www.firstgroup-sa.co.za Open in urlscan Pro
2606:4700::6811:ba3a  Public Scan

18 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Page URL
2. https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22

• https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 HTTP 307
• https://onboard.triptease.io/bootstrap/v6698.79747/bootstrap.js

Request Chain 41

• https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
• https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/scripts/jsd/19b997cb/invisible.js

Request Chain 69

• https://www.facebook.com/tr/?id=831287870643310&ev=PageView&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&rl=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&if=false&ts=1688992178361&sw=1600&sh=1200&v=2.9.111&r=stable&ec=0&o=30&fbp=fb.2.1688992178096.204731192&it=1688992177927&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET HTTP 302
• https://www.facebook.com/tr/?coo=false&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&dpo=LDU&dpoco=0&dpost=0&ec=0&ev=PageView&fbp=fb.2.1688992178096.204731192&id=831287870643310&if=false&it=1688992177927&o=30&r=stable&redirect=0&rl=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&rqm=GET&sh=1200&sw=1600&ts=1688992178361&v=2.9.111

Request Chain 70

• https://googleads.g.doubleclick.net/pagead/id HTTP 302
• https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

146 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Show response dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/	636 B 1 KB	741ms 598ms	Document text/html	52.169.10.20 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.169.10.20 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash 9cba504a11391fe677c03bc396012f1ff5d00062dc15c38922ed07117a003a36 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers api-deprecated False content-length 636 content-type text/html; charset=utf-8 date Mon, 10 Jul 2023 12:29:35 GMT server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 strict-transport-security max-age=31536000; includeSubDomains x-activity-id 8949654a-845c-4f8d-9aca-e07f30a3d0a6 x-content-type-options nosniff x-ms-activity-id 8949654a-845c-4f8d-9aca-e07f30a3d0a6 x-servicefabricrequestid 4661959f-093e-4443-b88a-1e73d20eb3bd bd0815be-aa12-4538-a92a-1068c4a58f03
GET H2	200	bot-detection.js Show response mktdplp102cdn.azureedge.net/public/latest/js/	29 KB 11 KB	87ms 22ms	Script application/x-javascript	2606:2800:133:206e:1315:22a5:2006:24fd EDGECAST
General Check archive.org Show headers Download Go to Full URL https://mktdplp102cdn.azureedge.net/public/latest/js/bot-detection.js?v=1.84.2007 Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CDA) / Resource Hash 84eacf3f43bf7b9177fb78c533f34c3930cd517da0295bfd57bd5e01b2400ed8 Request headers accept-language de-DE,de;q=0.9 Referer https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 10 Jul 2023 12:29:35 GMT content-encoding gzip content-md5 Yp+2mkXk4MNv10H73jLLCQ== age 329806 x-cache HIT content-length 10471 x-ms-lease-status unlocked last-modified Tue, 14 Feb 2023 10:25:54 GMT server ECAcc (frc/4CDA) etag 0x8DB0E75DA644AE9 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 205316a7-f01e-0004-202a-b0dea4000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19
GET DATA	200 OK	truncated /	68 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/png
POST H2	204	cp dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/	0 0	182ms 182ms	Fetch	52.169.10.20 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/cp Requested by Host: mktdplp102cdn.azureedge.net URL: https://mktdplp102cdn.azureedge.net/public/latest/js/bot-detection.js?v=1.84.2007 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.169.10.20 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Response headers strict-transport-security max-age=31536000; includeSubDomains date Mon, 10 Jul 2023 12:29:35 GMT x-content-type-options nosniff server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 x-servicefabricrequestid 4ee57b49-c54f-46a2-912e-655736cd67c3, 6b8b81e1-bb96-4334-bc33-d60aa4801e42 x-activity-id 0bbc9c18-6fa3-4569-a8a4-b443ec40326f x-ms-activity-id 0bbc9c18-6fa3-4569-a8a4-b443ec40326f content-length 0 api-deprecated False
GET H2	200	Primary Request midlands-saddle-and-trout Show response www.firstgroup-sa.co.za/	110 KB 17 KB	1200ms 208ms	Document text/html	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Requested by Host: mktdplp102cdn.azureedge.net URL: https://mktdplp102cdn.azureedge.net/public/latest/js/bot-detection.js?v=1.84.2007 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9a36559f4b116b44b0aa78fed186ca9b6f0f63f6d05994ffbad334a8455fd2bd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-cache cf-cache-status DYNAMIC cf-ray 7e48d0318d03371f-FRA content-encoding br content-type text/html; charset=UTF-8 date Mon, 10 Jul 2023 12:29:37 GMT last-modified Thu, 29 Jun 2023 11:46:37 GMT referrer-policy no-referrer-when-downgrade server cloudflare strict-transport-security max-age=31536000; includeSubdomains; preload vary Accept-Encoding via 1.1 55429e7ef2adea879b483fc335a60902.cloudfront.net (CloudFront) x-amz-cf-id AupNRs8xz-yIdr7WhnNi8jTZ8uLWjOxOOKZfatkQWj1CvLt5CYLzuw== x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
GET H2	200	main.css www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/	306 KB 51 KB	190ms 184ms	Stylesheet text/css	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d18d8c02267735d514d1b55662dd81b79a74863066d4c6145d108a8099b7818 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 29 Jun 2023 11:46:34 GMT server cloudflare etag W/"3b16fef5ecdb194db58ab7c13ff72415" x-frame-options SAMEORIGIN vary Accept-Encoding content-type text/css cache-control no-cache cf-ray 7e48d032eec0371f-FRA x-amz-cf-id 3T3wXELSVjQkWg1ejoBx1_jh9ZXj4iJLyl4XjjsyNpCFy-taZl3Rqg==
GET H2	200	gms-latest.min.js Show response cdn.galaxy.tf/asset-galaxy/js/	148 KB 46 KB	412ms 353ms	Script application/javascript	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.galaxy.tf/asset-galaxy/js/gms-latest.min.js?vf380a02f0c84cb86999864eaac80b67b Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ce4f1b48eedafeaa3d9b02d15dc642b4cc9a995b6e517d6d9bd91d007a420a6c Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=15768000 content-encoding br cf-cache-status DYNAMIC last-modified Tue, 23 Aug 2022 10:13:26 GMT server cloudflare etag W/"250c8-5e6e5d0abf027-gzip" vary Accept-Encoding content-type application/javascript cache-control max-age=604800 cf-ray 7e48d0334e392c6d-FRA alt-svc h3=":443"; ma=86400 expires Mon, 17 Jul 2023 12:29:37 GMT
GET H2	200	css2 fonts.googleapis.com/	33 KB 2 KB	92ms 33ms	Stylesheet text/css	2a00:1450:4001:813::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Great+Vibes&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 26b462068bdb82b16889165aae09e185499c92d7f70e02805f922e9291169a7d Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Mon, 10 Jul 2023 12:29:37 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 10 Jul 2023 12:29:37 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 10 Jul 2023 12:29:37 GMT
GET H2	200	CopperplateGothicBold.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	24 KB 24 KB	212ms 207ms	Font font/woff2	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/CopperplateGothicBold.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3d11f751bbfcb3f74bcf60fcd587652038107e810669cd061441a399110e6e91 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 d6561aeeccb210202cf78b99f07c5234.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 24304 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:39 GMT server cloudflare etag "05f290a1d57a905eaf542dbf89ebc236" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e48d032eec2371f-FRA x-amz-cf-id OFYpHLcKdkHt6_0ikEYjwCS8dCzdA6MMzt5ZLLoscT4tHnb3Qhz5Ww==
GET H2	200	CopperplateGothicBold.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	31 KB 31 KB	250ms 245ms	Font application/x-font-woff	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/CopperplateGothicBold.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4fa9553b8e1c2e83d93cb6409d0c04fbd7f4df5fa073dc09526380b79c74aa6a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 9bca546700a965c9c77ef5b8dbe65cc4.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 31880 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:34 GMT server cloudflare etag "269829e347820b7febfb4e7aaa78cc54" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e48d032eec3371f-FRA x-amz-cf-id k125PhpLNGN6Rxoys2LD22WNwarkR8KQBIh57MBjOjC9g42rBowhoQ==
GET H2	200	itc_avant_lt_bold.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	20 KB 21 KB	171ms 167ms	Font font/woff2	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_lt_bold.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash be7b85136bd51909802cf9df3eb5a9c4422d6149bb469b07233a0ea591a73b46 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 20920 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:38 GMT server cloudflare etag "e8b0598527bbd215963e47b3e233e901" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e48d032eec5371f-FRA x-amz-cf-id TYAgGkepwx4Otg6EvI95_QmXdiyk6B46iljUSgbeb0NPH9OQMfFz0Q==
GET H2	200	itc_avant_lt_bold.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	26 KB 26 KB	234ms 231ms	Font application/x-font-woff	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_lt_bold.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dfda8e97c19d1b57e5c77e515defcd80d7613d7b985bf58fe9abd989ccd5714a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 c4341fb26af0c8ea61cf721453e6bebc.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 26424 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:32 GMT server cloudflare etag "8ab88185bca4bee0496fde06832470ac" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e48d032eec9371f-FRA x-amz-cf-id N8nGTJI93-79rcU_3U4-NrOoxGWlH3gU94Es0eTW3BdzTdE5ZI2eRw==
GET H2	200	itc_avant_medium.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	19 KB 19 KB	250ms 247ms	Font font/woff2	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_medium.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b4e8fdcb8768b79bd2c243c78d8c348e03fbf4627f9ef5efcc6e018c617aa61f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 19408 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:34 GMT server cloudflare etag "a8f042db7e5c85da64352b0bf42417fb" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e48d032eecd371f-FRA x-amz-cf-id Qj9ufwrjidJ1xPWl98toS9DZA-dPSmRJBHdeyb_1skJu4pTxNhpK_Q==
GET H2	200	itc_avant_medium.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	24 KB 25 KB	367ms 364ms	Font application/x-font-woff	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_medium.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0cc32f757c93e1f0ead3f3c7a82abd4a1f3627ae69095466d755e0b7b24c1a64 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 24868 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:11 GMT server cloudflare etag "dd3aa7f79a8b9f1180b5050369924b1d" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e48d032eed4371f-FRA x-amz-cf-id c7Wda9TKijPIdVSq6NT0DJlyyZurBa9r-0IgF9KNKwcdoiV2RRyz3A==
GET H2	200	itc_avant_garde_gothic_lt_extra_light-webfont.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	19 KB 19 KB	227ms 225ms	Font font/woff2	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_garde_gothic_lt_extra_light-webfont.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d5d3fc55488572a9b3887994dd1df3fb180c34fb6960f2383b064ee7b304a397 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 85d2219c335742c82e7bf84433bc3256.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 19716 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:36 GMT server cloudflare etag "a45078faf891a62a8200df321611aca3" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e48d032eed6371f-FRA x-amz-cf-id fP7qQtJvyZbsNqaLCU3ocqImMXY9MnlgVTJgJsnPNW9-YxIef3wl0w==
GET H2	200	itc_avant_garde_gothic_lt_extra_light-webfont.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	24 KB 25 KB	137ms 135ms	Font application/x-font-woff	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_garde_gothic_lt_extra_light-webfont.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e2fd837706dddcf705eb8f148f17035ef45ab7c7572c561b8490c72a78fb6f1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 507b5edb20d0e1a0b73c8687f53defa8.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 24960 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:32 GMT server cloudflare etag "01c6ac5bd7d66dc6f87830ee6e1e6518" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e48d032eed8371f-FRA x-amz-cf-id 9iCbxsIfmlULMTklqWCkk1oo7gAgAA7urIud3pf164IKJYioqECiig==
GET H2	200	poetr-webfont.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	18 KB 19 KB	151ms 148ms	Font font/woff2	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/poetr-webfont.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1bee18ec8d387da52c83bb979a5ebfd0a81f01e4578a9217246454d7248e8e44 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 a0a81637cc76d6981e4e29044a73b7f6.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 18916 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:22 GMT server cloudflare etag "68c8e0697ce2d5f4478efe4145025318" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e48d032eedc371f-FRA x-amz-cf-id UaAFzbmYhfTsxcmqPknTxRPrTjA51DHDXN1DP81Xq1V5XDqZOdfggQ==
GET H2	200	poetr-webfont.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	24 KB 24 KB	185ms 183ms	Font application/x-font-woff	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/poetr-webfont.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d561b3b5b59d01ba7eb7228cc3f9e7eb550941335bb93f9696b1ebda16debb9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 24292 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:27 GMT server cloudflare etag "e071b6ae8c4d4321bd7dfdd1218ebed2" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e48d0330ef4371f-FRA x-amz-cf-id O2ajkG3Zadr3eAoBffQO2pvv6iU4jnbHSMuVnNQ0r4ifnzbNtC2D9Q==
GET H2	200	galaxy-helpers.js Show response www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/	56 KB 21 KB	128ms 125ms	Script application/javascript	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/galaxy-helpers.js?v=l-abc32155-72bf-4167-9e28-996bd5f4a347 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e1af5c26a6ca0cf6e1efcd25d203b5d1b890d8d2756d58ca0cfdfafa2f488576 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 7ff386cc5735ee5d428e6d9e2fdc8b2c.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 03 Nov 2022 06:54:59 GMT server cloudflare etag W/"ef1febd8b777272d6178f74661f8347e" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e48d0330ef7371f-FRA x-amz-cf-id XegrFEvp-TTlkBF5nUNkcv_8-sE3Y0R3LOH2EKuCbdY-7FdbTYrorA==
GET H2	200	jquery-3.1.1.min.js Show response www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/	85 KB 31 KB	264ms 262ms	Script application/javascript	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/jquery-3.1.1.min.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:32 GMT server cloudflare etag W/"5b5a269bd363e0886c17d855c2aab241" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e48d0330ef9371f-FRA x-amz-cf-id 7DQyh0NjrlMJF2LfvWrxevzGV4GJx6BB6Fsbz-2YhB6H9lHO6K_2Dg==
GET H2	200	lazysizes.min.js Show response www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/	7 KB 4 KB	333ms 331ms	Script application/javascript	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 06821251a29e71f8fd4f60349667c54d163b16d7bc8b1d47144c7f5042683eef Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:14 GMT server cloudflare etag W/"149ff45fc6c2f13e892e438a58abb77f" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e48d0330efa371f-FRA x-amz-cf-id NRwRnBT6rRBRDcShuuhAslqCutuuU44qvTlerJ6XmcilXMG5ijjohw==
GET H2	200	bundle-evt.min.js Show response www.firstgroup-sa.co.za/integration-shared/shared-evt/public/	14 KB 4 KB	250ms 248ms	Script application/javascript	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration-shared/shared-evt/public/bundle-evt.min.js?vf380a02f0c84cb86999864eaac80b67b Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 21e3b91dff6fbc82e8f064bdff51a687158d9362c8b0c85d1b84cb9d8bea62e3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Sun, 12 Jun 2022 05:30:15 GMT server cloudflare etag W/"06be9dcc973ab297fdff7ed212970025" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e48d0330efd371f-FRA x-amz-cf-id zzGmAamQt4UlMYJrlaXnJ-QgNaL7bgNgHLOGwsbJjQ1VQT-j-vywfw==
GET H2	200	bundle.js Show response www.firstgroup-sa.co.za/integration/first-hotels/public/js/	1 MB 324 KB	198ms 197ms	Script application/javascript	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/js/bundle.js?vf380a02f0c84cb86999864eaac80b67b Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9d350c18850ccb96442fd9e501dfb290827f44090e10449f25ad95cd782d2d4a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 d3039ad83798b26ecb9f9f1e666afe26.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 13 Apr 2023 10:04:37 GMT server cloudflare etag W/"eefd778c350b63df23546d87b71e8df7" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e48d0330f01371f-FRA x-amz-cf-id cJ39HbErMXkZ646txh8mIwSEVgAqKCeSdRTTzRqnI6-ToX73xUdAAw==
GET H2	200	bootstrap.js Show response onboard.triptease.io/bootstrap/v6698.79747/ Redirect Chain https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 https://onboard.triptease.io/bootstrap/v6698.79747/bootstrap.js	110 KB 34 KB	42ms 41ms	Script application/javascript	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/bootstrap/v6698.79747/bootstrap.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a73cd3fed1376eec3573d9842aa08dfe199e1cccf67d2416f7cc0492f65fad98 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status HIT x-goog-meta-git-hash 8096c686e1383b7ad9d3f574f31c8847a164a238 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 2450 x-guploader-uploadid ADPycduCOPKqRLoEExxv2eKsVWpiNihh5-xV8BFbZl0ERlp3VXi8UU3dK6_PxTZZRYQbiZ9knKn7W2gjkVtEp3a8X3eG9g x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-meta-build-version 6698.79747 alt-svc h3=":443"; ma=86400 last-modified Mon, 10 Jul 2023 11:26:34 GMT server cloudflare etag W/"08a2662499137e6548c784bc72408c19" vary Accept-Encoding x-goog-generation 1688988394401363 content-type application/javascript; charset=utf-8 access-control-allow-origin * x-goog-hash crc32c=x/JbfQ==, md5=CKJmJJkTfmVIx4S8ckCMGQ== access-control-expose-headers Content-Type cache-control public, max-age=31536000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gfNtl3saQe8uDzkjxV4kny15Kc7MhsQQ1KxfC3%2FfaJI7UYqJBRl6DqbSvfTV5bwt7vxvwllHWdomxRUUISXJ2tJumpo8dzNR21uj79hBlcGIb%2B4zM2swSK0oydLMvbaX3zaNTZIPXXTSUOok3pspOBRF0w%3D%3D"}],"group":"cf-nel","max_age":604800} x-goog-stored-content-length 112637 cf-ray 7e48d035fc6b1cb9-FRA expires Tue, 09 Jul 2024 11:33:31 GMT Redirect headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=15552000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PTYKJU1M7QHMSNh5o93LrkK6yqh7FmuxP24mrNYeUcSFZdechX1mupKmdnmTD6Bx1Wtr1IodErOjUh%2FvpmCbgYe5kK5P2OPb2OGkQYTw2p4pP59xYpPmVcAe%2FgL9nCMUmidT08%2FoBsBrCdnoH7PN%2BgVLQg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/plain;charset=UTF-8 location https://onboard.triptease.io/bootstrap/v6698.79747/bootstrap.js access-control-allow-origin * cache-control public, max-age=600 cf-ray 7e48d035bbfe1cb9-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept content-length 63 alt-svc h3=":443"; ma=86400
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	171 KB 47 KB	72ms 21ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 2da988427b34614d705adbf808e2e61d91f67bf147db9049e34c99b3624171e8 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 10 Jul 2023 12:29:37 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 46863 x-xss-protection 0 pragma public x-fb-debug rYNnZnVJl9gLJQdMQCv4hsxnqOsbw2gCMyqftYrLMhg5dJGuaYmNZ7CHviMUE3vyufF+xbPF+Z6pzzhK6cWEIw== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	220 KB 68 KB	87ms 28ms	Script application/javascript	2a00:1450:4001:829::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-TL2MM4B Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash c1f9662e6ed6a2e72d89a11f831508cdeed850b5c26b3536e8ef209b2d4762a1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 69149 x-xss-protection 0 last-modified Mon, 10 Jul 2023 12:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 10 Jul 2023 12:29:37 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	308 KB 95 KB	120ms 62ms	Script application/javascript	2a00:1450:4001:829::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a1ed41bf8e8820956df4ecfc73df39d0bc223c7a95e57c823c18c06f45a1dd69 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 97532 x-xss-protection 0 last-modified Mon, 10 Jul 2023 12:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 10 Jul 2023 12:29:37 GMT
GET		NIVQmaxs6TE www.youtube.com/embed/ Frame EED4	0 0
GET H3	200	dropdown-arrow-white.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	199 B 643 B	141ms 139ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/dropdown-arrow-white.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 10eaf3872d6ccfe8f2c38bc9b82600923bddfdb99d634b5b1acc7b52d1a2c9b8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 199 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:21 GMT server cloudflare etag "53cee396e71b580c087c48787e715a41" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e48d0363f9b19ad-FRA x-amz-cf-id d3eUnrULQ5UBHzgjGWbdHpieXxCFqVtgaOoPI7ElnzmXbcazZSYfcQ==
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v35/	47 KB 48 KB	75ms 20ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Great+Vibes&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 00:21:44 GMT x-content-type-options nosniff age 216473 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48412 x-xss-protection 0 last-modified Tue, 02 May 2023 15:08:53 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 00:21:44 GMT
GET H2	200	RWmMoKWR9v4ksMfaWd_JN9XFiaQ.woff2 fonts.gstatic.com/s/greatvibes/v15/	34 KB 34 KB	105ms 49ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/greatvibes/v15/RWmMoKWR9v4ksMfaWd_JN9XFiaQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Great+Vibes&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4828fd073a3b3ae17675d358262414d34cee95b4b94a4ab41a8e335a2015eb0c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 09:16:06 GMT x-content-type-options nosniff age 184411 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 34860 x-xss-protection 0 last-modified Tue, 02 May 2023 15:43:21 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 09:16:06 GMT
GET H2	200	memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2 fonts.gstatic.com/s/opensans/v35/	49 KB 49 KB	80ms 62ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v35/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Great+Vibes&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3642c7e774562f7483d7b0de93dd1759fc6928e85eebd7e62ddae72e9d46c9cb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 12:23:10 GMT x-content-type-options nosniff age 173187 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 50440 x-xss-protection 0 last-modified Tue, 02 May 2023 15:13:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 12:23:10 GMT
POST H/1.1	200 OK	869 Show response dynamic.travelclick-websolutions.com/view/	13 KB 4 KB	540ms 271ms	XHR application/json	195.244.31.25 IGUANA-WORLDWIDE
General Check archive.org Show headers Download Go to Full URL https://dynamic.travelclick-websolutions.com/view/869 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/js/bundle.js?vf380a02f0c84cb86999864eaac80b67b Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.244.31.25 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US), Reverse DNS xo7-viplb-01-new.ny.ig-1.net Software Apache / Resource Hash 104ba5664de37ffa347236c419cb053ef96502962c7633c197c5595b1a2df450 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Accept */* Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Pragma no-cache Date Mon, 10 Jul 2023 12:29:38 GMT Content-Encoding gzip Strict-Transport-Security max-age=15768000 Server Apache Vary Accept-Encoding Access-Control-Allow-Methods POST, GET, OPTIONS Content-Type application/json Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate X-Real-Hostname xo7-web-02 Content-Length 3620 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET		NIVQmaxs6TE www.youtube.com/embed/ Frame 4370	0 0
GET		NIVQmaxs6TE www.youtube.com/embed/ Frame C32A	0 0
GET H2	200	NIVQmaxs6TE Show response www.youtube.com/embed/ Frame 12A6	77 KB 32 KB	109ms 98ms	Document text/html	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/js/bundle.js?vf380a02f0c84cb86999864eaac80b67b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 6bdee4c39a1d21dddfed340b24c672866966839b55bf53848c1f1a25b1b9a3aa Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding br content-type text/html; charset=utf-8 cross-origin-opener-policy-report-only same-origin; report-to="youtube_main" cross-origin-resource-policy cross-origin date Mon, 10 Jul 2023 12:29:37 GMT expires Mon, 01 Jan 1990 00:00:00 GMT origin-trial AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=* pragma no-cache report-to {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} server ESF strict-transport-security max-age=31536000 vary Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-content-type-options nosniff x-xss-protection 0
GET H3	200	dropdown-arrow2.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	396 B 672 B	187ms 187ms	Image image/svg+xml	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/dropdown-arrow2.svg Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67048f24f9e15b8d779c632b86d09c4d9c9bb887a3142132bbb5f103e5163e11 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:33 GMT server cloudflare etag W/"51cd4cc2e178cdd8a0860500f595e434" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e48d037893a19ad-FRA x-amz-cf-id 6ED2zF9CdcxVeo3kct-uTZDKbin5ESv-l5WYVHCFK3Px2yv_Atje-A==
GET H3	200	initPersonalization.bundle.js Show response www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/	20 KB 8 KB	175ms 175ms	Script application/javascript	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/initPersonalization.bundle.js?ver=9e12c2ffed8b366e72d7 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/galaxy-helpers.js?v=l-abc32155-72bf-4167-9e28-996bd5f4a347 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7022cad501999201306c3542290df7945db17d5249478c3b8295b4e4d85ba6eb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:37 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 e7e7960d7731a7583cedd8f1ff1aca38.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 03 Nov 2022 06:54:59 GMT server cloudflare etag W/"b7eaa1851b39189f3089e87af9633eb2" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e48d037995119ad-FRA x-amz-cf-id bfbHhocXbEvNsAQwm685y-UUCIbXwVfW2SXpngaHIINvSB2vNv4gJQ==
GET H3	200	favicon.ico www.firstgroup-sa.co.za/integration/first-hotels/public/images/	10 KB 10 KB	187ms 186ms	Image image/x-icon	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/favicon.ico Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cde46b19a4a03ecf7f50494b16efb67476affd0fc21021b57d0a9ebdd72cd2ab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 21da0a66bafe2c8de8be4a4d8039346a.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:30 GMT server cloudflare etag W/"2f25f9ec6b8e9ac274f2279472a502a1" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/x-icon cache-control no-cache cf-ray 7e48d037b96719ad-FRA x-amz-cf-id 74CCBm0Z0VHNyOiBi9BpVGGP3PZPOH61P4wULKrIg0jfttgYKNmBYA==
GET H2	200	midlands-saddle-trout_logo.png image-tc.galaxy.tf/wipng-bwsbz4ladjitzhtg5dy7jctzr/	9 KB 9 KB	618ms 548ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wipng-bwsbz4ladjitzhtg5dy7jctzr/midlands-saddle-trout_logo.png?width=200 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d3ccf3dab9c5fb2c6e9d4973b90d7d39b5821030d73ad6a91590f2dd0cc31c9 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT x-amz-version-id IYxtpUGp3FnA75PGZn0ij76fnip9EPU1 x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 59778df72778f60e4701bb8768b14bcc.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop CDG50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 8793 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Wed, 22 Jun 2022 13:18:21 GMT server cloudflare etag "b94953d0f3ad5ce26ff72763cf86fd71" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/png access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d038293a993f-FRA x-amz-cf-id xlnikZI_Zbl5NJx7ocw2rmE0J5fRjnjfndVRt_6aG8Y5oKH1BW99gw==
GET H3	200	kernel-host.html Show response onboard.triptease.io/kernel/v6698.79747/ Frame 2B03	57 KB 19 KB	151ms 53ms	Document text/html	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/kernel/v6698.79747/kernel-host.html?originHost=www.firstgroup-sa.co.za Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e801e062eb64281b0b84f95f154a3da67cbbcb42dc90dcafc151ae1575b6e494 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type age 2821 alt-svc h3=":443"; ma=86400 cache-control public, max-age=31536000 cf-cache-status HIT cf-ray 7e48d03899321c9b-FRA content-encoding br content-type text/html; charset=utf-8 date Mon, 10 Jul 2023 12:29:38 GMT expires Tue, 09 Jul 2024 11:41:18 GMT last-modified Mon, 10 Jul 2023 11:26:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OLffq%2FHGLwsgubqzRffaGwRfAWCXm4pmcfZ46I9jduL2hbGmeACXJPmZfEI%2Fp%2F86aTt9NJS3g7oaB6CAhg4d2PMPIDbpYAupiUEVRAZhuRMcQyqkeW87V3WcV6o%2B%2Ft8x42sM5H61XxTrbYsmNj9LYnE4Cg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1688988390226588 x-goog-hash crc32c=tp4K3g== md5=IC7dsEKmRXsR+2esIm4pwg== x-goog-meta-build-version 6698.79747 x-goog-meta-git-hash 8096c686e1383b7ad9d3f574f31c8847a164a238 x-goog-metageneration 2 x-goog-storage-class MULTI_REGIONAL x-goog-stored-content-encoding identity x-goog-stored-content-length 58293 x-guploader-uploadid ADPycdvb00lkH8VsYET-5T4YBzAM2x3sY4BJ6f2I8wblIHJ3iX8xYRx8DfJ1x4FTh3Iv03Gvmw1HiL_aJ3swyJHW7HObx0PdbyVt
GET H2	200	1724388720976059 Show response connect.facebook.net/signals/config/	376 KB 108 KB	43ms 42ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1724388720976059?v=2.9.111&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 1132655a6c2fd3530408af6c640fe5c9d0bc52f39fdac70e095017fc20644656 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 10 Jul 2023 12:29:37 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 109931 x-xss-protection 0 pragma public x-fb-debug h7IxxqdXWE+kUNBfcq/s5dYsivbHwOCyx3btTec5c+FFa85EqDjgzd1rWLMYWWMOCsgpFdOJ6JKoRKpKm9Xv0A== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	invisible.js Show response www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/scripts/jsd/19b997cb/ Frame 073F Redirect Chain https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/scripts/invisible.js https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/scripts/jsd/19b997cb/invisible.js	7 KB 3 KB	31ms 30ms	Script application/javascript	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/scripts/jsd/19b997cb/invisible.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f16b40e24bc7e2d04fa53b2526cc8447f3b65fe04d6a16ea665a3045c3db3f85 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding br x-content-type-options nosniff server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public cf-ray 7e48d038fadc19ad-FRA alt-svc h3=":443"; ma=86400 Redirect headers date Mon, 10 Jul 2023 12:29:37 GMT server cloudflare vary accept-encoding location /cdn-cgi/challenge-platform/h/g/scripts/jsd/19b997cb/invisible.js access-control-allow-origin * cache-control max-age=300, public cf-ray 7e48d03839ff19ad-FRA alt-svc h3=":443"; ma=86400
GET H2	200	107113 Show response api.tsa-db.com/v1/data/hotelID/	649 B 1 KB	42ms 41ms	XHR application/json	2600:9000:218e:6a00:16:41f8:18c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.tsa-db.com/v1/data/hotelID/107113 Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218e:6a00:16:41f8:18c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 62b6a10d91573d55efb27dc366c3f787ea50a631c562a89fb123a91b3a326ec6 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Response headers date Mon, 10 Jul 2023 12:28:54 GMT via 1.1 90f2730fcbf1dfb3e49905fd930a0264.cloudfront.net (CloudFront) x-amz-cf-pop CDG52-P1 age 44 x-amzn-trace-id Root=1-64abf986-021b94ec45c491cf3d02ff22;Sampled=0;lineage=688c80a0:0 x-amzn-requestid 7a035a6b-8e47-4cda-9643-23ea1b9ff293 x-cache Hit from cloudfront content-type application/json; charset=utf-8 access-control-allow-origin * cache-control max-age=600 access-control-allow-credentials true x-amz-apigw-id H2Ps_F9xDoEFaMA= content-length 649 x-amz-cf-id nqxIj2ZJd_-lAEIEYC311gnzKRgDdtraDAttOy-vPMRiHqaqR8Ytng==
OPTIONS H2	200	107113 api.tsa-db.com/v1/data/hotelID/ Frame	0 0	499ms 110ms	Preflight application/json	2600:9000:218e:6a00:16:41f8:18c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.tsa-db.com/v1/data/hotelID/107113 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218e:6a00:16:41f8:18c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.firstgroup-sa.co.za Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent access-control-allow-methods OPTIONS,GET access-control-allow-origin * access-control-max-age 86400 age 14886 cache-control max-age=86400, s-maxage=86400, proxy-revalidate content-length 0 content-type application/json date Mon, 10 Jul 2023 08:21:32 GMT via 1.1 90f2730fcbf1dfb3e49905fd930a0264.cloudfront.net (CloudFront) x-amz-apigw-id H1reDH5JDoEFtBg= x-amz-cf-id HBAyAQl2e7A8iJuFMxeR3q_gv5vfYWzfx8jKY4ylVqhiDZ0bJgqhvw== x-amz-cf-pop CDG52-P1 x-amzn-requestid bf6063a8-6efb-4d57-bd3e-9fef7113e43b x-cache Hit from cloudfront
GET H2	200	optimize.js Show response www.googleoptimize.com/	129 KB 50 KB	115ms 36ms	Script application/javascript	2a00:1450:4001:80e::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleoptimize.com/optimize.js?id=OPT-KZT9Z7N Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f26d30fc68fa91ef1b9f84cdf1a8eacd6888e57cfb11d65eb8b4d5c5a07a45e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 50687 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Mon, 10 Jul 2023 12:29:38 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	87ms 21ms	Script text/javascript	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 10 Jul 2023 10:35:19 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 6859 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Mon, 10 Jul 2023 12:35:19 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/684551382/	3 KB 2 KB	134ms 64ms	Script text/javascript	2a00:1450:4001:82f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/684551382/?random=1688992178031&cv=11&fst=1688992178031&bg=ffffff&guid=ON&async=1&gtm=45He3750&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&hn=www.googleadservices.com&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&auid=50379658.1688992178&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 563967149ab9579cdbbc8eb88399b2bd036c2953b35d7714b88798aa28db5280 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1426 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/684551679/	3 KB 2 KB	179ms 109ms	Script text/javascript	2a00:1450:4001:82f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/684551679/?random=1688992178035&cv=11&fst=1688992178035&bg=ffffff&guid=ON&async=1&gtm=45He3750&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&hn=www.googleadservices.com&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&auid=50379658.1688992178&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 5ea3188155b48ea152ec515a1a74e43a9fd81633a0c80a5b28476796c522a7bb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1426 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	hotjar-3449617.js Show response static.hotjar.com/c/	9 KB 4 KB	120ms 44ms	Script application/javascript	13.225.34.50 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-3449617.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.34.50 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-34-50.cdg3.r.cloudfront.net Software / Resource Hash 5ebed540bf59dde7bc01d8ae1bfc256b16631076cd825ec00d101c4a2c759169 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=2592000; includeSubDomains content-encoding br x-content-type-options nosniff date Mon, 10 Jul 2023 12:29:31 GMT via 1.1 4f71df838a8c9e7869c43cb74c6385e6.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 age 7 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin etag W/72d27d949ae42eca9dd3f655edfa13dd vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * x-cache-hit 1 cache-control max-age=60 x-amz-cf-id acbYVRQPFUx4WZAgE8ROs4OfT3L7MWZza7yT5JmYSu3iezhYZPgOlQ==
GET H2	200	1004973-10041242.js Show response cdn-4.convertexperiments.com/js/	234 KB 69 KB	108ms 41ms	Script application/javascript	2a02:26f0:1700:189::14a9 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn-4.convertexperiments.com/js/1004973-10041242.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:189::14a9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 0d3ecb1e27379faf75c954fc2bc2b59e7effea33bb3f2589e6581e482a0252f8 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type application/javascript date Mon, 10 Jul 2023 12:29:38 GMT content-encoding gzip cache-control public, max-age=300 vary Accept-Encoding expires Mon, 10 Jul 2023 12:34:38 GMT
GET H3	200	www-player.css www.youtube.com/s/player/1dda5629/ Frame 12A6	375 KB 47 KB	25ms 22ms	Stylesheet text/css	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/1dda5629/www-player.css Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e5e92898ba6e42dfb897dca8d1601a62828ebff402051a240c4a015ea1138a41 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:24:33 GMT content-encoding br x-content-type-options nosniff age 305 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 47749 x-xss-protection 0 last-modified Wed, 05 Jul 2023 01:48:17 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 09 Jul 2024 12:24:33 GMT
GET H3	200	www-embed-player.js Show response www.youtube.com/s/player/1dda5629/www-embed-player.vflset/ Frame 12A6	311 KB 93 KB	47ms 44ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/1dda5629/www-embed-player.vflset/www-embed-player.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash dd246d635557581e8306bb09188bdd6caae6cedc47a799aaed9e96ed7db19a4c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:23:42 GMT content-encoding br x-content-type-options nosniff age 356 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 95637 x-xss-protection 0 last-modified Wed, 05 Jul 2023 01:48:17 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 09 Jul 2024 12:23:42 GMT
GET H3	200	base.js Show response www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/ Frame 12A6	2 MB 752 KB	59ms 57ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 80a9d66b356ce593f1069c17c8a60c91d7e8a0a1ae1947b7d890297dc1a3d5f9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sun, 09 Jul 2023 22:00:08 GMT content-encoding gzip x-content-type-options nosniff age 52170 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 770340 x-xss-protection 0 last-modified Wed, 05 Jul 2023 01:48:17 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Mon, 08 Jul 2024 22:00:08 GMT
GET H3	200	fetch-polyfill.js Show response www.youtube.com/s/player/1dda5629/fetch-polyfill.vflset/ Frame 12A6	9 KB 3 KB	57ms 55ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/1dda5629/fetch-polyfill.vflset/fetch-polyfill.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ac8177161c3038b07597ec544de3c00f46e1a0aa6b4b4c045ff0495553cc5069 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:15:56 GMT content-encoding br x-content-type-options nosniff age 822 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2625 x-xss-protection 0 last-modified Wed, 05 Jul 2023 01:48:17 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 09 Jul 2024 12:15:56 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 12A6	15 KB 15 KB	21ms 20ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Wed, 05 Jul 2023 00:06:15 GMT x-content-type-options nosniff age 476603 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15344 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:32:55 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 04 Jul 2024 00:06:15 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 12A6	15 KB 15 KB	24ms 24ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 17:47:45 GMT x-content-type-options nosniff age 153713 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15552 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:33:02 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 17:47:45 GMT
GET H2	200	firstresortslogo-100.png image-tc.galaxy.tf/wipng-c6svrhnya6za08pxmjouujwtv/	14 KB 14 KB	513ms 511ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wipng-c6svrhnya6za08pxmjouujwtv/firstresortslogo-100.png?width=220 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 61877efbe8988e059aeb854788d1badb0da79a9fe4e05f662022e283cab17ec2 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT x-amz-version-id 3yLuIvmxBBJBRTZMu2SOWPIHeH1T3m2x x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 14516 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Tue, 14 Sep 2021 08:19:34 GMT server cloudflare etag "096908df255a88c44659153406f193a1" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/png access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d0391a73993f-FRA x-amz-cf-id xPDaugH3RdLFJgNFvArVnn2rAQPR3YBu0_NZGjohTVMAmdQNumVSCg==
GET H2	200	3-stars.png image-tc.galaxy.tf/wipng-1eqsyl9kdk9c262hepoau5qvf/	50 KB 50 KB	417ms 417ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wipng-1eqsyl9kdk9c262hepoau5qvf/3-stars.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c15f0fe9f52687970a5392e3c23a6960b905f8c7f7d3c144d5ab3ba9e945020 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT x-amz-version-id u5oseC8ADM6BZzUGietU6pYHq1FakaYo x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 4dacb01807cb4c0e8eb52307b7de1392.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop CDG50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC alt-svc h3=":443"; ma=86400 content-length 51245 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 23 Mar 2023 12:04:35 GMT server cloudflare etag "75280d850c0740859961e120a1f95023" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/png access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d0391a74993f-FRA x-amz-cf-id Mw13vaiRjT5STmmio8nvh7sNvw4ZFd1mGKBuLWiiDm7UMgre-OJ0bg==
GET H3	200	831287870643310 Show response connect.facebook.net/signals/config/	305 KB 87 KB	87ms 82ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/831287870643310?v=2.9.111&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash d1ea5254bb3b52ef9128d62ec65822471fb3d07a897b11eaee89dd71832d282e Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 10 Jul 2023 12:29:38 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug BAPU5FHVUBeIvJv7CO8P4WwS8adP8KrGtFzBjJn7USVUC45Sxl8Ww3FVwOSBFqWeXxZECCmmY7h/C3cMAYOsqw== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	73ms 21ms	Image text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1724388720976059&ev=PageView&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&rl=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&if=false&ts=1688992178098&sw=1600&sh=1200&v=2.9.111&r=stable&ec=0&o=30&fbp=fb.2.1688992178096.204731192&cs_est=true&it=1688992177927&coo=false&rqm=GET Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Mon, 10 Jul 2023 12:29:38 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H3	200	kernel.js onboard.triptease.io/kernel/v6698.79747/ Frame 2B03	63 KB 20 KB	32ms 32ms	Other application/javascript	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/kernel/v6698.79747/kernel.js? Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 64bc5a3d83430341c57babaaea1963842b76a3f66e2e46d38116a2b68b71f2e5 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers accept-language de-DE,de;q=0.9 Referer https://onboard.triptease.io/kernel/v6698.79747/kernel-host.html?originHost=www.firstgroup-sa.co.za User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status HIT x-goog-meta-git-hash 8096c686e1383b7ad9d3f574f31c8847a164a238 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 3366 x-guploader-uploadid ADPycdsq-ERBKcZtB110XcX84dISvsjnRdsX8zzHr3AwZ7-xT9h5okvtaXvn5c94e68mGv5di6Ap7MEvlpwLNnkfMeYWT7PDbuH6 x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-meta-build-version 6698.79747 alt-svc h3=":443"; ma=86400 last-modified Mon, 10 Jul 2023 11:26:30 GMT server cloudflare etag W/"5cb7eb80f994a21d3d93473b2136bde3" vary Accept-Encoding x-goog-generation 1688988390229287 content-type application/javascript; charset=utf-8 access-control-allow-origin * x-goog-hash crc32c=OC4uaA==, md5=XLfrgPmUoh09k0c7ITa94w== access-control-expose-headers Content-Type cache-control public, max-age=31536000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=76TU7LUb2rZBpJdeYZ9vHWnKJrsmyKUdoRMkWo3wSmf3mymnZnIrJ4ssx02X2llHThR6NYxYbjd0YtQKjfrukz1L4uhEwIVCtWwsf%2BWJ3o%2Bj5dgk1SYDRJhu7hvEaFnrDTegafjpenOStLftGc%2FIshyUpA%3D%3D"}],"group":"cf-nel","max_age":604800} x-goog-stored-content-length 64193 cf-ray 7e48d0396a121c9b-FRA expires Tue, 09 Jul 2024 11:33:32 GMT
POST H3	200	7e48d0318d03371f Show response www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 073F	0 301 B	39ms 39ms	XHR text/plain	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/cv/result/7e48d0318d03371f Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/scripts/invisible.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding br server cloudflare cf-ray 7e48d03a3c5c19ad-FRA alt-svc h3=":443"; ma=86400 content-type text/plain; charset=UTF-8
GET H2	200	modules.fba0c9b2e1c5e125e170.js Show response script.hotjar.com/	270 KB 69 KB	129ms 36ms	Script application/javascript	18.164.52.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.fba0c9b2e1c5e125e170.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-3449617.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.164.52.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-164-52-95.cdg50.r.cloudfront.net Software / Resource Hash 4e930b31445643295bfd2cfaeeaba015e08766fd8b7ff3b61db88003ad6720a0 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 07:23:07 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=2592000; includeSubDomains via 1.1 dc18e61b7558d5d9f4d1852820b02a16.cloudfront.net (CloudFront) x-amz-cf-pop CDG50-P4 age 18391 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 70330 last-modified Mon, 10 Jul 2023 07:22:19 GMT etag "0054d18e8d659772b0e915a12ecd8b15" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-robots-tag none x-amz-cf-id ZIspauB9N87C8NNuzulMv2zS4wGxDORSyFHHFze4kpS4eROOPOgVsQ==
GET H2	200	/ www.google.com/pagead/1p-user-list/684551382/	42 B 108 B	89ms 34ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/684551382/?random=1688992178031&cv=11&fst=1688990400000&bg=ffffff&guid=ON&async=1&gtm=45He3750&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&fmt=3&is_vtc=1&random=3668494233&rmt_tld=0&ipr=y Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/684551382/	42 B 108 B	91ms 36ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/684551382/?random=1688992178031&cv=11&fst=1688990400000&bg=ffffff&guid=ON&async=1&gtm=45He3750&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&fmt=3&is_vtc=1&random=3668494233&rmt_tld=1&ipr=y Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	3 B 214 B	31ms 29ms	XHR text/plain	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=735058049&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&dp=%2Fmidlands-saddle-and-trout&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHBACEABRAAAACAAI~&jid=1186636417&gjid=1525164654&cid=1320456858.1688992178&tid=UA-98837830-1&_gid=637248743.1688992178&_r=1&_slc=1&gtm=45He3750n81K9Q4XPK&cd1=no_data&cd2=not_applicable&cd4=not_applicable&cd5=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&z=1621994255 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/684551679/	42 B 455 B	64ms 33ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/684551679/?random=1688992178035&cv=11&fst=1688990400000&bg=ffffff&guid=ON&async=1&gtm=45He3750&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&fmt=3&is_vtc=1&random=354240501&rmt_tld=0&ipr=y Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/684551679/	42 B 455 B	67ms 36ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/684551679/?random=1688992178035&cv=11&fst=1688990400000&bg=ffffff&guid=ON&async=1&gtm=45He3750&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&fmt=3&is_vtc=1&random=354240501&rmt_tld=1&ipr=y Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	2351337388229475 Show response connect.facebook.net/signals/config/	382 KB 109 KB	264ms 263ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/2351337388229475?v=2.9.111&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 07202ea8f693f219bc6e1aa8d92c27082d5dc8f5e4bf26f9676cea3d63bdc5a8 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 10 Jul 2023 12:29:38 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug 34Q9rlNfZWW+MhX643wKUStUOP//7IkUXPErLKUHlIUFxGg3Wl4crFk/8AElq+YwtaSxfCu/EEx/uAHYU0+D2Q== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	/ www.facebook.com/tr/ Redirect Chain https://www.facebook.com/tr/?id=831287870643310&ev=PageView&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&rl=https%... https://www.facebook.com/tr/?coo=false&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&dpo=LDU&dpoco=0&dpost=0&ec=0&e...	0 18 B	22ms 21ms	Image text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?coo=false&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&dpo=LDU&dpoco=0&dpost=0&ec=0&ev=PageView&fbp=fb.2.1688992178096.204731192&id=831287870643310&if=false&it=1688992177927&o=30&r=stable&redirect=0&rl=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&rqm=GET&sh=1200&sw=1600&ts=1688992178361&v=2.9.111 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Mon, 10 Jul 2023 12:29:38 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0 priority u=3,i Redirect headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt content-type text/plain location /tr/?coo=false&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&dpo=LDU&dpoco=0&dpost=0&ec=0&ev=PageView&fbp=fb.2.1688992178096.204731192&id=831287870643310&if=false&it=1688992177927&o=30&r=stable&redirect=0&rl=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&rqm=GET&sh=1200&sw=1600&ts=1688992178361&v=2.9.111 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0 expires 0
GET H3	200	id Show response googleads.g.doubleclick.net/pagead/ Frame 12A6 Redirect Chain https://googleads.g.doubleclick.net/pagead/id https://googleads.g.doubleclick.net/pagead/id?slf_rd=1	100 B 146 B	29ms 28ms	XHR application/json	2a00:1450:4001:82f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Server 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7cd34a15babbc35c70ea7a7711ac39d5f6218099ba57d6ddb57fee6967750a79 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 120 x-xss-protection 0 pragma no-cache server cafe content-type application/json; charset=UTF-8 access-control-allow-origin https://www.youtube.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 pragma no-cache server cafe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 access-control-allow-origin https://www.youtube.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ad_status.js Show response static.doubleclick.net/instream/ Frame 12A6	29 B 494 B	178ms 21ms	Script text/javascript	2a00:1450:4001:80b::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://static.doubleclick.net/instream/ad_status.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/www-embed-player.vflset/www-embed-player.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:04 GMT x-content-type-options nosniff age 34 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 29 x-xss-protection 0 last-modified Thu, 12 Dec 2013 23:40:16 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=900 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 10 Jul 2023 12:44:04 GMT
OPTIONS H2	200	Create jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame	0 0	145ms 31ms	Preflight text/html	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,x-goog-api-key,x-user-agent Access-Control-Request-Method POST Origin https://www.youtube.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-goog-api-key,x-user-agent access-control-allow-methods DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT access-control-allow-origin https://www.youtube.com access-control-max-age 3600 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 content-type text/html date Mon, 10 Jul 2023 12:29:38 GMT server ESF vary origin referer x-origin x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 0
POST H2	200	Create Show response jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 12A6	67 KB 31 KB	42ms 41ms	XHR application/json+protobuf	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash b5044b609e89b179c8035ebedbbbd5252d74d89296a859856f39e3faa0a13c61 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-User-Agent grpc-web-javascript/0.1 Referer https://www.youtube.com/ X-Goog-Api-Key AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json+protobuf Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding gzip x-content-type-options nosniff server ESF vary Origin, X-Origin, Referer x-frame-options SAMEORIGIN content-type application/json+protobuf; charset=UTF-8 access-control-allow-origin https://www.youtube.com access-control-expose-headers vary,vary,vary,content-encoding,date,server,content-length cache-control private access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31628 x-xss-protection 0
POST H3	200	player Show response www.youtube.com/youtubei/v1/ Frame 12A6	63 KB 23 KB	124ms 124ms	XHR application/json	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/youtubei/v1/player?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=false Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software scaffolding on HTTPServer2 / Resource Hash 9c2e9d660c6f3bd8144663fcaefd838877e19697315fbced3c4328dcd0c2fec4 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-Youtube-Bootstrap-Logged-In false accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-Youtube-Client-Name 56 X-Youtube-Client-Version 1.20230704.00.00 X-Goog-Visitor-Id CgttVjUzZ29lUkJQMCix86-lBg%3D%3D Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding br x-content-type-options nosniff server scaffolding on HTTPServer2 x-frame-options SAMEORIGIN vary Origin, X-Origin, Referer content-type application/json; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23244 x-xss-protection 0 expires Mon, 10 Jul 2023 12:29:38 GMT
GET H2	200	V7JOy9E5LPAmHC4-uXpPG1TUC0v77ajXJMI6Ew5elJ8.js Show response www.google.com/js/th/ Frame 12A6	37 KB 15 KB	43ms 43ms	Script text/javascript	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/js/th/V7JOy9E5LPAmHC4-uXpPG1TUC0v77ajXJMI6Ew5elJ8.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 57b24ecbd1392cf0261c2e3eb97a4f1b54d40b4bfbeda8d724c23a130e5e949f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 16:06:33 GMT content-encoding br x-content-type-options nosniff age 159785 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 14661 x-xss-protection 0 last-modified Mon, 26 Jun 2023 15:30:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Sun, 07 Jul 2024 16:06:33 GMT
GET H3	200	embed.js Show response www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/ Frame 12A6	28 KB 8 KB	25ms 24ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/embed.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4a101234fd004179c4ba82ac71e6fc670a4778ce1e22661936a933e5a8834181 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sun, 09 Jul 2023 02:31:12 GMT content-encoding br x-content-type-options nosniff age 122306 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 8147 x-xss-protection 0 last-modified Wed, 05 Jul 2023 01:48:17 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Mon, 08 Jul 2024 02:31:12 GMT
GET DATA	200 OK	truncated / Frame 12A6	175 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/png
GET H2	200	AOPolaT1LYYbpOw1hd8FF9JVeudO2dPTqLmFdeR8nFV1=s68-c-k-c0x00ffffff-no-rj yt3.ggpht.com/ytc/ Frame 12A6	3 KB 4 KB	74ms 19ms	Image image/jpeg	2a00:1450:4001:806::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://yt3.ggpht.com/ytc/AOPolaT1LYYbpOw1hd8FF9JVeudO2dPTqLmFdeR8nFV1=s68-c-k-c0x00ffffff-no-rj Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 02a40f2e04358612332400244cd5334e264ea2de1c828722881dcf31c4371a95 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:28:54 GMT x-content-type-options nosniff age 44 content-disposition inline;filename="unnamed.jpg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3572 x-xss-protection 0 server fife etag "v65" vary Origin content-type image/jpeg access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Tue, 11 Jul 2023 12:28:54 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	3 B 23 B	30ms 29ms	XHR text/plain	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=735058049&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACEABRAAAACAEK~&jid=1338753506&gjid=1811362303&cid=1320456858.1688992178&tid=UA-162681275-1&_gid=637248743.1688992178&_r=1&_slc=1&gtm=45He3750n81TL2MM4B&cd1=not_applicable&cd2=not_applicable&cd3=First%20Group%20Management%20MB&cd4=First%20Resorts&cd5=107113&cd6=Midlands%20Saddle%20Trout&cd7=Mooi%20River&cd8=South%20Africa&cd9=KwaZulu-Natal&cd10=middle_east_and_africa&cd11=Africa&cd12=galaxy&cd13=custom&cg1=web&cg2=not_applicable&cg3=group_property&cd19=tvs_no&cd20=iHotelier%20BE4&cd21=group_property&cd22=0&cd23=4&cd24=1&cd25=en&cd26=web&cd27=not_applicable&cd28=not_applicable&cd29=not_applicable&cd30=no&cd31=no&cd34=%7C&cd36=%7C&cd38=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&cd39=firstgroup-sa.co.za&cd40=firstgroup-sa.co.za&cd41=GTM-TL2MM4B&cd42=64&cd54=be4&cd59=0&z=1159423659 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	226 KB 79 KB	30ms 30ms	Script application/javascript	2a00:1450:4001:829::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-3R5SJEDWK4&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TL2MM4B Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a5922907c10f5e655d4b261d775d078cb749debbf85a4d60f15bd19404f051cf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 80442 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Mon, 10 Jul 2023 12:29:38 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	4 B 24 B	35ms 34ms	XHR text/plain	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=735058049&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACEABRAAAACAEK~&jid=1109362533&gjid=1186636523&cid=1320456858.1688992178&tid=UA-135537499-5&_gid=637248743.1688992178&_r=1&_slc=1&gtm=45He3750n81K9Q4XPK&cd1=not_set&cd2=not_applicable&cd3=not_applicable&cd4=not_applicable&cd5=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&cd6=Mooi%20River&cd7=South%20Africa&cd8=KwaZulu-Natal&cd9=en&cd10=First%20Resorts&cd11=107113&cd12=Midlands%20Saddle%20Trout&cd13=0&cd14=no&cg1=not_applicable&cd20=no&z=554644564 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	4 B 24 B	31ms 30ms	XHR text/plain	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=735058049&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACEABRAAAACAEK~&jid=1606768078&gjid=239548796&cid=1320456858.1688992178&tid=UA-135537499-1&_gid=637248743.1688992178&_r=1&_slc=1&gtm=45He3750n81K9Q4XPK&cd1=not_set&cd2=not_applicable&cd3=not_applicable&cd4=not_applicable&cd5=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&cd6=Mooi%20River&cd7=South%20Africa&cd8=KwaZulu-Natal&cd9=en&cd10=First%20Resorts&cd11=107113&cd12=Midlands%20Saddle%20Trout&cd13=0&cd14=no&cg1=not_applicable&cd20=no&z=1118759052 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	231 KB 80 KB	36ms 36ms	Script application/javascript	2a00:1450:4001:829::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-LP9ZQF3SMX&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0c68d68457e34844192698f1453e0724a0ef429bd6055ff2c75bcb2449413013 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 82090 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Mon, 10 Jul 2023 12:29:38 GMT
POST H3	204	qoe Show response www.youtube.com/api/stats/ Frame 12A6	0 19 B	31ms 30ms	XHR text/html	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/api/stats/qoe?fmt=244&afmt=250&cpn=UXF3vsGQ40IXK3nY&el=embedded&ns=yt&fexp=23983296%2C24004644%2C24007246%2C24080738%2C24135310%2C24208765%2C24219382%2C24255165%2C24362593%2C24362623%2C24364789%2C24366065%2C24366917%2C24380264%2C24383853%2C24415864%2C24416290%2C24439361%2C24501422%2C24691745%2C39324104&cl=545524056&seq=1&docid=NIVQmaxs6TE&ei=svmrZOa5HZP_gAePyr34DQ&event=streamingstats&plid=AAYAISLUK2cDHpkV&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FNIVQmaxs6TE%3Fplaylist%3DNIVQmaxs6TE%26rel%3D0%26autoplay%3D1%26controls%3D0%26showinfo%3D0%26loop%3D1%26mute%3D1&qclc=ChBVWEYzdnNHUTQwSVhLM25ZEAE&embargoed=0&cbr=Chrome&cbrver=114.0.5735.198&c=WEB_EMBEDDED_PLAYER&cver=1.20230704.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&vps=0.000:N,0.010:B,0.180:B,0.180:B&cat=streaming&cmt=0.010:0.000,0.180:0.000&afs=0.180:250::i&vfs=0.180:244:248::r&view=0.180:4800:1079&bwe=0.180:130000&bat=0.180:1:1&vis=0.180:0&bh=0.180:0.000 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/x-www-form-urlencoded X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230704.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgttVjUzZ29lUkJQMCix86-lBg%3D%3D X-YouTube-Ad-Signals dt=1688992178346&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 access-control-allow-origin https://www.youtube.com cache-control no-cache, must-revalidate access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	videoplayback Show response rr3---sn-4g5e6nze.googlevideo.com/ Frame 12A6	236 KB 237 KB	261ms 174ms	Fetch application/vnd.yt-ump	2a00:1450:4001:66::8 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr3---sn-4g5e6nze.googlevideo.com/videoplayback?expire=1689013778&ei=svmrZOa5HZP_gAePyr34DQ&ip=2001%3A1b60%3A2%3A240%3A3247%3A%3A7&id=o-AJY8_nBzZzDt3s7DHEZV3YheOV3rfvqQPfMi3xfAouPt&itag=244&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-4g5e6nze%2Csn-4g5edn6k&ms=au%2Crdu&mv=m&mvi=3&pl=29&initcwndbps=1292500&spc=Ul2Sq5r0V1QVi9vcfygTGPURRJ8PQQ8skwCXyeoPNQ&vprv=1&svpuc=1&mime=video%2Fwebm&ns=AFmFcIktdHX9cna63rbNZlMO&gir=yes&clen=2574516&dur=30.000&lmt=1658290311840788&mt=1688991939&fvip=1&keepalive=yes&fexp=24007246%2C24363392&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=7QPBWgREMEgR7Q&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgZoZITws_Cm470ZV1un-paRrlKSPgX0DAvh4E4CZZPnQCICXiVzvmq8bo4wSOgyhjimMW9LnMBy9lg8MCaGK7F35i&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgU5_OdHE8-NlHPeMef33HCEEv9XOpQ8iDvQngRE2IIhgCIAQBifNVLZhjuE4Flr2fYRtT_jpKMEmLHDkM0MSn8FNg&alr=yes&cpn=UXF3vsGQ40IXK3nY&cver=1.20230704.00.00&range=0-241733&rn=1&rbuf=0&pot=IiiM54zk6Ex1Vc-A-JPajdmd1tW1i9mMxrbBpOWftNGhi86AqdTIwr-j&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:66::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 9d12e3b249ee18dff8cb43ee12507a7cf8a3025efcdfdac5481fad931753644d Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Mon, 10 Jul 2023 12:29:38 GMT X-Restrict-Formats-Hint None X-Content-Type-Options nosniff Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive Alt-Svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" Last-Modified Wed, 20 Jul 2022 04:11:51 GMT Server gvs 1.0 Vary Origin Content-Type application/vnd.yt-ump Access-Control-Allow-Origin https://www.youtube.com Access-Control-Expose-Headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Cache-Control private, max-age=21300 Access-Control-Allow-Credentials true Timing-Allow-Origin https://www.youtube.com Expires Mon, 10 Jul 2023 12:29:38 GMT
POST H/1.1	200 OK	videoplayback Show response rr3---sn-4g5e6nze.googlevideo.com/ Frame 12A6	14 KB 15 KB	153ms 67ms	Fetch application/vnd.yt-ump	2a00:1450:4001:66::8 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr3---sn-4g5e6nze.googlevideo.com/videoplayback?expire=1689013778&ei=svmrZOa5HZP_gAePyr34DQ&ip=2001%3A1b60%3A2%3A240%3A3247%3A%3A7&id=o-AJY8_nBzZzDt3s7DHEZV3YheOV3rfvqQPfMi3xfAouPt&itag=250&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-4g5e6nze%2Csn-4g5edn6k&ms=au%2Crdu&mv=m&mvi=3&pl=29&initcwndbps=1292500&spc=Ul2Sq5r0V1QVi9vcfygTGPURRJ8PQQ8skwCXyeoPNQ&vprv=1&svpuc=1&mime=audio%2Fwebm&ns=AFmFcIktdHX9cna63rbNZlMO&gir=yes&clen=13885&dur=30.021&lmt=1658290308483560&mt=1688991939&fvip=1&keepalive=yes&fexp=24007246%2C24363392&c=WEB_EMBEDDED_PLAYER&txp=5311224&n=7QPBWgREMEgR7Q&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRgIhALbx2DH0_LxdpjsVrO1pSR3yNiLGDLnLjeVRcH-eUCwrAiEA65kAw7ZTJSmkgE7o7CVTHyJ0xdhAHupeB6c_HprwTYE%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgU5_OdHE8-NlHPeMef33HCEEv9XOpQ8iDvQngRE2IIhgCIAQBifNVLZhjuE4Flr2fYRtT_jpKMEmLHDkM0MSn8FNg&alr=yes&cpn=UXF3vsGQ40IXK3nY&cver=1.20230704.00.00&range=0-13884&rn=2&rbuf=0&pot=Iih8HXweGLaFrz96CGkqdylnJi9FcSl2NkwxXhVlRCtRcT56WS44OE9Z&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:66::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 02dcf9de98ef748c75b040660886125b0b68c0f9a4b017bcd8b29fcd9b468889 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Mon, 10 Jul 2023 12:29:38 GMT X-Content-Type-Options nosniff Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive Alt-Svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" Last-Modified Wed, 20 Jul 2022 04:11:48 GMT Server gvs 1.0 Vary Origin Content-Type application/vnd.yt-ump Access-Control-Allow-Origin https://www.youtube.com Access-Control-Expose-Headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Cache-Control private, max-age=21300 Access-Control-Allow-Credentials true Timing-Allow-Origin https://www.youtube.com Expires Mon, 10 Jul 2023 12:29:38 GMT
GET H3	200	endscreen.js Show response www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/ Frame 12A6	32 KB 8 KB	23ms 22ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/endscreen.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0558bc2c8c810cc57448a82de2cba85c6765cdf83290bf3e5b845b6ac4d2210e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Wed, 05 Jul 2023 07:20:40 GMT content-encoding br x-content-type-options nosniff age 450538 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 8302 x-xss-protection 0 last-modified Wed, 05 Jul 2023 01:48:17 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 04 Jul 2024 07:20:40 GMT
POST H3	200	next Show response www.youtube.com/youtubei/v1/ Frame 12A6	34 KB 6 KB	320ms 319ms	XHR application/json	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/youtubei/v1/next?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=false Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software scaffolding on HTTPServer2 / Resource Hash d8ca1dcb2ecc8991543cd0e76c777663dc0c24e6f62496ad21dd9a41ad967fc4 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-Youtube-Bootstrap-Logged-In false accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-Youtube-Client-Name 56 X-Youtube-Client-Version 1.20230704.00.00 X-Goog-Visitor-Id CgttVjUzZ29lUkJQMCix86-lBg%3D%3D Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding br x-content-type-options nosniff server scaffolding on HTTPServer2 x-frame-options SAMEORIGIN vary Origin, X-Origin, Referer content-type application/json; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 5759 x-xss-protection 0 expires Mon, 10 Jul 2023 12:29:38 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	24ms 19ms	Image image/gif	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=735058049&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Google%20Optimize&ea=2kyco3QpSfCTG6iMjPW3Sg&_u=aHDACEABRAAAACAEK~&jid=&gjid=&cid=1320456858.1688992178&tid=UA-135537499-1&_gid=637248743.1688992178&gtm=45He3750n81K9Q4XPK&cd1=not_set&cd2=not_applicable&cd3=not_applicable&cd4=not_applicable&cd5=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&cd6=Mooi%20River&cd7=South%20Africa&cd8=KwaZulu-Natal&cd9=en&cd10=First%20Resorts&cd11=107113&cd12=Midlands%20Saddle%20Trout&cd13=0&cd14=no&cg1=not_applicable&cd20=no&z=1445264532 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Sun, 09 Jul 2023 19:36:13 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 60805 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
POST H3	200	GenerateIT Show response jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 12A6	90 B 134 B	34ms 33ms	XHR application/json+protobuf	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 08f3d8275949e4dd6f0431d05d99363da53be39cdfc38fa1bad305246a7f877f Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-User-Agent grpc-web-javascript/0.1 Referer https://www.youtube.com/ X-Goog-Api-Key AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json+protobuf Response headers date Mon, 10 Jul 2023 12:29:38 GMT content-encoding gzip x-content-type-options nosniff server ESF vary Origin, X-Origin, Referer x-frame-options SAMEORIGIN content-type application/json+protobuf; charset=UTF-8 access-control-allow-origin https://www.youtube.com access-control-expose-headers vary,vary,vary,content-encoding,date,server,content-length cache-control private access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 110 x-xss-protection 0
OPTIONS H3	200	GenerateIT jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame	0 0	28ms 28ms	Preflight text/html	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,x-goog-api-key,x-user-agent Access-Control-Request-Method POST Origin https://www.youtube.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-goog-api-key,x-user-agent access-control-allow-methods DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT access-control-allow-origin https://www.youtube.com access-control-max-age 3600 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 content-type text/html date Mon, 10 Jul 2023 12:29:38 GMT server ESF vary origin referer x-origin x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 0
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 355 B	85ms 27ms	XHR text/plain	2a00:1450:400c:c00::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-135537499-5&cid=1320456858.1688992178&jid=1109362533&gjid=1186636523&_gid=637248743.1688992178&_u=aHDACEABRAAAACAEK~&z=1411360417 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 70 B	85ms 28ms	XHR text/plain	2a00:1450:400c:c00::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-135537499-1&cid=1320456858.1688992178&jid=1606768078&gjid=239548796&_gid=637248743.1688992178&_u=aHDACEABRAAAACAEK~&z=551183586 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	204	generate_204 www.youtube.com/ Frame 12A6	0 10 B	21ms 20ms	Image text/plain	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.youtube.com/generate_204?dzBrHw Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:38 GMT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0
GET H3	200	ga-audiences www.google.com/ads/	42 B 63 B	47ms 46ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-135537499-5&cid=1320456858.1688992178&jid=1109362533&_u=aHDACEABRAAAACAEK~&z=1816970749 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	48ms 46ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-135537499-5&cid=1320456858.1688992178&jid=1109362533&_u=aHDACEABRAAAACAEK~&z=1816970749 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.com/ads/	42 B 63 B	49ms 48ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-135537499-1&cid=1320456858.1688992178&jid=1606768078&_u=aHDACEABRAAAACAEK~&z=2143363490 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	47ms 45ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-135537499-1&cid=1320456858.1688992178&jid=1606768078&_u=aHDACEABRAAAACAEK~&z=2143363490 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:38 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 260 B	80ms 29ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-3R5SJEDWK4&gtm=45je3750&_p=735058049&cid=1320456858.1688992178&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1688992178&sct=1&seg=0&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&en=page_view&_fv=1&_ss=1&ep.hotel_name=Midlands%20Saddle%20Trout&ep.hotel_id=107113&ep.hotel_bid=not_applicable&ep.hotel_brand_name=First%20Group%20Management%20MB&ep.hotel_chain_id=not_applicable&ep.hotel_city=Mooi%20River&ep.hotel_continent=Africa&ep.hotel_country=South%20Africa&ep.hotel_state=KwaZulu-Natal&ep.hotel_sub_brand_name=First%20Resorts&ep.hotel_tc_region=middle_east_and_africa&ep.hotel_booking_engine=iHotelier%20BE4&ep.page_has_tvs=no&ep.page_language=en&ep.page_section=not_applicable&ep.page_subsection=not_applicable&ep.site_cms=galaxy&ep.site_galaxy_product=custom&ep.site_tvs=tvs_no&ep.hotel_property_type=group_property&ep.hotel_star_rating=0&ep.hotel_room_types_count=4&epn.site_number_of_languages=1&ep.site_global_product=web&ep.page_content_group=not_applicable&ep.site_be_version=be4&epn.page_tvs_videos_count=0&up.user_logged_in=no Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:39 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 54 B	47ms 29ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-LP9ZQF3SMX&gtm=45je3750&_p=735058049&cid=1320456858.1688992178&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1688992178&sct=1&seg=0&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&en=page_view&_fv=1&_ss=1&ep.page_section=not_applicable&ep.page_subsection=not_applicable&ep.page_content_group=not_applicable&ep.page_full_url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&ep.page_language=en&ep.page_containing_tvs=no&ep.hotel_city=Mooi%20River&ep.hotel_country=South%20Africa&ep.hotel_state=KwaZulu-Natal&ep.hotel_continent=Africa&ep.hotel_brand_name=First%20Resorts&ep.hotel_id=107113&ep.hotel_name=Midlands%20Saddle%20Trout&ep.hotel_star_rating=0&ep.hotel_property_type=group_property&ep.hotel_booking_engine_provider=iHotelier%20BE4&up.user_logged_in_session=no Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:39 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.facebook.com/tr/	0 15 B	20ms 20ms	Image text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=2351337388229475&ev=PageView&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DejsSPtJImgiBWifx3SjbmrsTvYCtt0PoEG3QC9a84EY&rl=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&if=false&ts=1688992179013&sw=1600&sh=1200&v=2.9.111&r=stable&ec=0&o=30&fbp=fb.2.1688992178096.204731192&cs_est=true&it=1688992177927&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Mon, 10 Jul 2023 12:29:39 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0 priority u=3,i
POST H3	200	videoplayback Show response rr3---sn-4g5e6nze.googlevideo.com/ Frame 12A6	236 KB 236 KB	49ms 23ms	Fetch application/vnd.yt-ump	2a00:1450:4001:66::8 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr3---sn-4g5e6nze.googlevideo.com/videoplayback?expire=1689013778&ei=svmrZOa5HZP_gAePyr34DQ&ip=2001%3A1b60%3A2%3A240%3A3247%3A%3A7&id=o-AJY8_nBzZzDt3s7DHEZV3YheOV3rfvqQPfMi3xfAouPt&itag=244&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-4g5e6nze%2Csn-4g5edn6k&ms=au%2Crdu&mv=m&mvi=3&pl=29&initcwndbps=1292500&spc=Ul2Sq5r0V1QVi9vcfygTGPURRJ8PQQ8skwCXyeoPNQ&vprv=1&svpuc=1&mime=video%2Fwebm&ns=AFmFcIktdHX9cna63rbNZlMO&gir=yes&clen=2574516&dur=30.000&lmt=1658290311840788&mt=1688991939&fvip=1&keepalive=yes&fexp=24007246%2C24363392&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=7QPBWgREMEgR7Q&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgZoZITws_Cm470ZV1un-paRrlKSPgX0DAvh4E4CZZPnQCICXiVzvmq8bo4wSOgyhjimMW9LnMBy9lg8MCaGK7F35i&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgU5_OdHE8-NlHPeMef33HCEEv9XOpQ8iDvQngRE2IIhgCIAQBifNVLZhjuE4Flr2fYRtT_jpKMEmLHDkM0MSn8FNg&alr=yes&cpn=UXF3vsGQ40IXK3nY&cver=1.20230704.00.00&range=241734-483148&rn=3&rbuf=4117&pot=MmTw5RXYHverS_DdBFA5PtojpLHIgNmzVSzsqkHPn9aiQyAnrSsAggesjub3ECjoPy8-kKFoTE68SUXjfuqyRpWVOhZP4Iib-PS3pc2gzVxY_wccAV6ugF1_osotiY5qDSb1QuIR&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:66::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash fbcab2f49f2260c2e1c3b53edb13b6f528a14714fba193377ae8d3be752dafd4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Mon, 10 Jul 2023 12:29:39 GMT date Mon, 10 Jul 2023 12:29:39 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:51 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21299 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
GET H2	200	AOPolaT1LYYbpOw1hd8FF9JVeudO2dPTqLmFdeR8nFV1=s88-c-k-c0x00ffffff-no-rj yt3.ggpht.com/ytc/ Frame 12A6	5 KB 5 KB	38ms 37ms	Image image/jpeg	2a00:1450:4001:806::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://yt3.ggpht.com/ytc/AOPolaT1LYYbpOw1hd8FF9JVeudO2dPTqLmFdeR8nFV1=s88-c-k-c0x00ffffff-no-rj Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 174c5978e88be3436aae3b820605b7197f73c84141764c902224d973d607da3f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT x-content-type-options nosniff age 0 content-disposition inline;filename="unnamed.jpg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4893 x-xss-protection 0 server fife etag "v65" vary Origin content-type image/jpeg access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Tue, 11 Jul 2023 12:29:39 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame F3B6	0 15 B	23ms 22ms	Document text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.firstgroup-sa.co.za Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Mon, 10 Jul 2023 12:29:39 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
POST H3	200	/ Show response www.facebook.com/tr/ Frame 57C3	0 15 B	23ms 22ms	Document text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.firstgroup-sa.co.za Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Mon, 10 Jul 2023 12:29:39 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
POST H3	200	log_event Show response www.youtube.com/youtubei/v1/ Frame 12A6	28 B 54 B	38ms 35ms	XHR application/json	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software scaffolding on HTTPServer2 / Resource Hash d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 X-Goog-Request-Time 1688992179080 Content-Type application/json X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230704.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgttVjUzZ29lUkJQMCix86-lBg%3D%3D X-YouTube-Ad-Signals dt=1688992178346&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers date Mon, 10 Jul 2023 12:29:39 GMT content-encoding br x-content-type-options nosniff server scaffolding on HTTPServer2 x-frame-options SAMEORIGIN vary Origin, X-Origin, Referer content-type application/json; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31 x-xss-protection 0 expires Mon, 10 Jul 2023 12:29:39 GMT
POST H3	200	videoplayback Show response rr3---sn-4g5e6nze.googlevideo.com/ Frame 12A6	374 B 398 B	63ms 62ms	Fetch application/vnd.yt-ump	2a00:1450:4001:66::8 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr3---sn-4g5e6nze.googlevideo.com/videoplayback?expire=1689013778&ei=svmrZOa5HZP_gAePyr34DQ&ip=2001%3A1b60%3A2%3A240%3A3247%3A%3A7&id=o-AJY8_nBzZzDt3s7DHEZV3YheOV3rfvqQPfMi3xfAouPt&itag=248&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-4g5e6nze%2Csn-4g5edn6k&ms=au%2Crdu&mv=m&mvi=3&pl=29&initcwndbps=1292500&spc=Ul2Sq5r0V1QVi9vcfygTGPURRJ8PQQ8skwCXyeoPNQ&vprv=1&svpuc=1&mime=video%2Fwebm&ns=AFmFcIktdHX9cna63rbNZlMO&gir=yes&clen=7804629&dur=30.000&lmt=1658290312237003&mt=1688991939&fvip=1&keepalive=yes&fexp=24007246%2C24363392&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=7QPBWgREMEgR7Q&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRQIgOGM6IM-K5BAxyqMxzDN_w2gne7iQuf2RKwT5v-lB_5cCIQDyc_Z0pf7c9xiMpiGVszkoR1-ZpJCEgoQZuUVsKnkaiw%3D%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgU5_OdHE8-NlHPeMef33HCEEv9XOpQ8iDvQngRE2IIhgCIAQBifNVLZhjuE4Flr2fYRtT_jpKMEmLHDkM0MSn8FNg&alr=yes&cpn=UXF3vsGQ40IXK3nY&cver=1.20230704.00.00&range=0-318&rn=4&rbuf=0&pot=MmTw5RXYHverS_DdBFA5PtojpLHIgNmzVSzsqkHPn9aiQyAnrSsAggesjub3ECjoPy8-kKFoTE68SUXjfuqyRpWVOhZP4Iib-PS3pc2gzVxY_wccAV6ugF1_osotiY5qDSb1QuIR&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:66::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 8c0ca24d1bf1201449a20ae303c8e0a4fa8fde5ca5f942f3430c0ffef10f0f8c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Mon, 10 Jul 2023 12:29:39 GMT date Mon, 10 Jul 2023 12:29:39 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:52 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21299 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
POST H3	200	videoplayback Show response rr3---sn-4g5e6nze.googlevideo.com/ Frame 12A6	252 KB 252 KB	22ms 22ms	Fetch application/vnd.yt-ump	2a00:1450:4001:66::8 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr3---sn-4g5e6nze.googlevideo.com/videoplayback?expire=1689013778&ei=svmrZOa5HZP_gAePyr34DQ&ip=2001%3A1b60%3A2%3A240%3A3247%3A%3A7&id=o-AJY8_nBzZzDt3s7DHEZV3YheOV3rfvqQPfMi3xfAouPt&itag=244&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-4g5e6nze%2Csn-4g5edn6k&ms=au%2Crdu&mv=m&mvi=3&pl=29&initcwndbps=1292500&spc=Ul2Sq5r0V1QVi9vcfygTGPURRJ8PQQ8skwCXyeoPNQ&vprv=1&svpuc=1&mime=video%2Fwebm&ns=AFmFcIktdHX9cna63rbNZlMO&gir=yes&clen=2574516&dur=30.000&lmt=1658290311840788&mt=1688991939&fvip=1&keepalive=yes&fexp=24007246%2C24363392&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=7QPBWgREMEgR7Q&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgZoZITws_Cm470ZV1un-paRrlKSPgX0DAvh4E4CZZPnQCICXiVzvmq8bo4wSOgyhjimMW9LnMBy9lg8MCaGK7F35i&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgU5_OdHE8-NlHPeMef33HCEEv9XOpQ8iDvQngRE2IIhgCIAQBifNVLZhjuE4Flr2fYRtT_jpKMEmLHDkM0MSn8FNg&alr=yes&cpn=UXF3vsGQ40IXK3nY&cver=1.20230704.00.00&range=483149-741013&rn=5&rbuf=7243&pot=MmTw5RXYHverS_DdBFA5PtojpLHIgNmzVSzsqkHPn9aiQyAnrSsAggesjub3ECjoPy8-kKFoTE68SUXjfuqyRpWVOhZP4Iib-PS3pc2gzVxY_wccAV6ugF1_osotiY5qDSb1QuIR&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:66::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 7294739580c8ec5655fb8853d0804bfd80116adde585ab4952b492ad04cbd716 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Mon, 10 Jul 2023 12:29:39 GMT date Mon, 10 Jul 2023 12:29:39 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:51 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21299 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
GET H3	204	playback Show response www.youtube.com/api/stats/ Frame 12A6	0 17 B	32ms 32ms	XHR text/html	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/api/stats/playback?ns=yt&el=embedded&cpn=UXF3vsGQ40IXK3nY&ver=2&cmt=0.068&fmt=244&fs=0&rt=0.757&euri=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&lact=790&cl=545524056&mos=1&volume=100&cbr=Chrome&cbrver=114.0.5735.198&c=WEB_EMBEDDED_PLAYER&cver=1.20230704.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&autoplay=1&epm=1&delay=4&hl=de_DE&cr=DE&len=30.021&fexp=23983296%2C24004644%2C24007246%2C24080738%2C24135310%2C24208765%2C24219382%2C24255165%2C24362593%2C24362623%2C24364789%2C24366065%2C24366917%2C24380264%2C24383853%2C24415864%2C24416290%2C24439361%2C24501422%2C24691745%2C39324104&rtn=7&afmt=250&size=4800%3A1079&inview=0&muted=1&docid=NIVQmaxs6TE&ei=svmrZOa5HZP_gAePyr34DQ&plid=AAYAISLUK2cDHpkV&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FNIVQmaxs6TE%3Fplaylist%3DNIVQmaxs6TE%26rel%3D0%26autoplay%3D1%26controls%3D0%26showinfo%3D0%26loop%3D1%26mute%3D1&list=TLGGSwT3bhDHDdgxMDA3MjAyMw&of=-_xhI4eL4MjOL53E0nwGhA&vm=CAEQABgEOjJBRmtzQzRyVms2WDd0LVlZZlVRZkZTUHdPajRwUDlKc2pfY2FZMzhFQWdNN1ExMW9sQWJYQVBta0tES2VjZkRnREM2QVpYUjFfT3Y5MERReGU1NjdXOXdwQUViZkoyRWlHT0FwdDdjNVlCdmZPLTRST1hRZ21mVzZFTld0cnlmQTl4aWpmRkNUczJfWWgB Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230704.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgttVjUzZ29lUkJQMCix86-lBg%3D%3D X-YouTube-Ad-Signals dt=1688992178346&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:39 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	204	ptracking Show response www.youtube.com/ Frame 12A6	0 19 B	30ms 29ms	XHR text/html	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/ptracking?html5=1&video_id=NIVQmaxs6TE&cpn=UXF3vsGQ40IXK3nY&ei=svmrZOa5HZP_gAePyr34DQ&ptk=youtube_none&pltype=contentugc Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230704.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgttVjUzZ29lUkJQMCix86-lBg%3D%3D X-YouTube-Ad-Signals dt=1688992178346&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:39 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	videoplayback Show response rr3---sn-4g5e6nze.googlevideo.com/ Frame 12A6	604 KB 604 KB	23ms 23ms	Fetch application/vnd.yt-ump	2a00:1450:4001:66::8 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr3---sn-4g5e6nze.googlevideo.com/videoplayback?expire=1689013778&ei=svmrZOa5HZP_gAePyr34DQ&ip=2001%3A1b60%3A2%3A240%3A3247%3A%3A7&id=o-AJY8_nBzZzDt3s7DHEZV3YheOV3rfvqQPfMi3xfAouPt&itag=244&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-4g5e6nze%2Csn-4g5edn6k&ms=au%2Crdu&mv=m&mvi=3&pl=29&initcwndbps=1292500&spc=Ul2Sq5r0V1QVi9vcfygTGPURRJ8PQQ8skwCXyeoPNQ&vprv=1&svpuc=1&mime=video%2Fwebm&ns=AFmFcIktdHX9cna63rbNZlMO&gir=yes&clen=2574516&dur=30.000&lmt=1658290311840788&mt=1688991939&fvip=1&keepalive=yes&fexp=24007246%2C24363392&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=7QPBWgREMEgR7Q&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgZoZITws_Cm470ZV1un-paRrlKSPgX0DAvh4E4CZZPnQCICXiVzvmq8bo4wSOgyhjimMW9LnMBy9lg8MCaGK7F35i&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgU5_OdHE8-NlHPeMef33HCEEv9XOpQ8iDvQngRE2IIhgCIAQBifNVLZhjuE4Flr2fYRtT_jpKMEmLHDkM0MSn8FNg&alr=yes&cpn=UXF3vsGQ40IXK3nY&cver=1.20230704.00.00&range=741014-1359034&rn=6&rbuf=10190&pot=MmTw5RXYHverS_DdBFA5PtojpLHIgNmzVSzsqkHPn9aiQyAnrSsAggesjub3ECjoPy8-kKFoTE68SUXjfuqyRpWVOhZP4Iib-PS3pc2gzVxY_wccAV6ugF1_osotiY5qDSb1QuIR&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:66::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash bf19a6d01306597f3d11ec6f3609ffeaba2b8f03f1e298759c46258824cccc29 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Mon, 10 Jul 2023 12:29:39 GMT date Mon, 10 Jul 2023 12:29:39 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:51 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21299 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
GET H3	200	calendar.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	491 B 681 B	292ms 290ms	Image image/svg+xml	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/calendar.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 70bf367f8a864b1ffff64191ae85b7f6bd66f5127b7acdaa73db9e4e46c8981a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:13 GMT server cloudflare etag W/"2f714d01df95c551b9ab4b6e5ea28175" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e48d0403b7919ad-FRA x-amz-cf-id HLsWb2IpNT9irTR0sYeCqK6F0AwfrUZfSIY9eSjyofKf2xZUswcqeQ==
GET H3	200	bed.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	1 KB 927 B	269ms 265ms	Image image/svg+xml	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/bed.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash acd49b929d9d8836eb1f57feb264259aaafc6c6a0ba9cfb9b803150f040814f8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 a350f357b825293e306b1b0a2cb490c0.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:32 GMT server cloudflare etag W/"9fda7d9765c377fcb092ef755a545920" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e48d0403b7d19ad-FRA x-amz-cf-id pN5r8_wH1pNcjddAD_6kbjATCDATdkWb-QEk_mzXjfSNiM1SGSrClA==
GET H2	200	first-group-girls-getaway_square.jpg image-tc.galaxy.tf/wijpeg-43eo734m1q34kx0z5q1q4tvsw/	43 KB 44 KB	448ms 443ms	Image image/jpeg	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-43eo734m1q34kx0z5q1q4tvsw/first-group-girls-getaway_square.jpg?crop=320%2C0%2C1280%2C1280&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4be803935fb7a669bbb3c4ef343de5c83b4c55b1b4e1c974bbfdbc2c774264ec Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT x-amz-version-id 04cqhkiPWN1V9FSh0oIogU2Ik45sLNb0 x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 343bfbd831f62ab698056c2ca0efaabc.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop CDG50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 44515 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 01 Aug 2022 08:43:20 GMT server cloudflare etag "20b4166dde6d059c55c3ce363923646a" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d0403b4b993f-FRA x-amz-cf-id egchgjj59owI3nUBtS5_BLso9ui1fsCpPNV7hzT3qFLKYScrkJmCYg==
GET H2	200	first-group-book-early-and-save_square.jpg image-tc.galaxy.tf/wijpeg-15bql94tumbk4we2zprk4d298/	51 KB 52 KB	463ms 459ms	Image image/jpeg	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-15bql94tumbk4we2zprk4d298/first-group-book-early-and-save_square.jpg?crop=360%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2cbb50e7dc8c4e2a322db01d714dbb0b459d59d928d6b9cc9d75924f48dacd24 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT x-amz-version-id s6cnSkBcC3VekKzIYWEysyMmgAcEw9Lo x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 099547a0e052eaf06abe4d508de91bbc.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop CDG50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 52613 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 01 Aug 2022 20:49:05 GMT server cloudflare etag "a5ffbeb89bd9e8c952651cf7d0d661db" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d0403b4c993f-FRA x-amz-cf-id ihBxlK0h3Yo8uKuj-ducIF376PiTetk02Rn6HuF5sw1cwTIYCS9Scg==
GET H2	200	couples-midweek-getaway-at-mst_square.jpg image-tc.galaxy.tf/wijpeg-a96xm37j5z2twqi5wlhf9z049/	77 KB 77 KB	510ms 506ms	Image image/jpeg	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-a96xm37j5z2twqi5wlhf9z049/couples-midweek-getaway-at-mst_square.jpg?crop=390%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0821c698a9c3cfe81b780427d8bc52da508f17648197ae4803205dc1e4d059ab Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT x-amz-version-id IdFA2IbUQ9kiIK3DsJZgjYC77GGjklUZ x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 54ebf0a06ec7306301fb9a98086cc9b0.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop CDG50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 78661 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 22 Aug 2022 07:21:36 GMT server cloudflare etag "39a30a44456efabd8ea99b884f352567" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d0403b4e993f-FRA x-amz-cf-id lMUpz0MsWCD-Pnxk5XUYhcZHep0_ufs0vSmi1i8Jbkl4r87dWY_qBw==
GET H2	200	6784-fg-25-midweek-offer-banner-v1_square.jpg image-tc.galaxy.tf/wijpeg-bk0968vlevzgq53irm5kqs9k1/	62 KB 62 KB	477ms 472ms	Image image/jpeg	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-bk0968vlevzgq53irm5kqs9k1/6784-fg-25-midweek-offer-banner-v1_square.jpg?crop=390%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 681c4645cf2b8830900bbbebf4efe20e9a6efba6d9bc539b2156af681b94937b Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT x-amz-version-id dOOuBI41Nf_unEizFkfecgKf2AiFXjst x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 50bea678ec8eb5af41be54d11f9c4872.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop CDG50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 63506 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Wed, 11 Jan 2023 08:12:10 GMT server cloudflare etag "996ba1213a1c9ff6762b4c430d1cbee5" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d0403b4f993f-FRA x-amz-cf-id H9TiGVnELEDqH2u9y2vC3biKkzuf-zQ3QLNt6x5pPFFkyhtIRp8FzQ==
GET H2	200	6784-fg-30-7-night-offer-banner-v1_square.jpg image-tc.galaxy.tf/wijpeg-9hazeuop3wx77by2zv8acy351/	46 KB 47 KB	478ms 474ms	Image image/jpeg	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-9hazeuop3wx77by2zv8acy351/6784-fg-30-7-night-offer-banner-v1_square.jpg?crop=390%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 906aa2e898f3baf773671b2ff25bf956a3dd17bf48753a345ace276047947bbd Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT x-amz-version-id k99wqaLmhJbz.5LZPfAZvX3HlbYZOwcu x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 834f63af56be39c339db32b1eb931e1a.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop CDG50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 47265 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Wed, 11 Jan 2023 09:50:30 GMT server cloudflare etag "e806d24ffc6ab7c4a938c080dafb7e7d" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d0403b50993f-FRA x-amz-cf-id Sxz99QB7o3D4pIkgmdaX0R2CulsePlYli5r0y43SCHYGy3bH3G8sKw==
GET H2	200	midlands-saddle-trout-couple-s-getaway_square.jpg image-tc.galaxy.tf/wijpeg-c7axu2wrgaltxoe1o311lr40d/	47 KB 47 KB	512ms 508ms	Image image/jpeg	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-c7axu2wrgaltxoe1o311lr40d/midlands-saddle-trout-couple-s-getaway_square.jpg?crop=360%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 63fea1d2fc7525fc77432818b292c2aa54790f3545aeb3604c31d425ca213288 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT x-amz-version-id jMU6_xBnJ7DlV4EGNWbgnuExFU3RCjMr x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 48284 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 01 Aug 2022 19:38:52 GMT server cloudflare etag "3f3744db4dd334b95460dacc5871172d" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d0403b52993f-FRA x-amz-cf-id 4mr9TggaaQzeCJRj80f_iTazlCdy0m4y5-r1oymaqKzPQFFWylxIQQ==
GET H2	200	first-group-coulpe-s-spa-getaway_square.jpg image-tc.galaxy.tf/wijpeg-ce06wsvz7fmur8qopk53090jw/	39 KB 39 KB	505ms 502ms	Image image/jpeg	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-ce06wsvz7fmur8qopk53090jw/first-group-coulpe-s-spa-getaway_square.jpg?crop=360%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e20d0ddf02cdfdd6dc8bac3e8d4405be92caacb961d84b1e25b908297c7f57d Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:39 GMT x-amz-version-id FUCYWaIYAHLWOEnmJSDXu0g6L97XXs10 x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 b78cc6d01d4e7856002e813febd954e2.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop CDG50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 39687 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 01 Aug 2022 15:14:21 GMT server cloudflare etag "c6242d97f3bf1a9ed19b3d091d09db66" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e48d0403b53993f-FRA x-amz-cf-id tWlLjc7LsF4eh9sOnIJ-qH17Eq-c3K9y8UAlH8uZc_uMa7nB0Y2bJA==
POST H3	204	qoe Show response www.youtube.com/api/stats/ Frame 12A6	0 19 B	31ms 30ms	XHR text/html	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/api/stats/qoe?fmt=248&afmt=250&cpn=UXF3vsGQ40IXK3nY&el=embedded&ns=yt&fexp=23983296%2C24004644%2C24007246%2C24080738%2C24135310%2C24208765%2C24219382%2C24255165%2C24362593%2C24362623%2C24364789%2C24366065%2C24366917%2C24380264%2C24383853%2C24415864%2C24416290%2C24439361%2C24501422%2C24691745%2C39324104&cl=545524056&seq=2&docid=NIVQmaxs6TE&ei=svmrZOa5HZP_gAePyr34DQ&event=streamingstats&plid=AAYAISLUK2cDHpkV&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FNIVQmaxs6TE%3Fplaylist%3DNIVQmaxs6TE%26rel%3D0%26autoplay%3D1%26controls%3D0%26showinfo%3D0%26loop%3D1%26mute%3D1&qclc=ChBVWEYzdnNHUTQwSVhLM25ZEAI&embargoed=0&cbr=Chrome&cbrver=114.0.5735.198&c=WEB_EMBEDDED_PLAYER&cver=1.20230704.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&bh=0.656:3.440,0.853:10.190&cmt=0.656:0.010,0.853:0.165&vps=0.656:PL,0.853:PL,0.853:PL&user_intent=0&vfs=0.853:248:248:244:r&view=0.853:4800:1079&bwm=0.853:1373583:1.145&bwe=0.853:570262&bat=0.853:1:1&df=0.853:0 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/x-www-form-urlencoded X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230704.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgttVjUzZ29lUkJQMCix86-lBg%3D%3D X-YouTube-Ad-Signals dt=1688992178346&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Mon, 10 Jul 2023 12:29:39 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 access-control-allow-origin https://www.youtube.com cache-control no-cache, must-revalidate access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	videoplayback Show response rr3---sn-4g5e6nze.googlevideo.com/ Frame 12A6	1 MB 1 MB	78ms 78ms	Fetch application/vnd.yt-ump	2a00:1450:4001:66::8 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr3---sn-4g5e6nze.googlevideo.com/videoplayback?expire=1689013778&ei=svmrZOa5HZP_gAePyr34DQ&ip=2001%3A1b60%3A2%3A240%3A3247%3A%3A7&id=o-AJY8_nBzZzDt3s7DHEZV3YheOV3rfvqQPfMi3xfAouPt&itag=248&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-4g5e6nze%2Csn-4g5edn6k&ms=au%2Crdu&mv=m&mvi=3&pl=29&initcwndbps=1292500&spc=Ul2Sq5r0V1QVi9vcfygTGPURRJ8PQQ8skwCXyeoPNQ&vprv=1&svpuc=1&mime=video%2Fwebm&ns=AFmFcIktdHX9cna63rbNZlMO&gir=yes&clen=7804629&dur=30.000&lmt=1658290312237003&mt=1688991939&fvip=1&keepalive=yes&fexp=24007246%2C24363392&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=7QPBWgREMEgR7Q&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRQIgOGM6IM-K5BAxyqMxzDN_w2gne7iQuf2RKwT5v-lB_5cCIQDyc_Z0pf7c9xiMpiGVszkoR1-ZpJCEgoQZuUVsKnkaiw%3D%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgU5_OdHE8-NlHPeMef33HCEEv9XOpQ8iDvQngRE2IIhgCIAQBifNVLZhjuE4Flr2fYRtT_jpKMEmLHDkM0MSn8FNg&alr=yes&cpn=UXF3vsGQ40IXK3nY&cver=1.20230704.00.00&range=4011919-5519830&rn=7&rbuf=15310&pot=MmTw5RXYHverS_DdBFA5PtojpLHIgNmzVSzsqkHPn9aiQyAnrSsAggesjub3ECjoPy8-kKFoTE68SUXjfuqyRpWVOhZP4Iib-PS3pc2gzVxY_wccAV6ugF1_osotiY5qDSb1QuIR&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:66::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 3e1c4894570ad01ba5bf19ac427fba18b1b5f3cbd09641469528d5a877da11d2 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Mon, 10 Jul 2023 12:29:39 GMT date Mon, 10 Jul 2023 12:29:39 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:52 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21299 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
POST H3	200	/ Show response www.facebook.com/tr/ Frame D844	0 15 B	21ms 20ms	Document text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.firstgroup-sa.co.za Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Mon, 10 Jul 2023 12:29:39 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H3	200	minus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	141 B 549 B	133ms 132ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/minus2.png Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 81ee91b271d16e2cfce70838aae0a41831cc99e8ffa7c070c021e9d803b5b03a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:40 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 d07eabeb1ed60c06da1457f35fb5c8c4.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 141 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:26 GMT server cloudflare etag "46201ff060cf4e3609f7dbad20bf7534" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e48d04498b719ad-FRA x-amz-cf-id IGVXKDMVAj8J738sngi82JtItM5MMs300qlQGYl8929YE0AQt5TxTA==
GET H3	200	plus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	292 B 701 B	150ms 149ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/plus2.png Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dadd2fe93bedffecaca7fed58fd74af66da5fefff858b48cb2d45494236f4d4c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:40 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 292 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:12 GMT server cloudflare etag "81ed7bc1309fce5cd1b0c43e40a61b2d" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e48d04498b819ad-FRA x-amz-cf-id Qg1Fxl36wzU7rSOVBrcuq1oqjzYqpyupGPd_AnzRlH_APFVJqE1CFA==
GET H3	200	adult.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	504 B 705 B	156ms 155ms	Image image/svg+xml	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/adult.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0854d432df5634f3e1bcba1668e56d8de1e0cb55ede3a6bbcee97b463b06df9e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:40 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 df86e917220bc08caa68b0eb8ddabe90.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:13 GMT server cloudflare etag W/"32626b48f6cec679f75b8c37a10e3dbd" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e48d04498b919ad-FRA x-amz-cf-id EZ3C--z5wH0txbYAion7ffFq0kphcdQlWBuRc_QnxJ83vHKSgWggwA==
GET H3	200	default.js Show response onboard.triptease.io/integrations/v6698.79747/	155 KB 49 KB	58ms 57ms	Script application/javascript	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/integrations/v6698.79747/default.js Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2af0155eaf26c8228cb8923b3f87de6dc06274ffab62185002c6e696087f51e2 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:40 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status MISS x-goog-meta-git-hash 8096c686e1383b7ad9d3f574f31c8847a164a238 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-guploader-uploadid ADPycdsyq4tYbfSWryqyDJ9uZuWeTdZlklfMt5PKHn0o4a7NsvGQqIDoxnglMtqwYObDTKulqn8L19F1V2aH87_AMqIPUojuF1B7 x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-meta-build-version 6698.79747 alt-svc h3=":443"; ma=86400 last-modified Mon, 10 Jul 2023 11:31:39 GMT server cloudflare etag W/"f90e236c17468c87549982cee6f5bd8c" vary Accept-Encoding x-goog-generation 1688988699802536 content-type application/javascript; charset=utf-8 access-control-allow-origin * x-goog-hash crc32c=IEjb5Q==, md5=+Q4jbBdGjIdUmYLO5vW9jA== access-control-expose-headers Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace cache-control public, max-age=31536000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2FbZtg%2BskK4PLi0R0FJr663oVDFvGarOP960wZGjkJLbPhshH4MhcXjfp3M70myS4LhcmgXmnbbqQJ78oe%2BcFPklVesMEvRdMZeSXTItZESrqdSI9JmMgIqYTAQP4DWK5I4b40AU%2FYZLpAFPTPLTA7KHKA%3D%3D"}],"group":"cf-nel","max_age":604800} x-goog-stored-content-length 158569 cf-ray 7e48d046180d4da6-FRA expires Tue, 09 Jul 2024 11:33:35 GMT
GET H3	200	minus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	141 B 550 B	129ms 128ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/minus2.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 81ee91b271d16e2cfce70838aae0a41831cc99e8ffa7c070c021e9d803b5b03a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:40 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 d07eabeb1ed60c06da1457f35fb5c8c4.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 141 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:26 GMT server cloudflare etag "46201ff060cf4e3609f7dbad20bf7534" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e48d0464aec19ad-FRA x-amz-cf-id Xeftm30AbgT_dMSrXh02eRiVeKvyvlkDjZJ8ONlshywRCi6iBnKOew==
GET H3	200	plus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	292 B 700 B	106ms 105ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/plus2.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dadd2fe93bedffecaca7fed58fd74af66da5fefff858b48cb2d45494236f4d4c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:40 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 292 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:12 GMT server cloudflare etag "81ed7bc1309fce5cd1b0c43e40a61b2d" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e48d0464aed19ad-FRA x-amz-cf-id KKUFfLSdS0Rp7mNmQ2pTzbtL3aealVQxSVCOE0wL6KH25de1IpXTGA==
GET H3	200	child.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	519 B 721 B	237ms 236ms	Image image/svg+xml	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/child.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1008f86262ea5d3c1d8917291494386829d0bd2869d033c148d9b163099b1635 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:40 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 af0a4579a75789980eb9374096ea1816.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:13 GMT server cloudflare etag W/"67e4895ea6c606c63b4b64b36034c5e0" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e48d0464aef19ad-FRA x-amz-cf-id VndULwNvwXHuU57BTtKdGRxjOBQRaIBIZhyGs_LXY1rUmlhLgJM8SQ==
GET H3	200	minus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	141 B 549 B	143ms 143ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/minus2.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 81ee91b271d16e2cfce70838aae0a41831cc99e8ffa7c070c021e9d803b5b03a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:40 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 d07eabeb1ed60c06da1457f35fb5c8c4.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 141 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:26 GMT server cloudflare etag "46201ff060cf4e3609f7dbad20bf7534" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e48d0471bdc19ad-FRA x-amz-cf-id hNa33dexPZ68hLYGos7Ebif_wEqaiGoxRBx4YF1Qck8QhK8hFbty8Q==
GET H3	200	plus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	292 B 700 B	113ms 112ms	Image image/png	2606:4700::6811:ba3a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/plus2.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:ba3a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dadd2fe93bedffecaca7fed58fd74af66da5fefff858b48cb2d45494236f4d4c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:40 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 292 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:12 GMT server cloudflare etag "81ed7bc1309fce5cd1b0c43e40a61b2d" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e48d048ad9619ad-FRA x-amz-cf-id SiwAtzo4N4rw619VFE5f16A1ZSFDm_h99dIAfMkZIsPnEfnyFZEG3w==
POST H3	200	log_event Show response www.youtube.com/youtubei/v1/ Frame 12A6	28 B 54 B	33ms 33ms	XHR application/json	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/1dda5629/www-embed-player.vflset/www-embed-player.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software scaffolding on HTTPServer2 / Resource Hash d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 X-Goog-Request-Time 1688992181204 Content-Type application/json X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230704.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgttVjUzZ29lUkJQMCix86-lBg%3D%3D X-YouTube-Ad-Signals dt=1688992178279&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers date Mon, 10 Jul 2023 12:29:41 GMT content-encoding br x-content-type-options nosniff server scaffolding on HTTPServer2 x-frame-options SAMEORIGIN vary Origin, X-Origin, Referer content-type application/json; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31 x-xss-protection 0 expires Mon, 10 Jul 2023 12:29:41 GMT
GET H3	200	identity Show response onboard.triptease.io/	161 B 839 B	31ms 31ms	Fetch application/json	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/identity Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b60867eee2fafcf5fb63865680f5198ecb12242ff3417c03913e6a62c7034eaa Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:41 GMT strict-transport-security max-age=15552000 content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FdyGGDE0CzUZBWHk7PbGnuTEW%2F6qgA6Jc2Je2MSFyxN5%2F37JrMpCo%2B3VWL%2BLPerbaV6tso2o6oZpVMGYt%2F3gQQxHr7tobwFil2LcbfI9LjYqe3C9hEuYl4SYOOYNzvPNY8lVL8U9K1MEBCo%2BlAF4LIhTug%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=utf-8 access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-store, no-cache access-control-allow-credentials true cf-ray 7e48d04d8b9c1c9b-FRA alt-svc h3=":443"; ma=86400
GET H3	200	claim Show response onboard.triptease.io/	2 B 558 B	202ms 202ms	Fetch application/json	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/claim?apiKey=d50e117bb1474b8d9a401cbd68d286a9 Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:41 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ohczGlH4jHpmJujWHX7og0PMz8e5PvQD%2BqHxgUMgEHCIo1aHDPoyO3fU4SIYhnzA1MKXDhpZ1HS8kG5S2so29jIGDQqF5KPrX2tkc9a994zwNE7L5Jtfa%2BauXm3jX3%2FtWpS0LCJEIHebsmSxTMnbB3sSbw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=utf-8 access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, max-age=0 access-control-allow-credentials true cf-ray 7e48d04ddc051c9b-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept alt-svc h3=":443"; ma=86400
GET H2	200	bootstrap-message-engine.js Show response targeted-messages.triptease.io/static/	85 KB 30 KB	112ms 35ms	Script application/javascript	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9df48ba65eec9d823816907a7646e55041f9bac1a3b62d2a52e3e99a63063eb6 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:41 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-goog-meta-goog-reserved-file-mtime 1688717634 age 494 x-guploader-uploadid ADPycdt_RaNzOa4MloKWKzKXU6hkPhz5zX8J5NWTLHpILrrKVLcg7_8vFNnwjCQ1u8AkwQ9Bvoq9ya9TQHENOhoxdkKl_3mJw5Cu x-goog-storage-class STANDARD x-goog-metageneration 2 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=86400 last-modified Fri, 07 Jul 2023 08:13:58 GMT server cloudflare etag W/"d9c653d42b3870bc7a45671d00744842" vary Accept-Encoding x-goog-generation 1688717638091593 content-type application/javascript access-control-allow-origin * x-goog-hash crc32c=MqTtEA==, md5=2cZT1Cs4cLx6RWcdAHRIQg== access-control-expose-headers Content-Type cache-control public, max-age=600 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7NU5Xh7O2%2BXTRN5QXaEPLXQPzXwtubGPDFsGNAZRo2dYB3DYaZzJSGrKdBAO55h1hRhH6kR2%2FD5BydlgvMOL0fjUsIRe1%2B5%2F%2FaLyZYVy0XZteygUBpZ2pQlUn5adENA2qfBP%2BHzC3YDX5FrnaeeAFqz6oNSiDFVZgTYpIIA%3D"}],"group":"cf-nel","max_age":604800} x-goog-stored-content-length 87416 cf-ray 7e48d04fac951ad7-FRA expires Mon, 10 Jul 2023 12:26:12 GMT
GET H3	200	storageIframe.html Show response targeted-messages.triptease.io/static/ Frame 89E1	7 KB 4 KB	65ms 34ms	Document text/html	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/storageIframe.html Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44967af7d7413422ff93ef8e795f138ffa16e64d705bf2fcdbb164145e7d651f Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type age 158 alt-svc h3=":443"; ma=86400 cache-control public, max-age=600 cf-cache-status HIT cf-ray 7e48d0503a482c27-FRA content-encoding br content-type text/html date Mon, 10 Jul 2023 12:29:41 GMT expires Mon, 10 Jul 2023 12:28:30 GMT last-modified Thu, 29 Jun 2023 09:56:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KVu5TQ9RsQ3qvxMc0tIx91Q%2BsukarAsQu1dO4SkjJNFBC8%2BeQFBLku%2BXAw7SLbKr5EdKiHxHyxpSh2d%2BoWVYaDwlpANkw9snj5hQeLaUftQq%2BITzKbPi5r8MFDIDvteFWCmMq0l2Y3gY6Sm%2FGo0NY508zhcqQnQjVuyMLGU%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1688032590472706 x-goog-hash crc32c=/G3XxQ== md5=98b+KQq4ov4sQNnkjjyKNw== x-goog-meta-goog-reserved-file-mtime 1688032586 x-goog-metageneration 3 x-goog-storage-class STANDARD x-goog-stored-content-encoding identity x-goog-stored-content-length 7485 x-guploader-uploadid ADPycdsRx4G7OCzgAFMwiIRso4BAFlW33guuvmfe8juhaxKb4Ya4pjpu0fFR6x8Kdlyb0xJfErWRBSnk0qiVavR2L0dd3Q
GET H3	200	storageIframe.html Show response targeted-messages.triptease.io/static/ Frame 42C0	7 KB 4 KB	59ms 32ms	Document text/html	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/storageIframe.html Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44967af7d7413422ff93ef8e795f138ffa16e64d705bf2fcdbb164145e7d651f Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type age 158 alt-svc h3=":443"; ma=86400 cache-control public, max-age=600 cf-cache-status HIT cf-ray 7e48d0503a4a2c27-FRA content-encoding br content-type text/html date Mon, 10 Jul 2023 12:29:41 GMT expires Mon, 10 Jul 2023 12:28:30 GMT last-modified Thu, 29 Jun 2023 09:56:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BC5WGawMj3BJrRlwetuAO71zbTaadgi7%2BfD%2Fjic8%2FTX4tZ3W3Pul9doJE%2Fad1OgSOnHPS83iadGeGc2jFjLjTgBNqQHyxpJLKNr64U7JgZBP3kiZjF5Uh85%2FQELaTYTo6XlY%2BqUPEsd0CeO%2FXe0wcb5IUeuB1LAp3qXjHQ4%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1688032590472706 x-goog-hash crc32c=/G3XxQ== md5=98b+KQq4ov4sQNnkjjyKNw== x-goog-meta-goog-reserved-file-mtime 1688032586 x-goog-metageneration 3 x-goog-storage-class STANDARD x-goog-stored-content-encoding identity x-goog-stored-content-length 7485 x-guploader-uploadid ADPycdsRx4G7OCzgAFMwiIRso4BAFlW33guuvmfe8juhaxKb4Ya4pjpu0fFR6x8Kdlyb0xJfErWRBSnk0qiVavR2L0dd3Q
GET H2	200	messages Show response messages.guest-experience.triptease.io/d50e117bb1474b8d9a401cbd68d286a9/	12 KB 12 KB	313ms 243ms	Fetch application/json	151.101.130.133
General Check archive.org Show headers Download Go to Full URL https://messages.guest-experience.triptease.io/d50e117bb1474b8d9a401cbd68d286a9/messages?language=en Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.130.133 -, , ASN (), Reverse DNS Software Google Frontend / Resource Hash b0d5c37f65b02ce6987bf2133821aae53b09a42db42e7d51c8bf22f7156e4eb6 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:42 GMT via 1.1 varnish age 0 x-cache MISS x-city frielendorf content-length 12198 x-served-by cache-fra-eddf8230128-FRA server Google Frontend vary Origin tt_keys campaigns-d50e117bb1474b8d9a401cbd68d286a9 campaigns-client-FIRSTGROUP access-control-allow-origin https://www.firstgroup-sa.co.za x-region-code HE x-cloud-trace-context d96cc88f03467a5e1618100ff0ef47b1 cache-control public,stale-if-error=600,stale-while-revalidate=10,max-age=600 access-control-allow-credentials true content-type application/json; charset=utf-8 tt_host messages.guest-experience.triptease.io access-control-expose-headers X-Country-Code, X-Region-Code, X-City accept-ranges bytes x-country-code DE x-cache-hits 0
GET H2	200	messages Show response messages.guest-experience.triptease.io/d50e117bb1474b8d9a401cbd68d286a9/	12 KB 12 KB	312ms 242ms	Fetch application/json	151.101.130.133
General Check archive.org Show headers Download Go to Full URL https://messages.guest-experience.triptease.io/d50e117bb1474b8d9a401cbd68d286a9/messages?language=en Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.130.133 -, , ASN (), Reverse DNS Software Google Frontend / Resource Hash b0d5c37f65b02ce6987bf2133821aae53b09a42db42e7d51c8bf22f7156e4eb6 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 12:29:42 GMT via 1.1 varnish age 0 x-cache HIT x-city frielendorf content-length 12198 x-served-by cache-fra-eddf8230128-FRA server Google Frontend vary Origin tt_keys campaigns-d50e117bb1474b8d9a401cbd68d286a9 campaigns-client-FIRSTGROUP access-control-allow-origin https://www.firstgroup-sa.co.za x-region-code HE x-cloud-trace-context d96cc88f03467a5e1618100ff0ef47b1 cache-control public,stale-if-error=600,stale-while-revalidate=10,max-age=600 access-control-allow-credentials true content-type application/json; charset=utf-8 tt_host messages.guest-experience.triptease.io access-control-expose-headers X-Country-Code, X-Region-Code, X-City accept-ranges bytes x-country-code DE x-cache-hits 1
POST H3	204	batch onboard.triptease.io/message/	0 474 B	183ms 183ms	Ping text/html	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/message/batch Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Mon, 10 Jul 2023 12:29:42 GMT strict-transport-security max-age=15552000 cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1lG8yMjwferD2n8yLYsfm8wrEJJJCOhajwrPYpYjsBJXbZtDs9fFzmgqDSjdkHY4udmZGhHlOJgmTTV6zgl2UsIYVq3%2FMRl999iaOKWWoZtnR2i2ygdAzdfjfXpFXL%2F2QLI0rgvRyvBZADxmiR1lIlTboA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html access-control-allow-origin * x-cloud-trace-context b19aaf442d670c2f1486598e27df58e6 cf-ray 7e48d050eff41c9b-FRA alt-svc h3=":443"; ma=86400
POST		event api.triptease.io/zappy/	0 0
POST		event api.triptease.io/zappy/	0 0
POST		event api.triptease.io/zappy/	0 0
GET H3	200	emailcapture.html targeted-messages.triptease.io/static/ Frame C68C	351 KB 114 KB	79ms 79ms	Document text/html	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/emailcapture.html Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type alt-svc h3=":443"; ma=86400 cache-control public, max-age=600 cf-cache-status REVALIDATED cf-ray 7e48d0529d312c27-FRA content-encoding br content-type text/html date Mon, 10 Jul 2023 12:29:42 GMT expires Mon, 10 Jul 2023 12:34:15 GMT last-modified Thu, 29 Jun 2023 09:56:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=emkaouDXDToa%2BkSbpEKfnJVEdFbXVgNnlgFlPZ2qUFwXZUwXC%2FwOc%2FN7%2Fk6%2BjKhaQsxVWwDFNSbB2fzjg4yZ9cJvfCnL%2FhFmVpeVNozf2bN0VDOA1Cc7DUpydV50qVZCBaTTsh9F0yC0ku7YpnkU4KdhVMB0jKXWjcfwDQw%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1688032590339130 x-goog-hash crc32c=JTlTJA== md5=p2A0y7IZwZgMeB19istOlg== x-goog-meta-goog-reserved-file-mtime 1688032586 x-goog-metageneration 3 x-goog-storage-class STANDARD x-goog-stored-content-encoding identity x-goog-stored-content-length 359446 x-guploader-uploadid ADPycdtyHgF_lUCQ4RswIhzcCCBZcOqciCYYh_JO2rx6RqmmIsWf1QKacoEdt4okArq5Tu6e6ltuKRRqwcuJSmgJrR0j8w
GET H3	200	emailcapture.html targeted-messages.triptease.io/static/ Frame FB57	351 KB 114 KB	39ms 39ms	Document text/html	2606:4700:3034::6815:1478 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/emailcapture.html Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type age 0 alt-svc h3=":443"; ma=86400 cache-control public, max-age=600 cf-cache-status HIT cf-ray 7e48d0529d332c27-FRA content-encoding br content-type text/html date Mon, 10 Jul 2023 12:29:42 GMT expires Mon, 10 Jul 2023 12:34:15 GMT last-modified Thu, 29 Jun 2023 09:56:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hx6LHKkETXuFnLWnRdBdRAPQ3hPCtuHChYZkhv2WIaNHyUeanqyB%2FBaxQlQjbNGiC4pAFs1EHPqr8Ko1ol9kgmcyavvw%2FRhKyxjccf%2FehyuNAZhigl9CH4jfK%2Fc17YcfuELoESG37Mt5l%2FkkyKCHvejfu7VNjGQLoOmSENs%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1688032590339130 x-goog-hash crc32c=JTlTJA== md5=p2A0y7IZwZgMeB19istOlg== x-goog-meta-goog-reserved-file-mtime 1688032586 x-goog-metageneration 3 x-goog-storage-class STANDARD x-goog-stored-content-encoding identity x-goog-stored-content-length 359446 x-guploader-uploadid ADPycdtyHgF_lUCQ4RswIhzcCCBZcOqciCYYh_JO2rx6RqmmIsWf1QKacoEdt4okArq5Tu6e6ltuKRRqwcuJSmgJrR0j8w

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.youtube.com

URL

https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1

Domain

www.youtube.com

URL

https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1

Domain

www.youtube.com

URL

https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1

Domain

api.triptease.io

URL

https://api.triptease.io/zappy/event?eventName=propensityToConvert&eventAppName=messageEngine

Domain

api.triptease.io

URL

https://api.triptease.io/zappy/event?eventName=propensityToConvert&eventAppName=messageEngine

Domain

api.triptease.io

URL

https://api.triptease.io/zappy/event?eventName=messageAvailable