www.cheapflights.co.il Open in urlscan Pro
3.161.82.9 Public Scan

Software

Google Tag Manager /

Resource Hash

deeced3c488326e8d7103de1eb3782d23c95539aea29ccaad5289a697866abcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 05 Oct 2024 08:28:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 05 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 88030
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 widget.js Show response
cdn.userway.org/ 2 KB
2 KB 350ms
113ms Script
application/javascript 212.102.56.178
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widget.js
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.56.178 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 245149724.fra.cdn77.com
Software: CDN77-Turbo /
Resource Hash: 7c77e5cb8b01ba2858ac5c43fb9e40408c6298d7ec2fcef3e30aa97f423a437a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

access-control-max-age: 3000
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
content-encoding: gzip
etag: W/"4a7ff06ae2a7042e6e7f25cfd6b46190"
age: 325
x-77-cache: HIT
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
x-cache: HIT
x-amz-cf-id: U1zDjBJPQ8skpmm7SEMadrg73jZ80PqhAzDN7Ri5TL7PrsDvdnM9Jw==
date: Sat, 05 Oct 2024 08:28:26 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 11:04:45 GMT
vary: Accept-Encoding
x-age: 972
x-77-nzt-ray: 1cb09c0e329991e0aaf80067638b412d
x-77-nzt: EgwB1GY4sQH3zAMAAAwBw7WvAgG3CgAAAA
cache-control: max-age=3600, public
via: 1.1 577d8c1d3279d6a0f53cebe01ead8c6e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-77-pop: frankfurtDE
x-accel-date-max: 1728039989
x-77-age: 972
x-amz-cf-pop: FRA56-P10
x-accel-date: 1728115934
server: CDN77-Turbo
x-accel-expires: @1728119534
x-amz-server-side-encryption: AES256

GET
H2 200 bundle.js Show response
www.cheapflights.co.il/ 2 MB
520 KB 414ms
412ms Script
application/javascript 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cheapflights.co.il/bundle.js
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 91ce6ccee5a70c72a5d4a89f32222405317069f888e363187a0d0efb47423eff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
content-encoding: gzip
etag: W/"1ef1d2-18680bc8c5f"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
x-amz-cf-id: RLD3ufziRRGKjX9EzZj2B7vnFA88-v5i_UDZDjPDlZ4-5WByJduLYw==
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/javascript
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT
vary: Accept-Encoding

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
51 KB 358ms
132ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca6ce42b1d502b0ab32b6d2a048425903e05742153e64f40f4275c9573d70a97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: br
etag: 512759456524159050
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 08:28:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52642
x-xss-protection: 0
server: cafe

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 309 KB
102 KB 463ms
230ms Script
application/javascript 142.250.184.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-P3QG6MT

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

442857a07ea3eecc632525379b8a8288bc9684de4e3726a53aae8a8cb905004d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Sat, 05 Oct 2024 08:28:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 05 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 103936
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 prum.min.js Show response
rum-static.pingdom.net/ 6 KB
3 KB 354ms
119ms Script
application/javascript 104.22.54.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-static.pingdom.net/prum.min.js
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.54.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d5cfe14d65accc4bd1df0d7c3bb65be70d0f4e94a5f9d40465343a2807548ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

cache-control: max-age=43200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"63490025-1849"
age: 6923
cf-ray: 8cdc09cd789cdc56-FRA
access-control-allow-origin: *
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 14 Oct 2022 06:22:29 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 226 KB
58 KB 225ms
111ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

48ba1993011db4834882d81b2153753437607292f704a6543d4466c0f6d1372a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=110, rtx=0, c=23, mss=1232, tbw=4468, tp=10, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: zd29YpOkp03Rus4REGpjwlq0vikCGt+8nvZZlCEvsKcwrJwJUvfw9GIydxsrRxaFbKfCifOMVZoAA5fbI//ONw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59131
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H3 200 xfbml.customerchat.js Show response
connect.facebook.net/he_IL/sdk/ 305 KB
86 KB 335ms
221ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/he_IL/sdk/xfbml.customerchat.js

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

39c0352f0b5975d82ff50807116f30ada7a5f17a83d5e692f7769c3cedc03ddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-md5: kXlT1fz4Ux7BK0fI6+AVlg==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "6c1706737c76781a2cceb77d3608ebed"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 08:48:26 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=1200s
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: adf2a89786876d8aa23fe0b00b2f467e
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=110, rtx=0, c=23, mss=1232, tbw=32708, tp=33, tpl=0, uplat=1, ullat=-1
x-fb-debug: LELf8VtaA4nDWmalCqiHCTsT6/GEz0vXbMKZfQIFhCCvbJjnyYsGze46oNpIHi3940OHmScsy17VBNESduPhsA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 88212

GET
H3 200 1990247907964527 Show response
connect.facebook.net/signals/config/ 76 KB
15 KB 217ms
217ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1990247907964527?v=2.9.170&r=stable&domain=www.cheapflights.co.il&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C82%2C87%2C47%2C46%2C86%2C37%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1e8509c30348596c459df1d0a1f0341400b2a5023c1e53b8028847fcc2f7b253

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=110, rtx=0, c=147, mss=1232, tbw=157780, tp=138, tpl=0, uplat=105, ullat=0
pragma: public
x-fb-debug: INRE6mIvCRq9lsOb1YJX7livPF+jhPiZ5CPArPMgkxRMpfnVVkiu4eEx1pKKu0CZgyrL8mskoiFhCT7PzYWsDg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/ 409 KB
136 KB 142ms
141ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

860ea045b1e1600cb423b19b463e85aba037ea32207c4f65621c20a604e09613

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: br
etag: 10770103728623752163
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 08:28:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 139482
x-xss-protection: 0
server: cafe

GET
H2 200 widget_app_base_1728039683734.js Show response
cdn.userway.org/widgetapp/2024-10-04-11-01-23/ 126 KB
40 KB 403ms
177ms Script
application/javascript 212.102.56.178
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-10-04-11-01-23/widget_app_base_1728039683734.js
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.56.178 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 245149724.fra.cdn77.com
Software: CDN77-Turbo /
Resource Hash: 6c8345bec57f9a7f21049f365f7699cc84bbe716af1f4a81c4f57244f378bf16

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cheapflights.co.il
Referer: https://www.cheapflights.co.il/

Response headers

access-control-max-age: 3000
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
content-encoding: gzip
etag: W/"c96020aa43c01c691962e28df8360d57"
age: 325
x-77-cache: HIT
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
x-cache: HIT
x-amz-cf-id: 97gcdNWBg0JV9agmAzfAKd3CPJo72dyuxJH3U6D8g-nqXYJFcdeemQ==
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 11:04:32 GMT
vary: Accept-Encoding
x-age: 76583
x-77-nzt-ray: 1cb09c0efd926602abf80067fe00a924
x-77-nzt: EgwB1GY4sQH3JysBAAwBJRPCMQG3CgAAAA
cache-control: max-age=25920000, public
via: 1.1 54458302557dcee9766f255184a02288.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-77-pop: frankfurtDE
x-accel-date-max: 1728039990
x-77-age: 76583
x-amz-cf-pop: FRA56-P10
x-accel-date: 1728040324
server: CDN77-Turbo
x-accel-expires: @1753960314
x-amz-server-side-encryption: AES256

GET /
www.facebook.com/plugins/customer_chat/SDK/ 0
0

GET /
www.facebook.com/plugins/customer_chat/facade/ 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 247 KB
87 KB 129ms
127ms Script
application/javascript 142.250.184.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-859083998&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-866394527

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f206.1e100.net

Software

Google Tag Manager /

Resource Hash

cacb9c1e6fe3a43ee2a0afbe07d00ab626da599897120eba805fa9196cb0f2eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 05 Oct 2024 08:28:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 05 Oct 2024 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89344
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 351ms
113ms Script
text/javascript 172.217.16.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P3QG6MT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: gzip
age: 3499
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 09:30:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 07:30:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 hotjar-664604.js Show response
static.hotjar.com/c/ 13 KB
5 KB 385ms
151ms Script
application/javascript 18.66.102.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-664604.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P3QG6MT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.106 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-106.fra56.r.cloudfront.net

Software

Resource Hash

828ce325694c4475684cb00d4cfe109a21005d8b2011f9021cf43c535ff85680

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=60
content-encoding: br
etag: W/e39559e37cb90c8b571193f3275877aa
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
x-cache-hit: 1
via: 1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-cf-id: qixmm8nBtc37Ygil1vRlyLt9rKkg849NCxfF5YkAVkiT0GTrEec0Mg==
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-pop: FRA56-P2

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1223218/ 71 KB
22 KB 403ms
198ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1223218/tfa.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P3QG6MT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1cf65e6f320545d3724f55f21eff55f3eb060ae1e8ddd95c810f3d58c4b28d58

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: gzip
etag: "37ca9f1117cb1d9c8f09982b25ce955e"
x-amz-version-id: FDXGBIRScSpVZGRAN_cZ5eRscUGNgItz
age: 0
x-cache: HIT
date: Sat, 05 Oct 2024 08:28:27 GMT
last-modified: Sun, 29 Sep 2024 11:07:37 GMT
x-served-by: cache-mrs10539-MRS
x-cache-hits: 0
content-type: application/javascript; charset=utf-8
x-amz-id-2: 3A0rmJUhRo7TdBSVz7FwXkyx4/kTrcHFtpUV16hL6eTNzA/p/WdfvTWQPVinLFW0G280r6KciXc=
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
cache-control: private,max-age=14401
x-timer: S1728116908.675244,VS0,VE101
via: 1.1 varnish
x-amz-request-id: DSSSXZWWFWFHYWXE
accept-ranges: bytes
access-control-allow-origin: *
abp: 58
content-length: 21997
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 pixel.js Show response
cdn.popt.in/ 228 KB
52 KB 259ms
130ms Script
application/javascript 172.67.166.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.popt.in/pixel.js?id=e4cfd654ecfda
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P3QG6MT
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.166.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d70ca063e74794c815071ccfb049724e710670831daec887b7d5b826aabf5083

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: gzip
cf-cache-status: HIT
x-amz-version-id: RdqryHliXAfM.w0bfWZRNcT2yLV.C8bU
etag: W/"98338421705b118a0d4f18ddab07a38e"
age: 5809
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JdDxPSNvVidlw%2FhNmRYKSteAgl65g%2FBqdWsWPrunts%2BGo23oR6gPZ%2Br7f15do8IGQeIW6JPARsXnY0YLQk3RrXbcK3VsJ8BgJclpcAZ8bHT9IcttGaIelJV2WdJIGw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-cache: Hit from cloudfront
x-amz-cf-id: z_xdP_a56HXy9LMT8b5vj0Qp1EM0kQam1wMAAGHoC2rSis7RPJsUmg==
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 06:51:05 GMT
vary: Accept-Encoding
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 b81e506afc0d8b7cd6094e636331ca78.cloudfront.net (CloudFront)
cf-ray: 8cdc09d08c55d380-FRA
x-amz-cf-pop: FRA56-P8
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 142543372998767 Show response
connect.facebook.net/signals/config/ 25 KB
3 KB 177ms
176ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/142543372998767?v=2.9.170&r=stable&domain=www.cheapflights.co.il&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C82%2C87%2C47%2C46%2C86%2C37%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112%2C199%2C198%2C200%2C205%2C206%2C207%2C203%2C195%2C131%2C133%2C162%2C194%2C196%2C121%2C156%2C144%2C150%2C188%2C189%2C128%2C231%2C115%2C125%2C126%2C232%2C164%2C118%2C234%2C165%2C135%2C122%2C153%2C147%2C113%2C127

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

839a241e966611c301de17d6fc3df8b908a76b37d35ae130d37dbf3c7d735623

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=110, rtx=0, c=160, mss=1232, tbw=173460, tp=152, tpl=0, uplat=62, ullat=0
pragma: public
x-fb-debug: kN77Iq//ovw9S1GQE/JB6nZlQuTx8TmwQK3DuNqXcxeYqIOIuaJ4BS4RN7ENHYZ5RFTIXmU0WMzTaTcwFnpcSg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 /
www.facebook.com/tr/ 0
269 B 330ms
111ms Image
text/plain 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1990247907964527&ev=PageView&dl=https%3A%2F%2Fwww.cheapflights.co.il%2F&rl=&if=false&ts=1728116907522&sw=1600&sh=1200&v=2.9.170&r=stable&ec=0&o=4126&fbp=fb.2.1728116907521.376792518968027154&cs_est=true&ler=empty&cdl=API_unavailable&it=1728116907287&coo=false&rqm=GET

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=10, mss=1380, tbw=2937, tp=-1, tpl=-1, uplat=0, ullat=1
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 493ms
274ms Image
image/png 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1990247907964527&ev=PageView&dl=https%3A%2F%2Fwww.cheapflights.co.il%2F&rl=&if=false&ts=1728116907522&sw=1600&sh=1200&v=2.9.170&r=stable&ec=0&o=4126&fbp=fb.2.1728116907521.376792518968027154&cs_est=true&ler=empty&cdl=API_unavailable&it=1728116907287&coo=false&rqm=FGET

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7422205600384289687"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: zFBws5VRV6FLqjnKAMeqmXZqxdqPm7zEwgJZEmoR1JbZbtrGxlsaGm8YOHKhtPouiEiR6rl8phfTkNUKwKGmgg==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7422205600384289687", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=10, mss=1380, tbw=3348, tp=-1, tpl=-1, uplat=158, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/859083998/ 6 KB
2 KB 374ms
142ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/859083998/?random=1728116907551&cv=11&fst=1728116907551&bg=ffffff&guid=ON&async=1&gtm=45be4a20v9193855583za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101533421~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cheapflights.co.il%2F&hn=www.googleadservices.com&frm=0&tiba=%D7%9E%D7%A9%D7%95%D7%95%D7%99%D7%9D%20%D7%9E%D7%97%D7%99%D7%A8%D7%99%20%D7%98%D7%99%D7%A1%D7%95%D7%AA%20%D7%91%D7%99%D7%9F%20%D7%94%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%D7%94%D7%9E%D7%95%D7%91%D7%99%D7%9C%D7%99%D7%9D%20%D7%91%D7%90%D7%A8%D7%A5%20%D7%95%D7%91&npa=0&pscdl=noapi&auid=959159119.1728116908&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-859083998&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b940d91d3cffff86728f44e953fd243d0c25575d855b960094b7931c2d1dba71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2391
date: Sat, 05 Oct 2024 08:28:27 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 859083998
td.doubleclick.net/td/rul/ Frame 8AC2 0
0 486ms
250ms Document
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/859083998?random=1728116907551&cv=11&fst=1728116907551&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a20v9193855583za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101533421~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cheapflights.co.il%2F&hn=www.googleadservices.com&frm=0&tiba=%D7%9E%D7%A9%D7%95%D7%95%D7%99%D7%9D%20%D7%9E%D7%97%D7%99%D7%A8%D7%99%20%D7%98%D7%99%D7%A1%D7%95%D7%AA%20%D7%91%D7%99%D7%9F%20%D7%94%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%D7%94%D7%9E%D7%95%D7%91%D7%99%D7%9C%D7%99%D7%9D%20%D7%91%D7%90%D7%A8%D7%A5%20%D7%95%D7%91&npa=0&pscdl=noapi&auid=959159119.1728116908&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-859083998&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cheapflights.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 1350
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Oct 2024 08:28:27 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html
googleads.g.doubleclick.net/pagead/html/r20241001/r20190131/ Frame F424 0
0 336ms
112ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20241001/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cheapflights.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

age: 60521
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4121
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 04 Oct 2024 15:39:46 GMT
etag: 13108003645644964576
expires: Fri, 18 Oct 2024 15:39:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame 740F 0
0 884ms
678ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9068148265549322&output=html&adk=1812271804&adf=3025194257&abgtt=3&lmt=1677196971&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fwww.cheapflights.co.il%2F&pra=5&wgl=1&aihb=0&asro=0&ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33&aifxl=29_18~30_19&aiixl=29_5~30_6&aslmct=0.7&asamct=0.7&aiict=1&aifgd=1&aipaq=1&aipecl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1728116907328&bpp=2&bdt=866&idt=307&shv=r20241001&mjsv=m202410010101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=6706322214125&frm=20&pv=2&u_tz=180&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31087658%2C95331832%2C95343329%2C95343454%2C95335247&oid=2&pvsid=1718065797954528&tmod=2126008786&uas=0&nvt=1&fsapi=1&fc=1920&brdim=10%2C10%2C10%2C10%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=341

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cheapflights.co.il/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 48182
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Oct 2024 08:28:28 GMT
expires: Sat, 05 Oct 2024 08:28:28 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 /
www.facebook.com/tr/ 0
98 B 140ms
112ms Image
text/plain 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=142543372998767&ev=PageView&dl=https%3A%2F%2Fwww.cheapflights.co.il%2F&rl=&if=false&ts=1728116907714&sw=1600&sh=1200&v=2.9.170&r=stable&ec=0&o=4126&fbp=fb.2.1728116907521.376792518968027154&ler=empty&cdl=API_unavailable&it=1728116907287&coo=false&rqm=GET

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=10, mss=1380, tbw=2937, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
903 B 420ms
393ms Image
image/png 157.240.0.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=142543372998767&ev=PageView&dl=https%3A%2F%2Fwww.cheapflights.co.il%2F&rl=&if=false&ts=1728116907714&sw=1600&sh=1200&v=2.9.170&r=stable&ec=0&o=4126&fbp=fb.2.1728116907521.376792518968027154&ler=empty&cdl=API_unavailable&it=1728116907287&coo=false&rqm=FGET

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

fra16s56-in-f10.1e100.net

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7422205600705977026"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: eVDaEcOcSstsUQQjsU/X/RH4S0H2uAgdNlmC4eHg+IkNwCBlXVGY1bHHKI+KJHcLw1jMa224v3BMvDrT95Dbbg==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7422205600705977026", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=10, mss=1380, tbw=6571, tp=-1, tpl=-1, uplat=282, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 css
fonts.googleapis.com/ 17 KB
2 KB 131ms
130ms Stylesheet
text/css 142.250.181.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

851699a18b631a7bd68efc99598701293a6065b463fced7b68d8d6d9227bd8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 08:28:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:27 GMT
content-type: text/css; charset=utf-8
last-modified: Sat, 05 Oct 2024 07:56:02 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 c47e9449e2343f15c6a268466396c5b9.jpg
www.cheapflights.co.il/ 58 KB
58 KB 249ms
248ms Image
image/jpeg 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/c47e9449e2343f15c6a268466396c5b9.jpg
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 647dcb87ff6b7b4ef0a66944ea1a873b9d10ad33603e87ed778000ccbd41d468

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"e805-18680bc8bc7"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 59397
x-amz-cf-id: oUZ2ytEajnnxY17OgqA-NQ_qgFYOzMFPGXyMkDqPXI2_3dCGaGDKSQ==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/jpeg
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 50433b989f7aeaa90e502a8df00b82e2.png
www.cheapflights.co.il/ 8 KB
9 KB 261ms
260ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/50433b989f7aeaa90e502a8df00b82e2.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: c3d31c707fce0e1c9ce3a8acc31c44242d66e460d5388db6c5aeca2c66187338

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"213d-18680bc8bdf"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 8509
x-amz-cf-id: qR3AnU7_Dte7bHoIeIK9CsUmJsKp81UFljK9hBYWD9_X237lmgLh2A==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 1a5488d8932dc4b13b070e57cc2af7ff.png
www.cheapflights.co.il/ 329 B
681 B 511ms
510ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/1a5488d8932dc4b13b070e57cc2af7ff.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: e38f403474c1b5ce4eded714d80798c41072452260d335e4819dd21d6a5c1c64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"149-18680bc8bc7"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 329
x-amz-cf-id: T571r9UwWdS_SzFtLd1VAuMm8bIQpFrs7IsH8Irpwf2tFTDuAT-lSA==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H3 200 NGSpv5_NC0k9P_v6ZUCbLRAHxK1EiSysdUmm.woff2
fonts.gstatic.com/s/heebo/v26/ 12 KB
12 KB 244ms
119ms Font
font/woff2 172.217.16.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/heebo/v26/NGSpv5_NC0k9P_v6ZUCbLRAHxK1EiSysdUmm.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Heebo&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f195.1e100.net

Software

sffe /

Resource Hash

817307e05a08a0afbf07b07e0df3ea78f461687e07cb8c3c8fa33123afb3bfd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cheapflights.co.il
Referer: https://fonts.googleapis.com/

Response headers

age: 10823
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 05 Oct 2025 05:28:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 05:28:05 GMT
last-modified: Wed, 31 Jan 2024 23:13:04 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11988
x-xss-protection: 0
server: sffe

GET
H2 200 25cdc28eec6c514ca33d36a0a7bf69d2.png
www.cheapflights.co.il/ 493 B
845 B 415ms
414ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/25cdc28eec6c514ca33d36a0a7bf69d2.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 7b3b27830d6f455163550283d70857207d6fe09a57fd6ed66cf234e03ed0133a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"1ed-18680bc8bc7"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 493
x-amz-cf-id: z5QPMhfolD11rC8lvk6rOu0-rmCL9yiyiFtnMCl_eLUDLWlaOrX2sQ==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 f46c9fb342803533c84bfd324e777f67.png
www.cheapflights.co.il/ 167 B
520 B 431ms
431ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/f46c9fb342803533c84bfd324e777f67.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: dd471fb47e8ef1b1c58262b4925eb730740797eaa26d03882e9259d6e3e2d90c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"a7-18680bc8bef"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 167
x-amz-cf-id: Qr_JYdpmAQXJD4MxzGk4-oe_BYLAfyBSQC1yk8bTjvD8PEiyyHtGvA==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 ce98d1f09abe86f0475e834a78c49e2c.png
www.cheapflights.co.il/ 47 KB
47 KB 414ms
414ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/ce98d1f09abe86f0475e834a78c49e2c.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 29ffe756116673123c384d4ab03dc237b540bbc96c18da6935eb9d12a282c1cb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"bbc3-18680bc8bc7"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 48067
x-amz-cf-id: hA4NQTdo-hs5PRtT5ONAwsZa_IMe4KrfPwGY2YeEdiVzKYNwzdIiKA==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 0306f8b603d8a667d9990cc25b4e1f57.png
www.cheapflights.co.il/ 4 KB
5 KB 429ms
429ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/0306f8b603d8a667d9990cc25b4e1f57.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 64fc9bd04a7af2ac8c6586d4c556871bc1cbe67d79a4d52135f270da85489b2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"10cb-18680bc8bdf"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 4299
x-amz-cf-id: Gt6ogn1yawjVrOsEp-8ZarQrDI9mtWOHr84kOYmfcH2Dz0TNTmBC0A==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 5f6d4922d3bfffbcc4266ef45a5f2448.png
www.cheapflights.co.il/ 2 KB
2 KB 442ms
442ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/5f6d4922d3bfffbcc4266ef45a5f2448.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 73d7fe705ceda062fef5e3b7587bf47b24edc13966d337a39de2f3e493b2a6f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"7f2-18680bc8bdf"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 2034
x-amz-cf-id: xUuy88QKs8e0B3YGmBac2UcLNJRIytUtXxedE4OPjCbpHSztazCpUA==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 4c14f35121407fe879d1ea75d60bdea5.png
www.cheapflights.co.il/ 4 KB
5 KB 538ms
538ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/4c14f35121407fe879d1ea75d60bdea5.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 48124882bd8183cd8d7d3fbfa1e0b45dc6dacd060f16f3e14097afd5415601b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"110f-18680bc8bdf"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 4367
x-amz-cf-id: 8cuVnkRbvtqs4BSRgYhp5NCz0clkBMOoMQryrE03mp_I65F79YhkgQ==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 cdae09252103d849df03e98edd1c9b9c.png
www.cheapflights.co.il/ 4 KB
4 KB 432ms
432ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/cdae09252103d849df03e98edd1c9b9c.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: d1004d45d0ec9641488a67c4c96eb3d356f498810fd1562f19a9dbb52b8bff1a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.cheapflights.co.il/

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"1065-18680bc8bdf"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 4197
x-amz-cf-id: tAKDs3v-NzqmfJz6rpgUfbLjdopyLCn_gTD23xYaNZKVF_Ib3BFuQw==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H3 200 NGSpv5_NC0k9P_v6ZUCbLRAHxK1EiSysd0mm_00.woff2
fonts.gstatic.com/s/heebo/v26/ 5 KB
5 KB 240ms
116ms Font
font/woff2 172.217.16.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/heebo/v26/NGSpv5_NC0k9P_v6ZUCbLRAHxK1EiSysd0mm_00.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Heebo&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f195.1e100.net

Software

sffe /

Resource Hash

da4bcf3bb086e7b2eef8834433fc1baefd203ee5954fcf6822a40820b34c2c01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cheapflights.co.il
Referer: https://fonts.googleapis.com/

Response headers

age: 123466
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 03 Oct 2025 22:10:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 22:10:42 GMT
last-modified: Wed, 31 Jan 2024 23:11:34 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4980
x-xss-protection: 0
server: sffe

GET
H2 200 getLocationData Show response
www.cheapflights.co.il/ 144 B
433 B 471ms
471ms XHR
application/json 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cheapflights.co.il/getLocationData?value=TLV&siteBrand=flightsIL&locationType=airport
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 5e169db68bbcffbb5b1463d3ab065fa821955416756a0423bbaf91f19563aad4

Request headers

Referer: https://www.cheapflights.co.il/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

content-encoding: gzip
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
x-amz-cf-id: MZDzqehoUNFm20li6M6ZcpYCjoZbNQhtSuYneDAg2cD-RwHpMszDAQ==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/json
x-powered-by: Express
server: nginx/1.14.1
x-amz-cf-pop: FRA56-P10
vary: Accept-Encoding

GET
H2 200 getLocationData Show response
www.cheapflights.co.il/ 144 B
422 B 614ms
142ms XHR
application/json 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cheapflights.co.il/getLocationData?value=TLV&siteBrand=flightsIL&locationType=airport
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 5e169db68bbcffbb5b1463d3ab065fa821955416756a0423bbaf91f19563aad4

Request headers

Referer: https://www.cheapflights.co.il/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

content-encoding: gzip
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: dPsmwWy-afbaogtLgtYMgnMo9BBJEdCv97RHLlMxaAcY1jQwrSM3xg==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/json
x-powered-by: Express
server: nginx/1.14.1
x-amz-cf-pop: FRA56-P10
vary: Accept-Encoding

GET
H2 200 getLocationData Show response
www.cheapflights.co.il/ 144 B
423 B 763ms
147ms XHR
application/json 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cheapflights.co.il/getLocationData?value=TLV&siteBrand=flightsIL&locationType=airport
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 5e169db68bbcffbb5b1463d3ab065fa821955416756a0423bbaf91f19563aad4

Request headers

Referer: https://www.cheapflights.co.il/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

content-encoding: gzip
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: zuOEH_mEogiKkpsQWZsH6vB16L8dpS3_-y9yIGxPx0jFQFU-zc2jPg==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/json
x-powered-by: Express
server: nginx/1.14.1
x-amz-cf-pop: FRA56-P10
vary: Accept-Encoding

GET
H3 200 fuckadblock.min.js Show response
cdnjs.cloudflare.com/ajax/libs/fuckadblock/3.2.1/ 5 KB
2 KB 234ms
121ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/fuckadblock/3.2.1/fuckadblock.min.js

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/bundle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c63c0a518fcd8243e365904eb4ec5162d2b6d066aa4f05027fb598089d73ebdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cheapflights.co.il
Referer

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e6b-1285"
age: 190855
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=64X2PIGOt1sgLfWRhkV122ANnOg5KjQ0m73%2BLfI4khNMaA2edCxxPrYYY91UnP377ivk91lBvVuGvvDuevFJs7Xuzin9ktS8wDqvg680NxnC6Yyz%2FStbg3VZw2wEJy0TVfLu54y1"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 25 Sep 2025 08:28:28 GMT
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:10:19 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cdc09d38d9a9f1a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1309
server: cloudflare

GET
H2 200 hp Show response
pixel.sojern.com/partner/vmIiNwUzTn9GRtS8/ 3 KB
995 B 261ms
118ms Script
application/javascript 107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.sojern.com/partner/vmIiNwUzTn9GRtS8/hp?
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ab956663e3a052cda03a91548aed9a09e569c9b6b50cb7fd6393e94d15d26dd8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 594
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/javascript
vary: Accept-Encoding
x-accel-expires: 0

GET
H2 200 / Show response
api.ipify.org/ 21 B
154 B 436ms
200ms XHR
application/json 104.26.13.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f643181eb6355efc7d4e5d2280205ae9ca7bd5496aea1f4e5c734ae141a5aed9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8cdc09d45aa1dbe2-FRA
access-control-allow-origin: *
content-length: 21
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/json
vary: Origin
server: cloudflare

GET
H2 200 e5441a4e225e9887ad3604d7fdd77be3.png
www.cheapflights.co.il/ 3 KB
4 KB 426ms
425ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/e5441a4e225e9887ad3604d7fdd77be3.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: b1935ed30edc94e6eb9170a05e4732efe276ca4feff4c8911bb48a5490cc33d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"d28-18680bc8bdf"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 3368
x-amz-cf-id: 0nb0GapyIkG06oygqgbdxT23lKJPQfyX-SWEfY5epIFDqMeWd-2ZSA==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 9019496778affa453c773b48a495a6b0.png
www.cheapflights.co.il/ 2 KB
2 KB 445ms
444ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/9019496778affa453c773b48a495a6b0.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 4b9be2547e82aba320591a904e15602e1f9fa6e65d5e7e2d4e63a0e2b91ab553

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"6db-18680bc8c2b"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 1755
x-amz-cf-id: Ls1lv96AJQDJcH5wRBQh9apyNFB2dP9PwBlIw62IftH7fAy3arAIlA==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 8561407abc51911d076323494ae14da7.jpg
www.cheapflights.co.il/ 32 KB
32 KB 444ms
443ms Image
image/jpeg 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/8561407abc51911d076323494ae14da7.jpg
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: ebd2afe59de33f952b892a82b7a21fff4e38554d902828cd791a920c0b6046e6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"806f-18680bc8c2b"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 32879
x-amz-cf-id: Hq0WVdFdSUx-WAB5ww49xN0A-P6CSbgHn-vNiVqopezxnxzEKw7HFw==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/jpeg
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 1ff218beefea7efefbe94c1475ce9cc5.jpg
www.cheapflights.co.il/ 912 B
1 KB 428ms
427ms Image
image/jpeg 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/1ff218beefea7efefbe94c1475ce9cc5.jpg
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: e2843cb8c7738046d9291d9fd5a77ca5dbc33fd81e9e2e565a63658c4b522627

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"390-18680bc8bdf"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 912
x-amz-cf-id: fM569CCZc7Wlh1tQC0whNcKAXGVBfJrc4i6r85TOpZKuLVZRo8S44Q==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/jpeg
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 9829939c912cb6dd09e6eceede18c884.png
www.cheapflights.co.il/ 3 KB
3 KB 431ms
430ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/9829939c912cb6dd09e6eceede18c884.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: ec024997f625f985b851dfe0eb89edb752794cfa09c1dd43e53b2cf80a03ee02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"a97-18680bc8bdf"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 2711
x-amz-cf-id: 05uMW-jyuJ3eCB6qFwv4yb3u7jaIO860EWB-6NTXfcZ--2EATX6uFw==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H2 200 1757bfe8459ccfee91aea47e96c36740.png
www.cheapflights.co.il/ 4 KB
5 KB 269ms
268ms Image
image/png 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cheapflights.co.il/1757bfe8459ccfee91aea47e96c36740.png
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 3ee37e29cd6a34ca93fd0239f03a0542d27f5974af4cff7ef69666449f136c8f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
etag: W/"11ff-18680bc8c2b"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 4607
x-amz-cf-id: n875cbUkIUfyISIR-CbRx6_Ok92ZTltkdxvcL9TzIXORmYbqmmnD7Q==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/png
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame AFB0 0
0 777ms
776ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9068148265549322&output=html&h=280&slotname=8023884041&adk=1096605847&adf=2680576174&pi=t.ma~as.8023884041&w=1020&abgtt=3&fwrn=4&fwrnh=100&lmt=1677196971&rafmt=1&format=1020x280&url=https%3A%2F%2Fwww.cheapflights.co.il%2F&fwr=0&fwrattr=true&rh=250&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1728116907911&bpp=1&bdt=1449&idt=1&shv=r20241001&mjsv=m202410010101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=6706322214125&frm=20&pv=1&u_tz=180&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=290&ady=585&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31087658%2C95331832%2C95343329%2C95343454%2C95335247&oid=2&pvsid=1718065797954528&tmod=2126008786&uas=0&nvt=1&fc=1920&brdim=10%2C10%2C10%2C10%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=20

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-13-32-27-54.fra56.r.cloudfront.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 46973
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Oct 2024 08:28:28 GMT
expires: Sat, 05 Oct 2024 08:28:28 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/ 87 KB
28 KB 121ms
121ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js

Requested by

Host: cdn.popt.in
URL: https://cdn.popt.in/pixel.js?id=e4cfd654ecfda

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03ec4-15d95"
age: 155088
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s8mWORLsCQUpJJ7OB2JTZv3262bStfjq7ORtnIM9U5yxeDPtgjLWc5HkuScVNjMj5vncYDkj2hNPRciLfrVa8%2BdFy6KJ6G5ccshkE9rej4uAV6a10TDh0VZbd9891KsbdER%2FqE5c"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 25 Sep 2025 08:28:28 GMT
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:11:48 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cdc09d36f2dd222-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27964
server: cloudflare

POST
H2 200 BIeHMSzAA0 Show response
api.userway.org/api/tunings/ 633 B
1020 B 869ms
315ms XHR
application/json 34.214.246.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.userway.org/api/tunings/BIeHMSzAA0
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-10-04-11-01-23/widget_app_base_1728039683734.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.214.246.253 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-214-246-253.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 01fdf7be5156500c6da045744dbadd553e55b3a54825d0c966c2f3a28bac9c83

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

access-control-max-age: 3000
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: no-cache, no-store, must-revalidate
x-service-request-id: usr716432473ea84fb
etag: W/"279-yN3El6Av7bRLIXKgmQGGkvp6KnA"
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
access-control-allow-origin: *
content-length: 633
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/json; charset=utf-8
x-service-version: uw-pr
access-control-allow-headers: *

GET
H2 200 modules.ca70bc16369dcd35d4ef.js Show response
script.hotjar.com/ 224 KB
56 KB 370ms
137ms Script
application/javascript 13.32.27.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.ca70bc16369dcd35d4ef.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-664604.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.54 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

1b49717ee4566c527ce824a1f6db23dc4b1ceb5d539c0a249cc16010af88c096

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag: none
content-encoding: br
etag: "af93a606d2b26fbc80fccfd902e26cd3"
age: 70221
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: oNzfaQhMKtdWxR35JNgggag8d91BIFz9Om2yi63n28Y6JFiwYN-GSw==
date: Fri, 04 Oct 2024 12:58:07 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 04 Oct 2024 12:57:44 GMT
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
via: 1.1 2e4a0520ad8fe16707823b20e9441e08.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56592
x-amz-cf-pop: FRA56-C2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
439 B 122ms
121ms XHR
text/plain 172.217.16.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1103045271&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cheapflights.co.il%2F&ul=he-il&de=UTF-8&dt=%D7%9E%D7%A9%D7%95%D7%95%D7%99%D7%9D%20%D7%9E%D7%97%D7%99%D7%A8%D7%99%20%D7%98%D7%99%D7%A1%D7%95%D7%AA%20%D7%91%D7%99%D7%9F%20%D7%94%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%D7%94%D7%9E%D7%95%D7%91%D7%99%D7%9C%D7%99%D7%9D%20%D7%91%D7%90%D7%A8%D7%A5%20%D7%95%D7%91%D7%A2%D7%95%D7%9C%D7%9D&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgAABAAAAACAAI~&jid=1949205440&gjid=1593014241&cid=1565679731.1728116908&tid=UA-78541688-8&_gid=1463007049.1728116908&_slc=1&gtm=45He4a20n81P3QG6MTv77523668za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101671035~101747727&z=1407550629

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f206.1e100.net

Software

Golfe2 /

Resource Hash

9268d0cda1e39ae56345cc9b3eba808561f6d069883dea67e28d571f8ef4ad1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:28 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.cheapflights.co.il
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
651 B 341ms
115ms XHR
text/plain 74.125.206.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-78541688-8&cid=1565679731.1728116908&jid=1949205440&gjid=1593014241&_gid=1463007049.1728116908&_u=YGBAgAABAAAAAGAAI~&z=1206418650

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wk-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:28 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0
access-control-allow-origin: https://www.cheapflights.co.il
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
71 B 121ms
120ms XHR
text/plain 172.217.16.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1103045271&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.cheapflights.co.il%2F&ul=he-il&de=UTF-8&dt=%D7%9E%D7%A9%D7%95%D7%95%D7%99%D7%9D%20%D7%9E%D7%97%D7%99%D7%A8%D7%99%20%D7%98%D7%99%D7%A1%D7%95%D7%AA%20%D7%91%D7%99%D7%9F%20%D7%94%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%D7%94%D7%9E%D7%95%D7%91%D7%99%D7%9C%D7%99%D7%9D%20%D7%91%D7%90%D7%A8%D7%A5%20%D7%95%D7%91%D7%A2%D7%95%D7%9C%D7%9D&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=giltry&ea=gilos&_u=YGDAAAABAAAAAGAAI~&jid=1619093160&gjid=1972015037&cid=1565679731.1728116908&tid=UA-78541688-8&_gid=1463007049.1728116908&_r=1&gtm=45He4a20n81P3QG6MTv77523668za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101671035~101747727&z=1630820080

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f206.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:28 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.cheapflights.co.il
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H2 200 topics_api Show response
psb.taboola.com/ 65 B
279 B 298ms
99ms Fetch
text/html 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://psb.taboola.com/topics_api
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1223218/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e7112b70eed95d42b178135728e6153e34f07001827870748de87cd7dec3538e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=2592000
retry-after: 0
x-timer: S1728116908.278401,VS0,VE0
observe-browsing-topics: ?1
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: HIT
content-length: 65
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: text/html; charset=utf-8
x-served-by: cache-mrs10569-MRS
server: Varnish
x-cache-hits: 0

GET
H2 200 json Show response
trc.taboola.com/1223218/trc/3/ 3 KB
2 KB 191ms
184ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1223218/trc/3/json?tim=1728116908033&data=%7B%22id%22%3A225%2C%22ii%22%3A%22%2F%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1728116908028%2C%22cv%22%3A%2220240929-12-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22http%3A%2F%2Fcheapflights.co.il%2F%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dtaboolaaccount-yanivtravelmediadirectcom%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1728116908032%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.cheapflights.co.il%2F%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22it%22%3A%22JS_PIXEL%22%2C%22supv%22%3Atrue%7D%2C%22pa%22%3A%7B%22su%22%3Atrue%7D%2C%22psb%22%3Atrue%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1223218/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f854cfc8b14585c807ebfee1d7bdbd8444697676e659edcd5dd43b36d6139d68

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-log-content-encoding: gzip
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-mrs10539-MRS
x-cache-hits: 0
vary: Accept-Encoding
x-fastly-to-nlb-rtt: 73829
x-timer: S1728116908.090729,VS0,VE87
x-vcl-time-ms: 87
access-control-allow-credentials: true
via: 1.1 varnish
cpu: 0.53625
accept-ranges: bytes
access-control-allow-origin: *
x-service-version: v1
server: nginx

GET
H3 200 /
www.google.com/pagead/1p-user-list/859083998/ 42 B
64 B 362ms
132ms Image
image/gif 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/859083998/?random=1728116907551&cv=11&fst=1728115200000&bg=ffffff&guid=ON&async=1&gtm=45be4a20v9193855583za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101533421~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cheapflights.co.il%2F&hn=www.googleadservices.com&frm=0&tiba=%D7%9E%D7%A9%D7%95%D7%95%D7%99%D7%9D%20%D7%9E%D7%97%D7%99%D7%A8%D7%99%20%D7%98%D7%99%D7%A1%D7%95%D7%AA%20%D7%91%D7%99%D7%9F%20%D7%94%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%D7%94%D7%9E%D7%95%D7%91%D7%99%D7%9C%D7%99%D7%9D%20%D7%91%D7%90%D7%A8%D7%A5%20%D7%95%D7%91&npa=0&pscdl=noapi&auid=959159119.1728116908&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfeuRnMGVI0l0XOztk4A_iONm7VOoJlQ&random=781732537&rmt_tld=0&ipr=y

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 05 Oct 2024 08:28:28 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 /
www.google.co.il/pagead/1p-user-list/859083998/ 42 B
455 B 369ms
131ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/pagead/1p-user-list/859083998/?random=1728116907551&cv=11&fst=1728115200000&bg=ffffff&guid=ON&async=1&gtm=45be4a20v9193855583za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101529666~101533421~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cheapflights.co.il%2F&hn=www.googleadservices.com&frm=0&tiba=%D7%9E%D7%A9%D7%95%D7%95%D7%99%D7%9D%20%D7%9E%D7%97%D7%99%D7%A8%D7%99%20%D7%98%D7%99%D7%A1%D7%95%D7%AA%20%D7%91%D7%99%D7%9F%20%D7%94%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%D7%94%D7%9E%D7%95%D7%91%D7%99%D7%9C%D7%99%D7%9D%20%D7%91%D7%90%D7%A8%D7%A5%20%D7%95%D7%91&npa=0&pscdl=noapi&auid=959159119.1728116908&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfeuRnMGVI0l0XOztk4A_iONm7VOoJlQ&random=781732537&rmt_tld=1&ipr=y

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 05 Oct 2024 08:28:28 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 293 KB
100 KB 133ms
133ms Script
application/javascript 142.250.184.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-H1WW56B18R&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f142.1e100.net

Software

Google Tag Manager /

Resource Hash

6f97f722e249007ed4381c412029280ad700e60cfb26cecf907213e99cd19626

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 05 Oct 2024 08:28:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 102475
x-xss-protection: 0
server: Google Tag Manager

POST
H2 200 writeToServerLog Show response
www.cheapflights.co.il/ 16 B
328 B 505ms
503ms XHR
application/json 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cheapflights.co.il/writeToServerLog
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 7d1cbc7b086d21fa8e18b25a57b47a221c263a4879a26d8d718546bfbc0de041

Request headers

Referer
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/json

Response headers

content-encoding: gzip
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
x-amz-cf-id: l_TF764rBR6vzqGxJDBR1xBp7P7jqTK1ewkzQkkC_prwso1JNIaCNA==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/json
x-powered-by: Express
server: nginx/1.14.1
x-amz-cf-pop: FRA56-P10
vary: Accept-Encoding

GET
H2

200

AdX
pixel.sojern.com/idSync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=MmE5YWQ1ODUtZWRiMC0zZDRiLWJkNjQtZTk3NjhmN2Y0NTFk&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=XnxPtm3PVIQqQPqDmCU_YmxdQ...
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=XnxPtm3PVIQqQPqDmCU_YmxdQSTHhotZjwI0NnjmDXBq_FuLf5xMqeGcgQxgPFP6&google_gid=CAESELUpUnU6HNq1xk824ksCftY&google_cver=1

42 B
279 B

116ms
115ms

Image
image/gif

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=XnxPtm3PVIQqQPqDmCU_YmxdQSTHhotZjwI0NnjmDXBq_FuLf5xMqeGcgQxgPFP6&google_gid=CAESELUpUnU6HNq1xk824ksCftY&google_cver=1
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/gif
vary: Accept-Encoding
x-accel-expires: 0

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=XnxPtm3PVIQqQPqDmCU_YmxdQSTHhotZjwI0NnjmDXBq_FuLf5xMqeGcgQxgPFP6&google_gid=CAESELUpUnU6HNq1xk824ksCftY&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 389
date: Sat, 05 Oct 2024 08:28:28 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
fcmatch.youtube.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_hm=MmE5YWQ1ODUtZWRiMC0zZDRiLWJkNjQtZTk3NjhmN2Y0NTFk&google_nid=sojern_adh
https://fcmatch.google.com/pixel?google_gm=AMnCDooTRTCYbDKK3gt5WuRLRzSxdzwkNI7oneuuh9sf63DU7J-m-UHWFYhw_k__Q7Aa0V68-TRPzPS4H1XwSljeJr16H_TjRXLxaIKa3eRfSPGhPjFSSTTbXnEbgkg7QpsHhyvST9qy
https://fcmatch.youtube.com/pixel?google_gm=AMnCDooTRTCYbDKK3gt5WuRLRzSxdzwkNI7oneuuh9sf63DU7J-m-UHWFYhw_k__Q7Aa0V68-TRPzPS4H1XwSljeJr16H_TjRXLxaIKa3eRfSPGhPjFSSTTbXnEbgkg7QpsHhyvST9qy

170 B
432 B

410ms
162ms

Image
image/png

216.58.212.142
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fcmatch.youtube.com/pixel?google_gm=AMnCDooTRTCYbDKK3gt5WuRLRzSxdzwkNI7oneuuh9sf63DU7J-m-UHWFYhw_k__Q7Aa0V68-TRPzPS4H1XwSljeJr16H_TjRXLxaIKa3eRfSPGhPjFSSTTbXnEbgkg7QpsHhyvST9qy

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Server

216.58.212.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 05 Oct 2024 08:28:29 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN

Redirect headers

cache-control: no-cache, must-revalidate
location: https://fcmatch.youtube.com/pixel?google_gm=AMnCDooTRTCYbDKK3gt5WuRLRzSxdzwkNI7oneuuh9sf63DU7J-m-UHWFYhw_k__Q7Aa0V68-TRPzPS4H1XwSljeJr16H_TjRXLxaIKa3eRfSPGhPjFSSTTbXnEbgkg7QpsHhyvST9qy
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 381
date: Sat, 05 Oct 2024 08:28:28 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN

GET
H2 200 getuidnb
ib.adnxs.com/ 43 B
700 B 369ms
122ms Image
image/gif 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/getuidnb?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=XnxPtm3PVIQqQPqDmCU_YmxdQSTHhotZjwI0NnjmDXBq_FuLf5xMqeGcgQxgPFP6

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 31.187.78.19; 31.187.78.19; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 6334558c-20c5-41e4-8d81-acc372cc3360
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 05 Oct 2024 08:28:28 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

GET
H3

200

ttd
pixel.sojern.com/idsync/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=XnxPtm3PVIQqQPqDmCU_YmxdQSTHhotZjwI0NnjmDXBq_FuLf5xMqeGcgQxgPFP6&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=ombl9hp&ttd_puid=XnxPtm3PVIQqQPqDmCU_YmxdQSTHhotZjwI0NnjmDXBq_FuLf5xMqeGcgQxgPFP6&ttd_tpi=1
https://pixel.sojern.com/idsync/ttd?id=65f75d36-6b40-4df0-bad1-7c5981926746&sjrn_id=XnxPtm3PVIQqQPqDmCU_YmxdQSTHhotZjwI0NnjmDXBq_FuLf5xMqeGcgQxgPFP6

42 B
63 B

118ms
117ms

Image
image/gif

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/ttd?id=65f75d36-6b40-4df0-bad1-7c5981926746&sjrn_id=XnxPtm3PVIQqQPqDmCU_YmxdQSTHhotZjwI0NnjmDXBq_FuLf5xMqeGcgQxgPFP6
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H3
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: image/gif
vary: Accept-Encoding
x-accel-expires: 0

Redirect headers

location: https://pixel.sojern.com/idsync/ttd?id=65f75d36-6b40-4df0-bad1-7c5981926746&sjrn_id=XnxPtm3PVIQqQPqDmCU_YmxdQSTHhotZjwI0NnjmDXBq_FuLf5xMqeGcgQxgPFP6
content-length: 327
date: Sat, 05 Oct 2024 08:28:28 GMT
server: Kestrel

GET
H2 200 cds-pips.js Show response
cdn.taboola.com/scripts/ 3 KB
2 KB 104ms
104ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/cds-pips.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1223218/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bce4b47b8fc12de49fac0a00e9039e38aa568aba0ee9154b93d20465f0289cfa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: "c52aa1ea682aef8ad5ebf7aff9662e35"
x-amz-version-id: uLMchp7BESXZGZqPSJ8.FcfKBYdWFxIf
age: 640
x-cache: HIT
date: Sat, 05 Oct 2024 08:28:28 GMT
last-modified: Sun, 29 Oct 2023 14:06:32 GMT
x-served-by: cache-mrs10539-MRS
x-cache-hits: 2385
content-type: application/javascript
x-amz-id-2: zRW4GzbRD5fxe2aoj4Z5QP/ZBQsXQWGaaibeyT7jM2E1ce9FIFOkCGTDalvFOaKy5Ft+4g93nqLlyzCEiPYE7YTx/GazSHJ3q/l2gBVXC/c=
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
cache-control: private, max-age=3600
x-timer: S1728116908.283568,VS0,VE0
via: 1.1 varnish
x-amz-request-id: VMN0CEKQB160C2Z2
accept-ranges: bytes
access-control-allow-origin: *
abp: 48
content-length: 1347
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 eid.es5.js Show response
cdn.taboola.com/scripts/ 17 KB
7 KB 99ms
98ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/eid.es5.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1223218/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: "2fdf3e79d5e851201a0d52a886453d8b"
x-amz-version-id: Bqo64Ai0BniIkPPSnUb8_cZLJGu.sClo
age: 13812
x-cache: HIT
date: Sat, 05 Oct 2024 08:28:28 GMT
last-modified: Sun, 02 Apr 2023 13:09:57 GMT
x-served-by: cache-mrs10539-MRS
x-cache-hits: 25338
content-type: application/javascript
x-amz-id-2: /9sDdV9HKydI/z1u/VKo5ocPKmszTnsviCjfPOQPyWs6PtJpy8PtEGan5n7kK7oSEXB16aVjmcy+Slx+z4hCOrHDdf7gZxs0
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
cache-control: private,max-age=14400
x-timer: S1728116908.283497,VS0,VE0
via: 1.1 varnish
x-amz-request-id: HXT8K1JXDV6D66RJ
accept-ranges: bytes
access-control-allow-origin: *
abp: 24
content-length: 6467
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 e4cfd654ecfda Show response
display.popt.in/api/display/ 68 B
697 B 440ms
307ms XHR
application/json 172.67.166.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://display.popt.in/api/display/e4cfd654ecfda?domain=https%3A%2F%2Fwww.cheapflights.co.il%2F&referrer=&previous_url=&cookies=%20poptin_old_user%3Dtrue%20poptin_user_id%3D0.ag6opb7gcdb%20poptin_previous_url%3D%20poptin_new_user%3Dtrue%20poptin_viewed_session%3Dfalse%20&triggers=&cc=false&if_mobile=false&page_title=%D7%9E%D7%A9%D7%95%D7%95%D7%99%D7%9D%20%D7%9E%D7%97%D7%99%D7%A8%D7%99%20%D7%98%D7%99%D7%A1%D7%95%D7%AA%20%D7%91%D7%99%D7%9F%20%D7%94%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%D7%94%D7%9E%D7%95%D7%91%D7%99%D7%9C%D7%99%D7%9D%20%D7%91%D7%90%D7%A8%D7%A5%20%D7%95%D7%91%D7%A2%D7%95%D7%9C%D7%9D&origin_landing_page=https%3A%2F%2Fwww.cheapflights.co.il%2F&if_page_refreshed=false&poptin_viewed_url=https%3A%2F%2Fwww.cheapflights.co.il%2F&previous_visited_pages=&shopify_customer_id=0&cart_total_items=0&cart_total_price=0&cart_products_ids_list=&cart_products_org_ids_list=

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.166.202 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6ecfd1daac5c0eac2b8e47c43b893aee49524cdd77ff16a0c2b3fc792eac0df

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://bc.popt.in https://.mybigcommerce.com https://.jumpseller.com https://.myshopline.com https://.myshopify.com https://*.grisynava.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1UU%2FOOWCv3lx1gJwfuMdHSgw8kPXK3NqvJuWC23C9%2FqSrYB5%2FMESdUEhDNnUF1qHcsen67zY6ei6stqpVgWojpCrT5Tq2X0Dno%2BQCfdePMajx46573%2Bf%2F5zcJMqwJPBcQSc%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff, nosniff
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
access-control-allow-headers: Origin, Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors https://bc.popt.in https://*.mybigcommerce.com https://*.jumpseller.com https://*.myshopline.com https://*.myshopify.com https://*.grisynava.com
cache-control: no-cache, private
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8cdc09d5ba879f4e-FRA
access-control-allow-origin: *
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 / Show response
pips.taboola.com/ 4 B
93 B 106ms
98ms XHR
text/plain 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pips.taboola.com/
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: fb329000228cc5a24c264c57139de8bf854fc86fc18bf1c04ab61a2b5cb4b921

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store
retry-after: 0
access-control-allow-methods: GET
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: https://www.cheapflights.co.il
x-cache: HIT
content-length: 4
date: Sat, 05 Oct 2024 08:28:28 GMT
x-served-by: cache-mrs10569-MRS
server: Varnish
x-cache-hits: 0

GET
H/1.1 200
OK 31.187.78.19 Show response
pro.ip-api.com/json/ 278 B
434 B 370ms
119ms XHR
application/json 51.77.64.70
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.ip-api.com/json/31.187.78.19?key=xJGBn63rkcjAK5U
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/bundle.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.77.64.70 , Germany, ASN16276 (OVH, FR),
Reverse DNS: de-fra-1.pro.ip-api.com
Software: /
Resource Hash: 3234756fabf6e05b1cbcbbddec930cae400b0f90cfc4bce302822877f7273e5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer

Response headers

Access-Control-Allow-Origin: *
Content-Length: 278
Date: Sat, 05 Oct 2024 08:28:28 GMT
Content-Type: application/json; charset=utf-8

GET
H2 204 / Show response
cds.taboola.com/ 0
82 B 595ms
184ms XHR
text/plain 141.226.224.32
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.taboola.com/?uid=e7b6a9be-0420-4b9c-813c-7e0f7ea7079d-tuctdfa7e2c&mbl=ZmFsc2U=
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-allow-origin: *
cache-control: no-store
date: Sat, 05 Oct 2024 08:28:28 GMT
server: nginx

POST
H2 200 / Show response
content.hotjar.io/ 56 B
171 B 583ms
191ms XHR
application/json 52.215.101.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?site_id=664604&gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.ca70bc16369dcd35d4ef.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.215.101.83 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-101-83.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 80f7e8c3f744912b9b0c2361ef3b0142425694e5067e4328418490f283b132b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8
Referer

Response headers

access-control-max-age: 86400
access-control-allow-origin: *
content-length: 56
date: Sat, 05 Oct 2024 08:28:29 GMT
content-type: application/json

POST
H2 204 collect
analytics.google.com/g/ 0
0 298ms
116ms Fetch
text/plain 216.239.38.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-H1WW56B18R&gtm=45je4a20v9137943415za200&_p=1728116906828&_gaz=1&gcd=13l3l3l3l2l1&npa=0&dma=0&tag_exp=101529666~101671035~101747727&ul=he-il&sr=1600x1200&cid=1565679731.1728116908&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.cheapflights.co.il%2F&dt=%D7%9E%D7%A9%D7%95%D7%95%D7%99%D7%9D%20%D7%9E%D7%97%D7%99%D7%A8%D7%99%20%D7%98%D7%99%D7%A1%D7%95%D7%AA%20%D7%91%D7%99%D7%9F%20%D7%94%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%D7%94%D7%9E%D7%95%D7%91%D7%99%D7%9C%D7%99%D7%9D%20%D7%91%D7%90%D7%A8%D7%A5%20%D7%95%D7%91%D7%A2%D7%95%D7%9C%D7%9D&sid=1728116908&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=3099
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H1WW56B18R&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.38.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.cheapflights.co.il
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
269 B 113ms
112ms Ping
text/plain 74.125.206.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-H1WW56B18R&cid=1565679731.1728116908&gtm=45je4a20v9137943415za200&aip=1&dma=0&gcd=13l3l3l3l2l1&npa=0&frm=0&tag_exp=101529666~101671035~101747727
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H1WW56B18R&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.206.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wk-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.cheapflights.co.il
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame D5D6 0
0 127ms
126ms Document
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-H1WW56B18R&gacid=1565679731.1728116908&gtm=45je4a20v9137943415za200&dma=0&gcd=13l3l3l3l2l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101529666~101671035~101747727&z=541657241

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-H1WW56B18R&cx=c&_slc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Oct 2024 08:28:28 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ga-audiences
www.google.co.il/ads/ 42 B
107 B 137ms
136ms Image
image/gif 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-H1WW56B18R&cid=1565679731.1728116908&gtm=45je4a20v9137943415za200&aip=1&dma=0&gcd=13l3l3l3l2l1&npa=0&frm=0&tag_exp=101529666~101671035~101747727&tag_exp=101529666~101671035~101747727&z=354312944

Requested by

Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 05 Oct 2024 08:28:28 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/ 172 KB
58 KB 137ms
136ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1431cfbe1e40ad1b5d3741961a4374d8279107d84c9a95f808e6e19160325061

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 8680106632422103451
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 08:28:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 59131
x-xss-protection: 0
server: cafe

GET
H2 200 ca-pub-9068148265549322 Show response
fundingchoicesmessages.google.com/i/ 200 KB
66 KB 387ms
146ms Script
application/javascript 142.250.186.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-9068148265549322?href=https%3A%2F%2Fwww.cheapflights.co.il&ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9e5c0be2dea8b1d6d5198481cdd3eb3fd24a63565af90a79b0d091022b2145fc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-R7bf_R9EOxxJ1fROJsyMCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjqtDikmJw1pBiOO90h-k6EEt8fcmkAcRO6TNYg4C49eY51qlAnPTvPGsRELtrXWT1B2JDhUusjiBcdInVE4hVey6xmgLx_XWXWJ8D8dc9l1j_AvHej5dYjwJxkcQV1iYgvt10hfUxEAvxcKz52LyDTWDGj_tXmJU0kvIL45Pz80qKMpNKS_KL0pLTUotTi8pSi-KNDIxMDA0MjPUMjOMLDABTOkre"
content-security-policy: script-src 'report-sample' 'nonce-R7bf_R9EOxxJ1fROJsyMCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 getHomeAirportForUserLocation Show response
www.cheapflights.co.il/ 36 B
344 B 240ms
240ms XHR
application/json 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cheapflights.co.il/getHomeAirportForUserLocation?city=Tel%20Aviv&country=Israel
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: 35a9a516192138f8af03aae270489732d62c30e171e8f90f8ed46c756b9f7815

Request headers

Referer
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

content-encoding: gzip
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
x-amz-cf-id: FXe0jGb0MpEhPCHAwOF19-C3ujW0R4Yrkod4bitwqcSjz_hMLGeoaA==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/json
x-powered-by: Express
server: nginx/1.14.1
x-amz-cf-pop: FRA56-P10
vary: Accept-Encoding

GET
H2 200 he.json Show response
cdn.userway.org/widgetapp/2024-10-04-11-01-23/locales/ 727 B
1 KB 114ms
113ms XHR
application/json 212.102.56.178
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-10-04-11-01-23/locales/he.json
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-10-04-11-01-23/widget_app_base_1728039683734.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.56.178 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 245149724.fra.cdn77.com
Software: CDN77-Turbo /
Resource Hash: c55af41fd0961f0ce93bde12f2d615b8680315d61a2d9a87518a77d0bd021421

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
content-encoding: gzip
etag: W/"5eab77cf464027402046f46dae1404b0"
age: 310
x-77-cache: HIT
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
x-cache: HIT
x-amz-cf-id: 7mBVjThRyquaxyfWZ29hv1xHDZpjqTFThcQKVl-e63lvaC9XeVWx2Q==
date: Sat, 05 Oct 2024 08:28:28 GMT
content-type: application/json
last-modified: Fri, 04 Oct 2024 11:04:31 GMT
x-77-nzt-ray: 1cb09c0efd926602acf800672da97a38
x-age: 76576
vary: Accept-Encoding
x-77-nzt: EgwB1GY4sQH3ICsBAAwBnJIhHwG3EAAAAA
cache-control: max-age=25920000, public
via: 1.1 3c13cc51908e4d37d2a5046d7703e256.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-77-pop: frankfurtDE
x-accel-date-max: 1728040007
x-77-age: 76576
x-amz-cf-pop: FRA56-P10
x-accel-date: 1728040332
server: CDN77-Turbo
x-accel-expires: @1753960316
x-amz-server-side-encryption: AES256

POST
H3 204 AGSKWxUx23Wi_0-NC7htHpqrwlfDQTzKl2sA8hAjXnMre0eud_B-gX1lKAvNLzH1ZaIgC1g8bH-HCewht2gMnwpDv-YIxod-Yo6LxX-tJC3ibGiIskmn_eJifkaxYw-UuPL1Zx6w6AIAfw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 352ms
124ms XHR
text/html 142.250.186.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUx23Wi_0-NC7htHpqrwlfDQTzKl2sA8hAjXnMre0eud_B-gX1lKAvNLzH1ZaIgC1g8bH-HCewht2gMnwpDv-YIxod-Yo6LxX-tJC3ibGiIskmn_eJifkaxYw-UuPL1Zx6w6AIAfw==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.iw.-_gR98Thnd0.es5.O/am=YDA/d=1/rs=AJlcJMwomkTjVQb6mMVkgbFho5dxH1zMwA/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-nBvO8B4RgQy-76EUQalR8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:29 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw0gDi9BmsIUDsrnWR1R-Iv-65xPoXiPd-vMR6FIiFeDjWfmzewSZwYtXBu4xKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyMTQwMBYz8AsvsAAAOrCL6E"
content-security-policy: script-src 'report-sample' 'nonce-nBvO8B4RgQy-76EUQalR8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.cheapflights.co.il
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxX7M-xdNVOPrA0NEDPuD_HhvOAeM_gkanhVmRQLl8flT3t0eOq_4MtKHBm7p8g6yI5p_ncuk4kpS9vcNMMxxBaCSt_qm3waFJ5eMBCtiJaSOGRh9bJKs7ieKaDU3ZU9DF7eJx6bQw== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 139ms
139ms Script
application/javascript 142.250.186.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX7M-xdNVOPrA0NEDPuD_HhvOAeM_gkanhVmRQLl8flT3t0eOq_4MtKHBm7p8g6yI5p_ncuk4kpS9vcNMMxxBaCSt_qm3waFJ5eMBCtiJaSOGRh9bJKs7ieKaDU3ZU9DF7eJx6bQw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI4MTE2OTA5LDIwMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93d3cuY2hlYXBmbGlnaHRzLmNvLmlsLyIsbnVsbCxbWzgsIi1fZ1I5OFRobmQwIl0sWzksIml3Il0sWzE4LCJbW1swXV1dIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

074a410470a8315ff0062127d869eb9c7bdae9df67c21e278f4a491b8af77c27

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-UVPS05B-k1ali-99IFbgsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:29 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjqtDikmJw0JBiOO90h-k6EEt8fcmkAcRO6TNYg4C49eY51qlAnPTvPGsRELtrXWT1B2JDhUusjiBcdInVE4hVey6xmgLx_XWXWJ8D8dc9l1j_AvHej5dYjwJxkcQV1iYgvt10hfUxEAvxcKz92LyDTeDElIY2RiWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyMTQwMDYz0D4_gCAwAp0kn5"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-UVPS05B-k1ali-99IFbgsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 zrt_lookup_fy2021.html
googleads.g.doubleclick.net/pagead/html/r20241001/r20190131/ Frame E43E 0
0 0ms
0ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20241001/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

age: 60521
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4121
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 04 Oct 2024 15:39:46 GMT
etag: 13108003645644964576
expires: Fri, 18 Oct 2024 15:39:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 remediation-tool-free.js Show response
cdn.userway.org/remediation/2024-10-04-11-01-23/free/ 31 KB
13 KB 124ms
124ms Script
application/javascript 212.102.56.178
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/remediation/2024-10-04-11-01-23/free/remediation-tool-free.js?ts=1728039683734
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-10-04-11-01-23/widget_app_base_1728039683734.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.56.178 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 245149724.fra.cdn77.com
Software: CDN77-Turbo /
Resource Hash: 64c50f87ea791b9cb64156a343dff6af131630669ee56395937ab6ef0a092389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.cheapflights.co.il
Referer

Response headers

access-control-max-age: 3000
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
content-encoding: gzip
etag: W/"cd0a28ab852047a8ad5a6e9e4b3fdcc4"
age: 239
x-77-cache: HIT
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
x-cache: HIT
x-amz-cf-id: 8Xe3AtL_K6jdEznZXT4niY24rS4CKmuso2iLB1XUz2_ehuaS4JRuig==
date: Sat, 05 Oct 2024 08:28:29 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 11:04:43 GMT
vary: Accept-Encoding
x-age: 76581
x-77-nzt-ray: 1cb09c0efd926602adf80067288ed11a
x-77-nzt: EgwB1GY4sQH3JSsBAAwBJRPCNAG3YgAAAA
cache-control: max-age=25920000, public
via: 1.1 004e894746bfb0d8f9e19ef0400dda24.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-77-pop: frankfurtDE
x-accel-date-max: 1728039991
x-77-age: 76581
x-amz-cf-pop: FRA56-P10
x-accel-date: 1728040328
server: CDN77-Turbo
x-accel-expires: @1753960230
x-amz-server-side-encryption: AES256

GET
H2 200 widget_base.css
cdn.userway.org/styles/2024-10-04-11-01-23/ 30 KB
5 KB 114ms
114ms Stylesheet
text/css 212.102.56.178
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/styles/2024-10-04-11-01-23/widget_base.css?v=1728039683734
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-10-04-11-01-23/widget_app_base_1728039683734.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.56.178 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 245149724.fra.cdn77.com
Software: CDN77-Turbo /
Resource Hash: 92a186a4d39702090ae3d539a1cf7cc0187b99203ed928fb4514fa3fdabf566d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
content-encoding: gzip
etag: W/"fa9ef3811ff36e9e81b054c454f9365f"
age: 324
x-77-cache: HIT
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
x-cache: HIT
x-amz-cf-id: KMAFjALe2Y4f1A0AOU3DQ5NciQd3xl5j8MspAWtuaAJn7uKvAFnOag==
date: Sat, 05 Oct 2024 08:28:29 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 11:03:50 GMT
vary: Accept-Encoding
x-age: 76583
x-77-nzt-ray: 1cb09c0e329991e0adf8006776c6cc1a
x-77-nzt: EgwB1GY4sQH3JysBAAwBw7WvAgG3CwAAAA
cache-control: max-age=864000, public
via: 1.1 fb02145a1ed983434aacfc27d3e4a9a6.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-77-pop: frankfurtDE
x-accel-date-max: 1728039991
x-77-age: 76583
x-amz-cf-pop: FRA56-P10
x-accel-date: 1728040326
server: CDN77-Turbo
x-accel-expires: @1728904315
x-amz-server-side-encryption: AES256

GET
H2 200 wheel_right_wh.svg
cdn.userway.org/widgetapp/images/ 3 KB
2 KB 112ms
112ms Image
image/svg+xml 212.102.56.178
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.userway.org/widgetapp/images/wheel_right_wh.svg
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.56.178 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 245149724.fra.cdn77.com
Software: CDN77-Turbo /
Resource Hash: 3e6b781c7c17a33e8505761c3647280a3a9038e25babb36e1aae6c1ce628f8ca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
content-encoding: gzip
etag: W/"06c6df2a4bebb363295045224214514f"
age: 37
x-77-cache: HIT
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
x-cache: HIT
x-amz-cf-id: gWZ2HMIFDOn_k7SeZAuxJslDgFmLNeQTOYncEv0HBPTm8-kCq4EspA==
date: Sat, 05 Oct 2024 08:28:29 GMT
content-type: image/svg+xml
last-modified: Fri, 04 Oct 2024 11:04:34 GMT
vary: Accept-Encoding
x-age: 76531
x-77-nzt-ray: 1cb09c0e329991e0adf8006775586b22
x-77-nzt: EgwB1GY4sQH38yoBAAwBisclxAG3PgAAAA
cache-control: max-age=25920000, public
via: 1.1 c53fb2c65e26830010100e7d773f73ae.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-77-pop: frankfurtDE
x-accel-date-max: 1728040280
x-77-age: 76531
x-amz-cf-pop: FRA56-P10
x-accel-date: 1728040378
server: CDN77-Turbo
x-accel-expires: @1753960316
x-amz-server-side-encryption: AES256

GET
H2 200 spin_wh.svg
cdn.userway.org/widgetapp/images/ 2 KB
1 KB 117ms
117ms Image
image/svg+xml 212.102.56.178
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.userway.org/widgetapp/images/spin_wh.svg
Requested by: Host: www.cheapflights.co.il
URL: https://www.cheapflights.co.il/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.102.56.178 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 245149724.fra.cdn77.com
Software: CDN77-Turbo /
Resource Hash: c45f637f905e1ea01ba81aa39e8da62ee7e7f8703c3da4c3bba55f6192e5834c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
content-encoding: gzip
etag: W/"8e0a35946bf39d10f46a1f1653366a0a"
x-77-cache: HIT
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
x-cache: HIT
x-amz-cf-id: mA5nt1rN4K99x_G8ybOCMf--QO49esOJba7fD33mlUZ2Q-ULEpLbng==
date: Sat, 05 Oct 2024 08:28:29 GMT
content-type: image/svg+xml
x-77-nzt-ray: 1cb09c0e329991e0adf80067729f6f22
vary: Accept-Encoding
last-modified: Fri, 04 Oct 2024 11:04:34 GMT
x-77-nzt: EgwB1GY4sQH3KSsBAAwBw7WvBgG3CgAAAA
cache-control: max-age=25920000, public
x-age: 76585
via: 1.1 3adffce7dd03a16d055927ad5fa7671a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-77-pop: frankfurtDE
x-accel-date-max: 1728040315
x-77-age: 76585
x-amz-cf-pop: FRA56-P10
x-accel-date: 1728040324
server: CDN77-Turbo
x-accel-expires: @1753960314
x-amz-server-side-encryption: AES256

OPTIONS
H2 200 unip
trc-events.taboola.com/1223218/log/3/ Frame 0
0 373ms
115ms Preflight 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1223218/log/3/unip?en=pre_d_eng_tb&tos=1551&scd=0&ssd=1&est=1728116908030&ver=36&isls=true&src=i&invt=1500&msa=786&rv=1&tim=1728116909582&vi=1728116908028&ri=b920113b310565b51082b9961a37c271&sd=v2_ace52b3c4c8722c15c77b36b7e92cd7e_e7b6a9be-0420-4b9c-813c-7e0f7ea7079d-tuctdfa7e2c_1728116908_1728116908_CNawjgYQstRKGPy_rd6lMiABKAEwZjiI6wpAsJAQSLzS2ANQ____________AVgAYABo9YyCzajipre0AXABgAEA&ui=e7b6a9be-0420-4b9c-813c-7e0f7ea7079d-tuctdfa7e2c&ref=null&cv=20240929-12-RELEASE&item-url=https%3A%2F%2Fwww.cheapflights.co.il%2F&ccpaPs=1---&it=JS_PIXEL
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://www.cheapflights.co.il
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://www.cheapflights.co.il
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Sat, 05 Oct 2024 08:28:29 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx

GET
H2 204 unip Show response
trc-events.taboola.com/1223218/log/3/ 0
635 B 349ms
117ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1223218/log/3/unip?en=pre_d_eng_tb&tos=1551&scd=0&ssd=1&est=1728116908030&ver=36&isls=true&src=i&invt=1500&msa=786&rv=1&tim=1728116909582&vi=1728116908028&ri=b920113b310565b51082b9961a37c271&sd=v2_ace52b3c4c8722c15c77b36b7e92cd7e_e7b6a9be-0420-4b9c-813c-7e0f7ea7079d-tuctdfa7e2c_1728116908_1728116908_CNawjgYQstRKGPy_rd6lMiABKAEwZjiI6wpAsJAQSLzS2ANQ____________AVgAYABo9YyCzajipre0AXABgAEA&ui=e7b6a9be-0420-4b9c-813c-7e0f7ea7079d-tuctdfa7e2c&ref=null&cv=20240929-12-RELEASE&item-url=https%3A%2F%2Fwww.cheapflights.co.il%2F&ccpaPs=1---&it=JS_PIXEL
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1223218/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Attribution-Reporting-Eligible: trigger
Referer

Response headers

access-control-allow-origin: https://www.cheapflights.co.il
cache-control: no-cache
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
date: Sat, 05 Oct 2024 08:28:30 GMT
pragma: no-cache
server: nginx
access-control-allow-credentials: true

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 17 KB
13 KB 367ms
136ms XHR
application/json 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20241001&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

916aa46b834fdc4bb9516173ecee4505ab62b812ca0b0a525e4f6203f8961b12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13167
date: Sat, 05 Oct 2024 08:28:30 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 favicon-flightsIL.ico
www.cheapflights.co.il/ 1 KB
1 KB 235ms
234ms Other
image/x-icon 3.161.82.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cheapflights.co.il/favicon-flightsIL.ico?v=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-9.fra56.r.cloudfront.net
Software: nginx/1.14.1 / Express
Resource Hash: dddc0b02f7f295c463269de2bf9f0ad7a3b220a42a376c281c28786c93889c82

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-cf-pop: FRA56-P10
cache-control: public, max-age=0
content-encoding: gzip
etag: W/"47e-18680bc8c27"
via: 1.1 9c8021538470ab47dffa34921d0b4aca.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
x-amz-cf-id: IDsg_yIAnEzeI_RLnPZN02FygGYHcKML2ZaA-YvsgeasB52vtQA04A==
date: Sat, 05 Oct 2024 08:28:29 GMT
content-type: image/x-icon
x-powered-by: Express
server: nginx/1.14.1
last-modified: Fri, 24 Feb 2023 00:04:45 GMT
vary: Accept-Encoding

GET
H/1.1 200
OK beacon.gif Show response
rum-collector-2.pingdom.net/img/ 0
213 B 529ms
127ms XHR
text/plain 52.212.15.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-collector-2.pingdom.net/img/beacon.gif?id=5902942556e3292aa57b23c6&sAW=1600&sAH=1200&bIW=1600&bIH=1200&pD=24&dPR=1&or=landscape-primary&nT=0&rC=0&nS=0&cS=303&cE=554&dLE=303&dLS=1&fS=0&hS=362&rE=-1&rS=-1&reS=554&resS=971&resE=974&uEE=-1&uES=-1&dL=978&dI=1347&dCLES=1846&dCLEE=1850&dC=4296&lES=4296&lEE=4297&s=nt&title=%D7%9E%D7%A9%D7%95%D7%95%D7%99%D7%9D%20%D7%9E%D7%97%D7%99%D7%A8%D7%99%20%D7%98%D7%99%D7%A1%D7%95%D7%AA%20%D7%91%D7%99%D7%9F%20%D7%94%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%D7%94%D7%9E%D7%95%D7%91%D7%99%D7%9C%D7%99%D7%9D%20%D7%91%D7%90%D7%A8%D7%A5%20%D7%95%D7%91%D7%A2%D7%95%D7%9C%D7%9D&path=https%3A%2F%2Fwww.cheapflights.co.il%2F&ref=&sId=z0acztjf&sST=1728116909&sIS=1&rV=0&v=1.4.1
Requested by: Host: rum-static.pingdom.net
URL: https://rum-static.pingdom.net/prum.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.15.135 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-15-135.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Expires: 0
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 0
Date: Sat, 05 Oct 2024 08:28:30 GMT
Pragma: no-cache
Connection: keep-alive

GET
H3 200 sidelinead. Show response
fundingchoicesmessages.google.com/f/AGSKWxVzIogTCj-NCCjxmyv8jZsxxG1i-KCg1Ecj5kBO7aguTqw_iViu1Yg-HsKhELXT8kQC1TVMslu-Hh7OeRM3BcyZE4qKlEILP0eyYo6c8ER4t0-RQmC2UUb-dACMeHS5uz8ivXoMK_qtqx-LPDCSoAGf0Fpol... 54 B
109 B 126ms
125ms Script
application/javascript 142.250.186.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVzIogTCj-NCCjxmyv8jZsxxG1i-KCg1Ecj5kBO7aguTqw_iViu1Yg-HsKhELXT8kQC1TVMslu-Hh7OeRM3BcyZE4qKlEILP0eyYo6c8ER4t0-RQmC2UUb-dACMeHS5uz8ivXoMK_qtqx-LPDCSoAGf0FpoloZ0C8mmDxbFRrz_7wV07trh8S0GNxRQ/__ad728x90./search/ads_-ads.swf/microad./sidelinead.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.iw.-_gR98Thnd0.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMxTIRXoW8tp5OkbKK1gIIs9gePOZA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a33181351f7b91c3500cc4674786ae3fdc2df3303fb56adb9301b6ea12816ef9

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2aOfU5OhCPx284tEC0P6jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjqtDikmJw0pBiOO90h-k6EEt8fcmkAcRO6TNYg4C49eY51qlAnPTvPGsRELtrXWT1B2JDhUusjiBcdInVE4hVey6xmgLx_XWXWJ8D8dc9l1j_AvHej5dYjwJxkcQV1iYgvt10hfUxEAtxc6z72LyDTeDEwY8cShpJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalF8UYGRiaGBgbGegbG8QUGAPVrSho"
content-security-policy: script-src 'report-sample' 'nonce-2aOfU5OhCPx284tEC0P6jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 rum.js Show response
pagead2.googlesyndication.com/pagead/js/ 71 KB
26 KB 113ms
113ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/rum.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

12969dd0a63e654e9d52998cae3eba0ee1102f963c20ff1a23bba5e98da2ad02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 13944717882201837103
age: 2732
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 08:42:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 05 Oct 2024 07:42:58 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 26573
x-xss-protection: 0
server: cafe

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUx23Wi_0-NC7htHpqrwlfDQTzKl2sA8hAjXnMre0eud_B-gX1lKAvNLzH1ZaIgC1g8bH-HCewht2gMnwpDv-YIxod-Yo6LxX-tJC3ibGiIskmn_eJifkaxYw-UuPL1Zx6w6AIAfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-DGV91DeXfOL-JsA15U_8Hw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw1pBicEqfwRoCxO5aF1n9gfjrnkusf4F478dLrEeBWIibY93H5h1sAidWLOBScknKL4xPzs8rSc0r0U1MKdYFsYsyk0pL8otQ2KllIBU5-enpmXnp8UYGRiaGBgbGegZm8QUGAJPBLrM"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-DGV91DeXfOL-JsA15U_8Hw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.cheapflights.co.il
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUx23Wi_0-NC7htHpqrwlfDQTzKl2sA8hAjXnMre0eud_B-gX1lKAvNLzH1ZaIgC1g8bH-HCewht2gMnwpDv-YIxod-Yo6LxX-tJC3ibGiIskmn_eJifkaxYw-UuPL1Zx6w6AIAfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6zFGXsi5vT21mfPws9akEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw1pBicEqfwRoCxO5aF1n9gfjrnkusf4F478dLrEeBWIibY93H5h1sAgcOrnVRcknKL4xPzs8rSc0r0U1MKdYFsYsyk0pL8otQ2KllIBU5-enpmXnp8UYGRiaGBgbGegZm8QUGAKiYLwM"
content-security-policy: script-src 'report-sample' 'nonce-6zFGXsi5vT21mfPws9akEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.cheapflights.co.il
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUx23Wi_0-NC7htHpqrwlfDQTzKl2sA8hAjXnMre0eud_B-gX1lKAvNLzH1ZaIgC1g8bH-HCewht2gMnwpDv-YIxod-Yo6LxX-tJC3ibGiIskmn_eJifkaxYw-UuPL1Zx6w6AIAfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-TrYnO-sbIdD-6VO8XEeeag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw1ZBicEqfwRoCxO5aF1n9gfjrnkusf4F478dLrEeBWIibY93H5h1sAiumrfRWcknKL4xPzs8rSc0r0U1MKdYFsYsyk0pL8otQ2KllIBU5-enpmXnp8UYGRiaGBgbGegZm8QUGAJckLsU"
content-security-policy: script-src 'report-sample' 'nonce-TrYnO-sbIdD-6VO8XEeeag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.cheapflights.co.il
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUx23Wi_0-NC7htHpqrwlfDQTzKl2sA8hAjXnMre0eud_B-gX1lKAvNLzH1ZaIgC1g8bH-HCewht2gMnwpDv-YIxod-Yo6LxX-tJC3ibGiIskmn_eJifkaxYw-UuPL1Zx6w6AIAfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0L1vaB0us1S6U8koWOOzAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw05BicEqfwRoCxO5aF1n9gfjrnkusf4F478dLrEeBWIibY93H5h1sAh9-7HRTcknKL4xPzs8rSc0r0U1MKdYFsYsyk0pL8otQ2KllIBU5-enpmXnp8UYGRiaGBgbGegZm8QUGAMt6L3s"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0L1vaB0us1S6U8koWOOzAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.cheapflights.co.il
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxXfa_mXhEQnMTNL3UZ9dgSFpN-qvnijp1frfpMtXzYIpcAQsTiyoWvWTirRTiIpS5l0ts-gDPk3qB-dVuT72LcCa_YdadVy9u-j7UmfgevqE7ruPYqGyDvp81Cct3IAwYpTsl126A== Show response
fundingchoicesmessages.google.com/f/ 8 KB
3 KB 136ms
136ms Script
application/javascript 142.250.186.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXfa_mXhEQnMTNL3UZ9dgSFpN-qvnijp1frfpMtXzYIpcAQsTiyoWvWTirRTiIpS5l0ts-gDPk3qB-dVuT72LcCa_YdadVy9u-j7UmfgevqE7ruPYqGyDvp81Cct3IAwYpTsl126A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI4MTE2OTEwLDgyMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw2XSxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly93d3cuY2hlYXBmbGlnaHRzLmNvLmlsLyIsbnVsbCxbWzgsIi1fZ1I5OFRobmQwIl0sWzksIml3Il0sWzE4LCJbW1swXV1dIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2b32ca940adf222e147b273fd91bc8761c2a7855a7662fa96fd752fe6f04a41d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-b7QdPOsC48V39eLhYzLOnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjqtDikmJw0JBiOO90h-k6EEt8fcmkAcRO6TNYg4C49eY51qlAnPTvPGsRELtrXWT1B2JDhUusjiBcdInVE4hVey6xmgLx_XWXWJ8D8dc9l1j_AvHej5dYjwJxkcQV1iYgvt10hfUxEAtxc6z72LyDTeBF51EvJY2k_ML45Py8kqLMpNKS_KK05LTU4tSistSieCMDIxNDAwNjPQPj-AIDAPODShY"
content-security-policy: script-src 'report-sample' 'nonce-b7QdPOsC48V39eLhYzLOnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 18 KB
7 KB 358ms
126ms Script
text/javascript 142.250.185.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f1.1e100.net

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Sat, 05 Oct 2024 08:28:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUx23Wi_0-NC7htHpqrwlfDQTzKl2sA8hAjXnMre0eud_B-gX1lKAvNLzH1ZaIgC1g8bH-HCewht2gMnwpDv-YIxod-Yo6LxX-tJC3ibGiIskmn_eJifkaxYw-UuPL1Zx6w6AIAfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-bpMx7CdFrgLo2_F4vuXrDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmJw15BicEqfwRoCxO5aF1n9gfjrnkusf4F478dLrEeBWIiHY93H5h1sAi_mruhkVHJJyi-MT87PK0nNK9FNTCnWBbGLMpNKS_KLUNipZSAVOfnp6Zl56fFGBkYmhgYGxnoGZvEFBgDUSC9N"
content-security-policy: script-src 'report-sample' 'nonce-bpMx7CdFrgLo2_F4vuXrDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.cheapflights.co.il
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxXRMrFFhljARgyhtln3xuFqNbc7diP6G21Z_reFhh4Q_cOS4ICoJc-EbHk74Jo5cHECvvCHys3em9ogcTWcvkAP6MumIfalQvVGTmEUI4jbnmMlztibGz9SxRhB7xd_8hy3-8a8TQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 141ms
141ms Script
application/javascript 142.250.186.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXRMrFFhljARgyhtln3xuFqNbc7diP6G21Z_reFhh4Q_cOS4ICoJc-EbHk74Jo5cHECvvCHys3em9ogcTWcvkAP6MumIfalQvVGTmEUI4jbnmMlztibGz9SxRhB7xd_8hy3-8a8TQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI4MTE2OTEwLDIyNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd3d3LmNoZWFwZmxpZ2h0cy5jby5pbC8iLG51bGwsW1s4LCItX2dSOThUaG5kMCJdLFs5LCJpdyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

35ba51dfa83d618caebd365610e714bfb04ae7b049d4fac8c5c6ec7fd9926c61

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Ew53Byk0cTY1XoeEUAJnJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjqtDikmII0JBiOO90h-k6EEt8fcmkAcRO6TNYg4C49eY51qlAnPTvPGsRELtrXWT1B2JDhUusjiBcdInVE4hVey6xmgLx_XWXWJ8D8dc9l1j_AvHej5dYjwJxkcQV1iYgvt10hfUxEAvxcKz72LyDTWDBibsTGZU0kvIL45Pz80qKMpNKS_KL0pLTUotTi8pSi-KNDIxMDA0MjPUMjOMLDABJBEp-"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Ew53Byk0cTY1XoeEUAJnJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUSTB7RI8KHfVO2bEX3WTMCWxLzpXZQzOVVulLJU5d7AkECvNR-qjviIGgA6GcWFFVKzH2l2xJNt4nVh3jE6dvF7W2jikv181CgzUxynSvwUrXByGDaBkvS38y-YMQwzOoUm-vwrw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 143ms
143ms Script
application/javascript 142.250.186.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUSTB7RI8KHfVO2bEX3WTMCWxLzpXZQzOVVulLJU5d7AkECvNR-qjviIGgA6GcWFFVKzH2l2xJNt4nVh3jE6dvF7W2jikv181CgzUxynSvwUrXByGDaBkvS38y-YMQwzOoUm-vwrw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI4MTE2OTEwLDM3MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly93d3cuY2hlYXBmbGlnaHRzLmNvLmlsLyIsbnVsbCxbWzgsIi1fZ1I5OFRobmQwIl0sWzksIml3Il0sWzE4LCJbW1swXV1dIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9c086be0c7fbfc566843e1e4601e57259c849329147ed1073889f35fe79a45e2

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-AtiDwmtEkLDszQQ8w9xkrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjqtDikmLw1JBiOO90h-k6EEt8fcmkAcRO6TNYg4C49eY51qlAnPTvPGsRELtrXWT1B2JDhUusjiBcdInVE4hVey6xmgLx_XWXWJ8D8dc9l1j_AvHej5dYjwJxkcQV1iYgvt10hfUxEAvxcKz72LyDTeDC5N03GJU0kvIL45Pz80qKMpNKS_KL0pLTUotTi8pSi-KNDIxMDA0MjPUMjOMLDABJ1EqX"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-AtiDwmtEkLDszQQ8w9xkrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxUBTdj_-BhysJB5wQbGrvLAQ93OEDny9hDbG69YwxVcfL9BX-DfPvqMeRs_FdA3m3M-AdE7BKRWFxW2I3Qy3Tva9WAWJ3NPCvVuykaRYm6ld1ORgd264izahgfOKvMAmNAV8BQ9gw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 124ms
124ms XHR
text/html 142.250.186.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUBTdj_-BhysJB5wQbGrvLAQ93OEDny9hDbG69YwxVcfL9BX-DfPvqMeRs_FdA3m3M-AdE7BKRWFxW2I3Qy3Tva9WAWJ3NPCvVuykaRYm6ld1ORgd264izahgfOKvMAmNAV8BQ9gw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-8iCf-4_DYZWHMGUcFawL5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 05 Oct 2024 08:28:30 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw0ZBicEqfwRoCxO5aF1n9gfjrnkusf4F478dLrEeBWIiHY93H5h1sAgf2_5_KpOSSlF8Yn5yfV5KaV6KbmFKsC2IXZSaVluQXobBTy0AqcvLT0zPz0uONDIxMDA0MjPUMzOILDADxMi-w"
content-security-policy: script-src 'report-sample' 'nonce-8iCf-4_DYZWHMGUcFawL5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://www.cheapflights.co.il
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUx23Wi_0-NC7htHpqrwlfDQTzKl2sA8hAjXnMre0eud_B-gX1lKAvNLzH1ZaIgC1g8bH-HCewht2gMnwpDv-YIxod-Yo6LxX-tJC3ibGiIskmn_eJifkaxYw-UuPL1Zx6w6AIAfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS