a5c6bf

Request headers

:path
/main.css?r=0.5185441343104271
pragma
no-cache
cookie
remember_token=; auid_tp=CtY4vlu9pEWElgzjPp4rAg==; auid_ab=fwAAAVu9pEWEXgzfCclHAg==; wl_auid=CtY4vlu9pEWEbgzgIVEgAg==
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
hotels.bookingdwin.com
referer
https://hotels.bookingdwin.com/
:scheme
https
:method
GET
Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 10 Oct 2018 07:03:33 GMT
content-encoding
gzip
last-modified
Thu, 06 Sep 2018 10:30:24 GMT
server
nginx
etag
"5b9101c0-6e9c7"
content-type
text/css
status
200
content-length
453063
whitelabel_en.js
hotels.bookingdwin.com/widgets/
320 KB
63 KB
Script
General
Full URL
https://hotels.bookingdwin.com/widgets/whitelabel_en.js
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
188.42.196.67 , Luxembourg, ASN7979 (SERVERS - Servers.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
2165a311f29640b07c7da10ba3cd0c612751cc039acc791d7953daf385fdf4f2

Request headers

:path
/widgets/whitelabel_en.js
pragma
no-cache
cookie
remember_token=; auid_tp=CtY4vlu9pEWElgzjPp4rAg==; auid_ab=fwAAAVu9pEWEXgzfCclHAg==; wl_auid=CtY4vlu9pEWEbgzgIVEgAg==
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
hotels.bookingdwin.com
referer
https://hotels.bookingdwin.com/
:scheme
https
:method
GET
Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 10 Oct 2018 07:03:33 GMT
content-encoding
gzip
last-modified
Wed, 29 Aug 2018 08:17:27 GMT
server
nginx
host
www.travelpayouts.com
etag
W/"5b865697-500cf"
vary
Accept-Encoding
x-forwarded-for
148.251.45.254, 10.214.56.190, 148.251.45.254
content-type
application/javascript; charset=utf-8
status
200
x-real-ip
148.251.45.254
bookingdwin4.png
bookingdwin.com/wp-content/uploads/2018/10/
7 KB
7 KB
Image
General
Full URL
https://bookingdwin.com/wp-content/uploads/2018/10/bookingdwin4.png
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.197.247.162 Dallas, United States, ASN63410 (PRIVATESYSTEMS - PrivateSystems Networks, US),
Reverse DNS
host.creatibrand.com
Software
Apache /
Resource Hash
da0e8b871c4b9210fe4dab1a9113b4acc20ee999142cbd281eb894db1ca9a94c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
bookingdwin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://hotels.bookingdwin.com/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
public
Date
Wed, 10 Oct 2018 07:03:33 GMT
Referrer-Policy
Last-Modified
Tue, 09 Oct 2018 12:31:34 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=31536000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=14
Content-Length
6677
Expires
Thu, 10 Oct 2019 07:03:33 GMT
css
fonts.googleapis.com/
4 KB
741 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,700
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
0cbeef1cf3fbe7e0874802b1cb90e875f3bdbd49e2473bf73bd0efc1f2abac1d
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
last-modified
Wed, 10 Oct 2018 07:03:33 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 10 Oct 2018 07:03:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
x-xss-protection
1; mode=block
expires
Wed, 10 Oct 2018 07:03:33 GMT
gtm.js
www.googletagmanager.com/
73 KB
25 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-M47KB56
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
5510463f82522f6089b6742469b930a821e5010b7f8dc4d21e883cc45d943e9d
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 10 Oct 2018 07:03:33 GMT
content-encoding
gzip
server
Google Tag Manager (scaffolding)
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
25353
x-xss-protection
1; mode=block
expires
Wed, 10 Oct 2018 07:03:33 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v18/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
1be216dbc059d96e288b0c1f399a1a80ee8c65e4c1272dbc4574bd6d23cf45d9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:400,700
Origin
https://hotels.bookingdwin.com

Response headers

date
Tue, 02 Oct 2018 10:29:20 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:33:03 GMT
server
sffe
age
678853
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
10764
x-xss-protection
1; mode=block
expires
Wed, 02 Oct 2019 10:29:20 GMT
analytics.js
www.google-analytics.com/
42 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M47KB56
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
316fe2ef7b6caac81936e79571e2e0b742200f1c5b0e02d6bdeeb375eb419026
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Oct 2018 17:56:18 GMT
server
Golfe2
age
2054
date
Wed, 10 Oct 2018 06:29:19 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
17285
expires
Wed, 10 Oct 2018 08:29:19 GMT
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j70&a=516770434&t=pageview&_s=1&dl=https%3A%2F%2Fhotels.bookingdwin.com%2F&ul=en-us&de=UTF-8&dt=The%20best%20hotels%20search&sd=24-bit&sr=1600x1200...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-70090146-9&cid=1397005240.1539155013&jid=31110865&_gid=867334821.1539155013&gjid=598209406&_v=j70&z=843736640
35 B
102 B
Image
General
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-70090146-9&cid=1397005240.1539155013&jid=31110865&_gid=867334821.1539155013&gjid=598209406&_v=j70&z=843736640
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:400c:c00::9a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 10 Oct 2018 07:03:33 GMT
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 10 Oct 2018 07:03:33 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
302
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-70090146-9&cid=1397005240.1539155013&jid=31110865&_gid=867334821.1539155013&gjid=598209406&_v=j70&z=843736640
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
415
expires
Fri, 01 Jan 1990 00:00:00 GMT
rollbar.min.js
cdnjs.cloudflare.com/ajax/libs/rollbar.js/2.3.9/
58 KB
18 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/rollbar.js/2.3.9/rollbar.min.js
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/main.en.js?r=0.9782618784325626
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ee21873f0f644e948c8ccc8cbb2647d2691a94b1a36b3ed9980672b103d71d4
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://hotels.bookingdwin.com/
Origin
https://hotels.bookingdwin.com

Response headers

date
Wed, 10 Oct 2018 07:03:33 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
MISS
status
200
served-in-seconds
0.005
last-modified
Thu, 17 May 2018 09:26:39 GMT
server
cloudflare
etag
W/"5afd4acf-e9f8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
46773a522ec396e2-FRA
expires
Mon, 30 Sep 2019 07:03:33 GMT
set
mamka.aviasales.ru/third_party_cookies/
95 B
811 B
Image
General
Full URL
https://mamka.aviasales.ru/third_party_cookies/set?mamka_version=0.0.13&mamka_utc_datetime=2018-10-10T07%3A03%3A33.452Z
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.108.212.76 Phoenix, United States, ASN7979 (SERVERS - Servers.com, Inc., US),
Reverse DNS
Software
Microsoft-IIS/7.5 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 10 Oct 2018 07:03:33 GMT
server
Microsoft-IIS/7.5
status
200
etag
"0ec63b140374ba704a58fa0c743cb357683313dd"
access-control-max-age
1728000
access-control-allow-methods
GET,POST,OPTIONS
p3p
policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT", CP="CAO PSA OUR"
access-control-allow-origin
https://hotels.bookingdwin.com
cache-control
public, max-age=1
access-control-allow-credentials
true
content-type
image/png
access-control-allow-headers
Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since
content-length
95
check
mamka.aviasales.ru/third_party_cookies/
28 B
620 B
Script
General
Full URL
https://mamka.aviasales.ru/third_party_cookies/check?mamka_version=0.0.13&mamka_utc_datetime=2018-10-10T07%3A03%3A33.535Z&callback=mamka_get_param_S5BoUm
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/main.en.js?r=0.9782618784325626
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.108.212.76 Phoenix, United States, ASN7979 (SERVERS - Servers.com, Inc., US),
Reverse DNS
Software
Microsoft-IIS/7.5 /
Resource Hash
6f758816636acc091c3a9655daa3a6fc5565b42ef9ab883005b53a18eb44b7e4

Request headers

Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 10 Oct 2018 07:03:33 GMT
server
Microsoft-IIS/7.5
status
200
etag
"1652710ffb356469a0c763133a3ca6350be1503d"
access-control-max-age
1728000
access-control-allow-methods
GET,POST,OPTIONS
p3p
policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT", CP="CAO PSA OUR"
access-control-allow-origin
https://hotels.bookingdwin.com
access-control-allow-credentials
true
content-type
text/javascript
access-control-allow-headers
Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since
content-length
28
event
mamka.aviasales.ru/
95 B
971 B
Image
General
Full URL
https://mamka.aviasales.ru/event?mamka_version=0.0.13&mamka_utc_datetime=2018-10-10T07%3A03%3A33.582Z&goal=mamka_page_view&project_name=wl_search&page_view_id=hrh0ycFV3zk04p74Wnk2ZFnQc281pnAK&url=https%3A%2F%2Fhotels.bookingdwin.com%2F&referer=&data=%7B%22viewport_size%22%3A%7B%22width%22%3A1600%2C%22height%22%3A1200%7D%7D
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.108.212.76 Phoenix, United States, ASN7979 (SERVERS - Servers.com, Inc., US),
Reverse DNS
Software
Microsoft-IIS/7.5 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 10 Oct 2018 07:03:33 GMT
server
Microsoft-IIS/7.5
status
200
etag
"0ec63b140374ba704a58fa0c743cb357683313dd"
access-control-max-age
1728000
access-control-allow-methods
GET,POST,OPTIONS
p3p
policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT", CP="CAO PSA OUR"
access-control-allow-origin
https://hotels.bookingdwin.com
cache-control
public, max-age=1
access-control-allow-credentials
true
content-type
image/png
access-control-allow-headers
Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since
content-length
95
event
mamka.aviasales.ru/
95 B
971 B
Image
General
Full URL
https://mamka.aviasales.ru/event?mamka_version=0.0.13&mamka_utc_datetime=2018-10-10T07%3A03%3A33.638Z&goal=TP_WL_HOTELS_FRONTPAGE_LOAD&project_name=wl_search&url=https%3A%2F%2Fhotels.bookingdwin.com%2F&referer=&data=%7B%22device%22%3A%22desktop%22%2C%22version%22%3A1%2C%22ab_group%22%3A%22default%22%2C%22ab_branch%22%3Anull%2C%22engine_type%22%3A%22hotel%22%2C%22auid%22%3A%22CtY4vlu9pEWEbgzgIVEgAg%3D%3D%22%2C%22mamka_user_events_count%22%3A0%7D&page_view_id=hrh0ycFV3zk04p74Wnk2ZFnQc281pnAK
Requested by
Host: hotels.bookingdwin.com
URL: https://hotels.bookingdwin.com/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.108.212.76 Phoenix, United States, ASN7979 (SERVERS - Servers.com, Inc., US),
Reverse DNS
Software
Microsoft-IIS/7.5 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://hotels.bookingdwin.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 10 Oct 2018 07:03:33 GMT
server
Microsoft-IIS/7.5
status
200
etag
"0ec63b140374ba704a58fa0c743cb357683313dd"
access-control-max-age
1728000
access-control-allow-methods
GET,POST,OPTIONS
p3p
policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT", CP="CAO PSA OUR"
access-control-allow-origin
https://hotels.bookingdwin.com
cache-control
public, max-age=1
access-control-allow-credentials
true
content-type
image/png
access-control-allow-headers
Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since
content-length
95
/
api.rollbar.com/api/1/item/
0
48 B
XHR
General
Full URL
https://api.rollbar.com/api/1/item/
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/rollbar.js/2.3.9/rollbar.min.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.81.77 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
77.81.201.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Access-Control-Request-Method
POST
Origin
https://hotels.bookingdwin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers
content-type,x-rollbar-access-token

Response headers

x-response-time
0ms
date
Wed, 10 Oct 2018 07:03:33 GMT
via
1.1 google
x-content-type-options
nosniff
alt-svc
clear
server
nginx
access-control-allow-origin
*
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
status
204
access-control-allow-credentials
true
access-control-allow-headers
content-type,x-rollbar-access-token
/
api.rollbar.com/api/1/item/
94 B
172 B
XHR
General
Full URL
https://api.rollbar.com/api/1/item/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.201.81.77 Ann Arbor, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
77.81.201.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
97cf036df2022dca74e8469606d6994d0d2eea3396aef6df01e8a7898d76a6e7

Request headers

X-Rollbar-Access-Token
d046f2cd932042f3acf368699599fa00
Referer
https://hotels.bookingdwin.com/
Origin
https://hotels.bookingdwin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/json

Response headers

x-response-time
3ms
date
Wed, 10 Oct 2018 07:03:33 GMT
via
1.1 google
server
nginx
status
429
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-credentials
true
alt-svc
clear
content-length
94

Verdicts & Comments Add Verdict or Comment

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| GEOIP object| dataLayer object| TPWLCONFIG function| loadCSS object| google_tag_manager string| GoogleAnalyticsObject function| ga boolean| MewtwoIsLoaded object| google_tag_data object| gaplugins object| sa object| gaGlobal object| gaData object| mamka_queue boolean| mamka_tpc object| _rollbarShims object| _rollbarWrappedError object| Rollbar function| rollbar function| setImmediate function| clearImmediate function| cssx function| ResizeSensor object| TP_DISPATCHER boolean| SHOW_GOOGLE_ADSENSE boolean| HANDLE_ALL_MARKERS function| f function| mamka_get_param_S5BoUm number| _rollbarStartTime boolean| _rollbarDidLoad boolean| _rollbarInitialized

9 Cookies

Domain/Path Name / Value
hotels.bookingdwin.com/ Name: locale
Value: en
.bookingdwin.com/ Name: mtdc_S0PJF
Value: true
.bookingdwin.com/ Name: _gid
Value: GA1.2.867334821.1539155013
hotels.bookingdwin.com/ Name: auid_ab
Value: fwAAAVu9pEWEXgzfCclHAg==
hotels.bookingdwin.com/ Name: wl_auid
Value: CtY4vlu9pEWEbgzgIVEgAg==
hotels.bookingdwin.com/ Name: auid_tp
Value: CtY4vlu9pEWElgzjPp4rAg==
.bookingdwin.com/ Name: _ga
Value: GA1.2.1397005240.1539155013
.bookingdwin.com/ Name: _gat_UA-70090146-9
Value: 1
hotels.bookingdwin.com/ Name: remember_token
Value:

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.rollbar.com
bookingdwin.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
hotels.bookingdwin.com
mamka.aviasales.ru
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
188.42.196.67
204.197.247.162
23.108.212.76
2400:cb00:2048:1::6813:c797
2a00:1450:4001:81d::2003
2a00:1450:4001:81d::2008
2a00:1450:4001:81d::200a
2a00:1450:4001:81d::200e
2a00:1450:400c:c00::9a
35.201.81.77
0cbeef1cf3fbe7e0874802b1cb90e875f3bdbd49e2473bf73bd0efc1f2abac1d
0ee21873f0f644e948c8ccc8cbb2647d2691a94b1a36b3ed9980672b103d71d4
1be216dbc059d96e288b0c1f399a1a80ee8c65e4c1272dbc4574bd6d23cf45d9
2165a311f29640b07c7da10ba3cd0c612751cc039acc791d7953daf385fdf4f2
316fe2ef7b6caac81936e79571e2e0b742200f1c5b0e02d6bdeeb375eb419026
3844f6e00e1f78579cdc4db2c682316164f0723d668d5473402cd0925f35ea88
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fb8ef164289e8672dbe97c35d5e3bdceb60f4714ad619ca2dfa82110efe7b90
5510463f82522f6089b6742469b930a821e5010b7f8dc4d21e883cc45d943e9d
6f758816636acc091c3a9655daa3a6fc5565b42ef9ab883005b53a18eb44b7e4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
97cf036df2022dca74e8469606d6994d0d2eea3396aef6df01e8a7898d76a6e7
da0e8b871c4b9210fe4dab1a9113b4acc20ee999142cbd281eb894db1ca9a94c
dce708c89f8d8614fe57aa8313eeb619ecc26fe326dacb61bf3196da04a5c6bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855