www.firstgroup-sa.co.za Open in urlscan Pro
2606:4700::6811:b83a  Public Scan

18 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Page URL
2. https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22

• https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 HTTP 307
• https://onboard.triptease.io/bootstrap/v6723.80224/bootstrap.js

Request Chain 52

• https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
• https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/scripts/jsd/f5fedcf7/invisible.js

Request Chain 88

• https://googleads.g.doubleclick.net/pagead/id HTTP 302
• https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Request Chain 126

• https://googleads.g.doubleclick.net/pagead/id HTTP 302
• https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

156 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Show response dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/	636 B 1 KB	441ms 304ms	Document text/html	52.169.10.20 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.169.10.20 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash a6a10f8500effcbe929f05e79f13739fecce714f02832fe3e16e272ad0a82fd0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers api-deprecated False content-length 636 content-type text/html; charset=utf-8 date Thu, 13 Jul 2023 18:22:50 GMT server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 strict-transport-security max-age=31536000; includeSubDomains x-activity-id ba227d44-2d4c-4db0-88c3-6371a7f203be x-content-type-options nosniff x-ms-activity-id ba227d44-2d4c-4db0-88c3-6371a7f203be x-servicefabricrequestid 3584ce9b-dff9-4044-8d18-6f16f93cb81b c6345bcb-1967-4772-acf4-a652c9ba1ee3
GET H2	200	bot-detection.js Show response mktdplp102cdn.azureedge.net/public/latest/js/	29 KB 11 KB	57ms 9ms	Script application/x-javascript	2606:2800:133:206e:1315:22a5:2006:24fd EDGECAST
General Check archive.org Show headers Download Go to Full URL https://mktdplp102cdn.azureedge.net/public/latest/js/bot-detection.js?v=1.84.2007 Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CDA) / Resource Hash 84eacf3f43bf7b9177fb78c533f34c3930cd517da0295bfd57bd5e01b2400ed8 Request headers accept-language de-DE,de;q=0.9 Referer https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 13 Jul 2023 18:22:51 GMT content-encoding gzip content-md5 Yp+2mkXk4MNv10H73jLLCQ== age 1913 x-cache HIT content-length 10471 x-ms-lease-status unlocked last-modified Tue, 14 Feb 2023 10:25:54 GMT server ECAcc (frc/4CDA) etag 0x8DB0E75DA644AE9 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 86270aa0-b01e-0093-07b2-b588a9000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19
GET DATA	200 OK	truncated /	68 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/png
POST H2	204	cp dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/	0 0	62ms 62ms	Fetch	52.169.10.20 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/cp Requested by Host: mktdplp102cdn.azureedge.net URL: https://mktdplp102cdn.azureedge.net/public/latest/js/bot-detection.js?v=1.84.2007 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.169.10.20 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 13 Jul 2023 18:22:50 GMT x-content-type-options nosniff server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 x-servicefabricrequestid e15bf602-8ec6-448e-a494-2f7aba68cdfa, 8ea15d07-94c7-4970-8056-5b389926eccd x-activity-id b3749fd6-0c8d-4b02-909c-6b3597c8f5e3 x-ms-activity-id b3749fd6-0c8d-4b02-909c-6b3597c8f5e3 content-length 0 api-deprecated False
GET H2	200	Primary Request midlands-saddle-and-trout Show response www.firstgroup-sa.co.za/	110 KB 17 KB	1203ms 235ms	Document text/html	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Requested by Host: mktdplp102cdn.azureedge.net URL: https://mktdplp102cdn.azureedge.net/public/latest/js/bot-detection.js?v=1.84.2007 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5a4ab659ccae3f9b4d730be85a3405af97f53983345b67b923737557a4cf40b3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-cache cf-cache-status DYNAMIC cf-ray 7e638dca9c331c7f-FRA content-encoding br content-type text/html; charset=UTF-8 date Thu, 13 Jul 2023 18:22:52 GMT last-modified Thu, 13 Jul 2023 14:03:06 GMT referrer-policy no-referrer-when-downgrade server cloudflare strict-transport-security max-age=31536000; includeSubdomains; preload vary Accept-Encoding via 1.1 0b0cf39231f2e8a928723d3a28df13cc.cloudfront.net (CloudFront) x-amz-cf-id SbgWOnLhbiCltoC3jIXthKMoOKQwGOxcccg_y8vn9TOMjWxDtHNCPQ== x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
GET H2	200	main.css www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/	306 KB 51 KB	353ms 350ms	Stylesheet text/css	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d18d8c02267735d514d1b55662dd81b79a74863066d4c6145d108a8099b7818 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 95a1a2515bcfe82199fde4e864c4e6f0.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 13 Jul 2023 14:03:12 GMT server cloudflare etag W/"3b16fef5ecdb194db58ab7c13ff72415" x-frame-options SAMEORIGIN vary Accept-Encoding content-type text/css cache-control no-cache cf-ray 7e638dcc2e5f1c7f-FRA x-amz-cf-id JN7oph-LF1emgSclR8NrLl2R5DstH7OtGWf_1ilIR9jf52oskI7ASA==
GET H2	200	gms-latest.min.js Show response cdn.galaxy.tf/asset-galaxy/js/	148 KB 46 KB	383ms 352ms	Script application/javascript	2606:4700::6811:b63a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.galaxy.tf/asset-galaxy/js/gms-latest.min.js?vf380a02f0c84cb86999864eaac80b67b Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b63a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ce4f1b48eedafeaa3d9b02d15dc642b4cc9a995b6e517d6d9bd91d007a420a6c Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=15768000 content-encoding br cf-cache-status DYNAMIC last-modified Tue, 23 Aug 2022 10:13:56 GMT server cloudflare etag W/"250c8-5e6e5d27ceffe-gzip" vary Accept-Encoding content-type application/javascript cache-control max-age=604800 cf-ray 7e638dcc5be63619-FRA alt-svc h3=":443"; ma=86400 expires Thu, 20 Jul 2023 18:22:53 GMT
GET H2	200	css2 fonts.googleapis.com/	33 KB 2 KB	73ms 35ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Great+Vibes&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 26b462068bdb82b16889165aae09e185499c92d7f70e02805f922e9291169a7d Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 13 Jul 2023 18:22:52 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 13 Jul 2023 18:22:52 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 13 Jul 2023 18:22:52 GMT
GET H2	200	CopperplateGothicBold.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	24 KB 24 KB	304ms 300ms	Font font/woff2	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/CopperplateGothicBold.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3d11f751bbfcb3f74bcf60fcd587652038107e810669cd061441a399110e6e91 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 3e49d1b7d94458397e7bc6421c922a18.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 24304 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:39 GMT server cloudflare etag "05f290a1d57a905eaf542dbf89ebc236" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e641c7f-FRA x-amz-cf-id 2CSxehmCTOulBB8Z80mhTrCz4oCp4KqGAQWUHB2jCJ7gkVtH9RHeOg==
GET H2	200	CopperplateGothicBold.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	31 KB 31 KB	607ms 603ms	Font application/x-font-woff	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/CopperplateGothicBold.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4fa9553b8e1c2e83d93cb6409d0c04fbd7f4df5fa073dc09526380b79c74aa6a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 95a1a2515bcfe82199fde4e864c4e6f0.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 31880 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:34 GMT server cloudflare etag "269829e347820b7febfb4e7aaa78cc54" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e651c7f-FRA x-amz-cf-id Y6PPoCWZGIlyZUaqsmu2fAwHKa1HZ-V75U58XRD2hOw9Wfe9JkfYLQ==
GET H2	200	itc_avant_lt_bold.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	20 KB 21 KB	309ms 305ms	Font font/woff2	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_lt_bold.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash be7b85136bd51909802cf9df3eb5a9c4422d6149bb469b07233a0ea591a73b46 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 49fc2f926cfb7dd26ebb967cdc70f29a.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 20920 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:38 GMT server cloudflare etag "e8b0598527bbd215963e47b3e233e901" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e661c7f-FRA x-amz-cf-id E4Vgynnk53SEVY7hnfm0pDawv14Tbjx3_THtN4qqIMpQZo4y3eQSBg==
GET H2	200	itc_avant_lt_bold.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	26 KB 26 KB	176ms 172ms	Font application/x-font-woff	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_lt_bold.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dfda8e97c19d1b57e5c77e515defcd80d7613d7b985bf58fe9abd989ccd5714a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:52 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 89c822bb1ce1445a7be6d1057088cfbe.cloudfront.net (CloudFront) x-amz-cf-pop FRA6-C1 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 26424 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:32 GMT server cloudflare etag "8ab88185bca4bee0496fde06832470ac" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e681c7f-FRA x-amz-cf-id xc8V-UjMz0GHZJYsUlz99VAZip5SYXUFF2Dxovdtbm91HzL7T1puPw==
GET H2	200	itc_avant_medium.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	19 KB 19 KB	489ms 485ms	Font font/woff2	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_medium.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b4e8fdcb8768b79bd2c243c78d8c348e03fbf4627f9ef5efcc6e018c617aa61f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 4448f6f0cf46259e83792c753f97a4de.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 19408 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:34 GMT server cloudflare etag "a8f042db7e5c85da64352b0bf42417fb" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e6b1c7f-FRA x-amz-cf-id J0Y_GQkmPuR_NeC5zjdUvBeSzD-Z3X8yBLOnGmHsA9QkZ4YiK8ZBgw==
GET H2	200	itc_avant_medium.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	24 KB 25 KB	229ms 226ms	Font application/x-font-woff	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_medium.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0cc32f757c93e1f0ead3f3c7a82abd4a1f3627ae69095466d755e0b7b24c1a64 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 d6561aeeccb210202cf78b99f07c5234.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 24868 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:11 GMT server cloudflare etag "dd3aa7f79a8b9f1180b5050369924b1d" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e6c1c7f-FRA x-amz-cf-id N6bXCmeCji-j1hnYC_PwwLH8EQ5SPErwLiTIeitHIAhciVHAKmsjRQ==
GET H2	200	itc_avant_garde_gothic_lt_extra_light-webfont.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	19 KB 19 KB	264ms 261ms	Font font/woff2	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_garde_gothic_lt_extra_light-webfont.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d5d3fc55488572a9b3887994dd1df3fb180c34fb6960f2383b064ee7b304a397 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 40cf8ac59708b6770beb4d2d04bc6ae8.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 19716 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:36 GMT server cloudflare etag "a45078faf891a62a8200df321611aca3" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e6d1c7f-FRA x-amz-cf-id u8Ofip0zVYPU7MkPum3hg0gj2o47S3Wdf1-00kfbHBTWM7Z_xT0kyQ==
GET H2	200	itc_avant_garde_gothic_lt_extra_light-webfont.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	24 KB 25 KB	244ms 241ms	Font application/x-font-woff	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/itc_avant_garde_gothic_lt_extra_light-webfont.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e2fd837706dddcf705eb8f148f17035ef45ab7c7572c561b8490c72a78fb6f1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 bfb83f89a06636844c21e465f3ea5ace.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 24960 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:32 GMT server cloudflare etag "01c6ac5bd7d66dc6f87830ee6e1e6518" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e6f1c7f-FRA x-amz-cf-id Wdprad9AwqfDcXzJ0jqFyzXH1qu4zWdIQ_XrRf-1CqPYsyfcQzGsBg==
GET H2	200	poetr-webfont.woff2 www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	18 KB 19 KB	328ms 325ms	Font font/woff2	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/poetr-webfont.woff2 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1bee18ec8d387da52c83bb979a5ebfd0a81f01e4578a9217246454d7248e8e44 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 81df7b82147a3b8250950ccfe02b7432.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 18916 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:22 GMT server cloudflare etag "68c8e0697ce2d5f4478efe4145025318" x-frame-options SAMEORIGIN vary Accept-Encoding content-type font/woff2 cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e701c7f-FRA x-amz-cf-id 7phna7RrVnCu1rEpHA3d5tUXiOGEUXjOOrA5YWDKslrbWE8zFE40lA==
GET H2	200	poetr-webfont.woff www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/	24 KB 24 KB	231ms 228ms	Font application/x-font-woff	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/fonts/poetr-webfont.woff Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d561b3b5b59d01ba7eb7228cc3f9e7eb550941335bb93f9696b1ebda16debb9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 3222648a6d70343df21c8c5701c2e520.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 content-length 24292 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:27 GMT server cloudflare etag "e071b6ae8c4d4321bd7dfdd1218ebed2" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/x-font-woff cache-control no-cache accept-ranges bytes cf-ray 7e638dcc2e7b1c7f-FRA x-amz-cf-id SUQ2fi9Rzx3wO5CEHZ57WD3n6iW6D4wuWPlOwGd-nm3m1w_-h13XDQ==
GET H2	200	galaxy-helpers.js Show response www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/	56 KB 21 KB	522ms 520ms	Script application/javascript	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/galaxy-helpers.js?v=l-d6915bf4-7324-4b16-ad73-f63d3d4067d0 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e1af5c26a6ca0cf6e1efcd25d203b5d1b890d8d2756d58ca0cfdfafa2f488576 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 aaefb45970dabebd3a727d7be2a72d10.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 03 Nov 2022 06:54:59 GMT server cloudflare etag W/"ef1febd8b777272d6178f74661f8347e" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e638dcc2e7c1c7f-FRA x-amz-cf-id m2ssvD563QzPxzHoYKz5PxpbjnRuJ11jflg38WsYYBwGAew6SBeTDg==
GET H2	200	jquery-3.1.1.min.js Show response www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/	85 KB 31 KB	605ms 603ms	Script application/javascript	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/jquery-3.1.1.min.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1cf30e59d21d4ae560af7143f5913efcc8222bcaa4fcc7508eb802b5faa9e94e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 0b0cf39231f2e8a928723d3a28df13cc.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:32 GMT server cloudflare etag W/"5b5a269bd363e0886c17d855c2aab241" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e638dcc2e7f1c7f-FRA x-amz-cf-id LhrgG2aQUy9esDwIZViQe8TdeswIFM2vYF7s7LnXFDtD9Bjc2mYDug==
GET H2	200	lazysizes.min.js Show response www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/	7 KB 4 KB	285ms 283ms	Script application/javascript	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 06821251a29e71f8fd4f60349667c54d163b16d7bc8b1d47144c7f5042683eef Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 55429e7ef2adea879b483fc335a60902.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:14 GMT server cloudflare etag W/"149ff45fc6c2f13e892e438a58abb77f" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e638dcc2e801c7f-FRA x-amz-cf-id 0wvk3qmPvCoA93tzCfF2DPSLGGLanVkWYv_ywfqXWFs5Q4P_JjSPBQ==
GET H2	200	bundle-evt.min.js Show response www.firstgroup-sa.co.za/integration-shared/shared-evt/public/	14 KB 4 KB	489ms 487ms	Script application/javascript	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration-shared/shared-evt/public/bundle-evt.min.js?vf380a02f0c84cb86999864eaac80b67b Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 21e3b91dff6fbc82e8f064bdff51a687158d9362c8b0c85d1b84cb9d8bea62e3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 b3f4b9d58649ca2204c0fb8174557c62.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Sun, 12 Jun 2022 05:30:15 GMT server cloudflare etag W/"06be9dcc973ab297fdff7ed212970025" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e638dcc2e811c7f-FRA x-amz-cf-id QsY1Lde3udqabhpFIUzx8MKYS2pZnmfFwqPcPPA_uAhMY4_SwFRg5g==
GET H2	200	bundle.js Show response www.firstgroup-sa.co.za/integration/first-hotels/public/js/	1 MB 324 KB	290ms 288ms	Script application/javascript	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/js/bundle.js?vf380a02f0c84cb86999864eaac80b67b Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9d350c18850ccb96442fd9e501dfb290827f44090e10449f25ad95cd782d2d4a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 55429e7ef2adea879b483fc335a60902.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 13 Apr 2023 10:04:37 GMT server cloudflare etag W/"eefd778c350b63df23546d87b71e8df7" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e638dcc2e821c7f-FRA x-amz-cf-id BY2hqywaEB9wpkZl_g_uZHo71ZVp2GfIhmT3NN8EUZIUuWbNiIePkQ==
GET H2	200	bootstrap.js Show response onboard.triptease.io/bootstrap/v6723.80224/ Redirect Chain https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 https://onboard.triptease.io/bootstrap/v6723.80224/bootstrap.js	110 KB 34 KB	30ms 29ms	Script application/javascript	2606:4700:3035::ac43:c0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/bootstrap/v6723.80224/bootstrap.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Server 2606:4700:3035::ac43:c0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b25e43a05e8ce096bdaa1480d6df113cf32b14dd1582db5b62806330e0aec77 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status HIT x-goog-meta-git-hash 0c5110c9468fee9d788e1fdce1d618eb4770da54 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 85217 x-guploader-uploadid ADPycdtbRrBDd98Q_HOtoebaqPK_H9__Yp92YDfHlTiOHWYmpJqVuG8zyaoUGiZJXwWc_Z--cxMKggZDXBdfVBhWJSg7KrkLLWcZ x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-meta-build-version 6723.80224 alt-svc h3=":443"; ma=86400 last-modified Wed, 12 Jul 2023 16:55:32 GMT server cloudflare etag W/"854c2ac03960a6b73107c093a64958f2" vary Accept-Encoding x-goog-generation 1689180932368231 content-type application/javascript; charset=utf-8 access-control-allow-origin * x-goog-hash crc32c=7DIkzA==, md5=hUwqwDlgprcxB8CTpklY8g== access-control-expose-headers Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace cache-control public, max-age=31536000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tga2GoIdKyMizoHNUDknhHAqApfyCiETDu7ZXUqlGIHomcGUyzKvPSyL9yf8RysupFEhe5nWBD1mvE4GqHTWrWfmOrIQhLqI6bebKHcxySj9A%2Banv5e8W7epF6SpTXbNdPmQb6B7fpWrMG9FT5qwtSboNg%3D%3D"}],"group":"cf-nel","max_age":604800} x-goog-stored-content-length 112637 cf-ray 7e638dcfbfebbbf5-FRA expires Thu, 11 Jul 2024 18:00:56 GMT Redirect headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=15552000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=COWtGY1zmUIS1QhHuKuYHyoZ5bXP247D5L4guFveNUzKhcnZUP0H%2F02iaP6ZpfxNkT0igaeA%2Ffsjy8lOELKuem8n6oZ1UgxMKYW56ucnuwDIJwcFM0IAC5PLhJ4H51Kp4heKBwQPDisajlIf63tjSX5TUw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/plain;charset=UTF-8 location https://onboard.triptease.io/bootstrap/v6723.80224/bootstrap.js access-control-allow-origin * cache-control public, max-age=600 cf-ray 7e638dcf6f72bbf5-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept content-length 63 alt-svc h3=":443"; ma=86400
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	171 KB 47 KB	38ms 8ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 2da988427b34614d705adbf808e2e61d91f67bf147db9049e34c99b3624171e8 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 13 Jul 2023 18:22:53 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 46863 x-xss-protection 0 pragma public x-fb-debug igUdex+9cnpHPUM0vDCVZ6pBYdqDcj1YxdWlW0cM2QuAsjhEA0PEddyhlJuGxlzN5KC+w6DPwH/NED6HBEzfYQ== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	260 KB 81 KB	57ms 21ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-TL2MM4B Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 62af7883b89c94cc23e5c969adb06f1098350728ebab16a2a1dc988be6c36a91 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 82023 x-xss-protection 0 last-modified Thu, 13 Jul 2023 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 13 Jul 2023 18:22:53 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	310 KB 96 KB	82ms 47ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 80c56095d775827544786aa94fc489d384ea63281881ceb3b5c0438a22ea2531 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 97672 x-xss-protection 0 last-modified Thu, 13 Jul 2023 18:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 13 Jul 2023 18:22:53 GMT
GET H2	200	NIVQmaxs6TE www.youtube.com/embed/ Frame EC1C	79 KB 0	147ms 110ms	Document text/html	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding br content-type text/html; charset=utf-8 cross-origin-opener-policy-report-only same-origin; report-to="youtube_main" cross-origin-resource-policy cross-origin date Thu, 13 Jul 2023 18:22:53 GMT expires Mon, 01 Jan 1990 00:00:00 GMT origin-trial AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info." permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=* pragma no-cache report-to {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} server ESF strict-transport-security max-age=31536000 vary Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-content-type-options nosniff x-xss-protection 0
GET H3	200	dropdown-arrow-white.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	199 B 650 B	211ms 210ms	Image image/png	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/dropdown-arrow-white.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 10eaf3872d6ccfe8f2c38bc9b82600923bddfdb99d634b5b1acc7b52d1a2c9b8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 3e49d1b7d94458397e7bc6421c922a18.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 199 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:21 GMT server cloudflare etag "53cee396e71b580c087c48787e715a41" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e638dcf3e24bb44-FRA x-amz-cf-id QAnEBf7BmYJPLkHTgXKXkIfqXeWcBD7TmN0U7HaDCjMZQa-MUSMHfg==
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v35/	47 KB 48 KB	52ms 14ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Great+Vibes&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 00:21:44 GMT x-content-type-options nosniff age 496869 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48412 x-xss-protection 0 last-modified Tue, 02 May 2023 15:08:53 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 00:21:44 GMT
GET H2	200	RWmMoKWR9v4ksMfaWd_JN9XFiaQ.woff2 fonts.gstatic.com/s/greatvibes/v15/	34 KB 34 KB	66ms 28ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/greatvibes/v15/RWmMoKWR9v4ksMfaWd_JN9XFiaQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Great+Vibes&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4828fd073a3b3ae17675d358262414d34cee95b4b94a4ab41a8e335a2015eb0c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 09:16:06 GMT x-content-type-options nosniff age 464807 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 34860 x-xss-protection 0 last-modified Tue, 02 May 2023 15:43:21 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 09:16:06 GMT
GET H2	200	memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2 fonts.gstatic.com/s/opensans/v35/	49 KB 49 KB	23ms 22ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v35/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Great+Vibes&family=Open+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3642c7e774562f7483d7b0de93dd1759fc6928e85eebd7e62ddae72e9d46c9cb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 12:23:10 GMT x-content-type-options nosniff age 453583 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 50440 x-xss-protection 0 last-modified Tue, 02 May 2023 15:13:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 12:23:10 GMT
GET H2	200	1724388720976059 Show response connect.facebook.net/signals/config/	376 KB 108 KB	73ms 72ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1724388720976059?v=2.9.111&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 1132655a6c2fd3530408af6c640fe5c9d0bc52f39fdac70e095017fc20644656 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 13 Jul 2023 18:22:53 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug paTY32cv4XQloTbo6xcXuH2rlzG/GhJBRtvZxJwtJ0xPSSRqUeqnTcwtWm/iIchuF4GfKkNhPc/0jfqHU2SDBQ== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET		www-player.css www.youtube.com/s/player/f2f137c6/ Frame EC1C	0 0
GET		www-embed-player.js www.youtube.com/s/player/f2f137c6/www-embed-player.vflset/ Frame EC1C	0 0
GET		base.js www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/ Frame EC1C	0 0
GET		fetch-polyfill.js www.youtube.com/s/player/f2f137c6/fetch-polyfill.vflset/ Frame EC1C	0 0
GET H2	200	optimize.js Show response www.googleoptimize.com/	129 KB 50 KB	268ms 41ms	Script application/javascript	2a00:1450:4001:806::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleoptimize.com/optimize.js?id=OPT-KZT9Z7N Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8c9db1091218e3d3062cab440788318209d4adfb0477ec3ab5592199a0810913 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 50651 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 13 Jul 2023 18:22:53 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	235ms 13ms	Script text/javascript	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 13 Jul 2023 16:35:19 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 6454 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Thu, 13 Jul 2023 18:35:19 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/684551382/	3 KB 2 KB	275ms 56ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/684551382/?random=1689272573496&cv=11&fst=1689272573496&bg=ffffff&guid=ON&async=1&gtm=45He37a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&hn=www.googleadservices.com&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&auid=1867946602.1689272573&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash eaf05261d4bf6c9fa07e1010430b17892fd53450840f6b5a39af0a9b088aa1c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1425 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/684551679/	3 KB 2 KB	274ms 56ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/684551679/?random=1689272573499&cv=11&fst=1689272573499&bg=ffffff&guid=ON&async=1&gtm=45He37a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&hn=www.googleadservices.com&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&auid=1867946602.1689272573&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 56269474f1058a0cefbd59caff96a34f6f06157e8238ed3de8db74725c052e4e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1429 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	hotjar-3449617.js Show response static.hotjar.com/c/	9 KB 4 KB	268ms 53ms	Script application/javascript	18.66.192.125 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-3449617.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.192.125 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-192-125.muc50.r.cloudfront.net Software / Resource Hash bf98f0b63c4a21479f9a01af8c8d1fb6a3826e7475fd2e32e99b923c7a551e3d Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=2592000; includeSubDomains via 1.1 28e56b9ddced4ed414e75f87cbd0d976.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P1 etag W/833e95a31e74271cc71044581d9d35e9 vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=60 x-cache-hit 1 cross-origin-resource-policy cross-origin x-amz-cf-id dqnxjFiTdjTO-W-pl6Ozb9zoITpb2eQyyOFKaI77Rvawb2T5ePeg2Q==
GET H2	200	107113 Show response api.tsa-db.com/v1/data/hotelID/	649 B 1 KB	86ms 84ms	XHR application/json	2600:9000:20c3:9c00:16:41f8:18c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.tsa-db.com/v1/data/hotelID/107113 Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:9c00:16:41f8:18c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 93619b71cc25325842f98db0621271251bcaf7b5a640bf7c65d323c2c3895741 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Response headers date Thu, 13 Jul 2023 18:22:53 GMT via 1.1 ae3f020e2e89e632d339db198e9ba75a.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-amzn-trace-id Root=1-64b040fd-451300f47d407b2270d8403f;Sampled=0;lineage=688c80a0:0 x-amzn-requestid 9823cb69-c04c-4c62-a964-c0fcd1fbca77 x-cache Miss from cloudfront content-type application/json; charset=utf-8 access-control-allow-origin * cache-control max-age=600 access-control-allow-credentials true x-amz-apigw-id IA8XsHBEjoEFuAw= content-length 649 x-amz-cf-id 3yVwZIn_CPcgN3QjIZ3JWWrMhl4ZbpF9QCJmE6x30WKTgkEVhe2U7g==
POST H/1.1	200 OK	869 Show response dynamic.travelclick-websolutions.com/view/	13 KB 4 KB	599ms 230ms	XHR application/json	195.244.31.25 IGUANA-WORLDWIDE
General Check archive.org Show headers Download Go to Full URL https://dynamic.travelclick-websolutions.com/view/869 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/js/bundle.js?vf380a02f0c84cb86999864eaac80b67b Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.244.31.25 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US), Reverse DNS xo7-viplb-01-new.ny.ig-1.net Software Apache / Resource Hash d8da6e8589ac913a1cfc4b78c7e4bf9c95145939f6557af3267ca133448f4be0 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Accept */* Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Pragma no-cache Date Thu, 13 Jul 2023 18:22:54 GMT Content-Encoding gzip Strict-Transport-Security max-age=15768000 Server Apache Vary Accept-Encoding Access-Control-Allow-Methods POST, GET, OPTIONS Content-Type application/json Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate X-Real-Hostname xo7-web-02 Content-Length 3628 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET		NIVQmaxs6TE www.youtube.com/embed/ Frame 706C	0 0
GET		NIVQmaxs6TE www.youtube.com/embed/ Frame 9A84	0 0
GET H3	200	NIVQmaxs6TE Show response www.youtube.com/embed/ Frame D2D9	78 KB 32 KB	96ms 83ms	Document text/html	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/js/bundle.js?vf380a02f0c84cb86999864eaac80b67b Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 7d43c3037b26911ccc9dd0f8bbf55998bfaa5ec4420419bb11428743d84101f2 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding br content-type text/html; charset=utf-8 cross-origin-opener-policy-report-only same-origin; report-to="youtube_main" cross-origin-resource-policy cross-origin date Thu, 13 Jul 2023 18:22:53 GMT expires Mon, 01 Jan 1990 00:00:00 GMT origin-trial AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=* pragma no-cache report-to {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} server ESF strict-transport-security max-age=31536000 vary Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-content-type-options nosniff x-xss-protection 0
GET H3	200	dropdown-arrow2.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	396 B 675 B	194ms 193ms	Image image/svg+xml	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/dropdown-arrow2.svg Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67048f24f9e15b8d779c632b86d09c4d9c9bb887a3142132bbb5f103e5163e11 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/css/custom/869/47/main/3bbc187d14706cb692aa934fac090dc4/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 b3f4b9d58649ca2204c0fb8174557c62.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:33 GMT server cloudflare etag W/"51cd4cc2e178cdd8a0860500f595e434" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e638dd1590bbb44-FRA x-amz-cf-id 0Al6Y0zcQZdDxlr2QGX9izR7h2tHRBorTmff3smmqGDpx9hw7Ud0KA==
GET H3	200	initPersonalization.bundle.js Show response www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/	20 KB 8 KB	260ms 260ms	Script application/javascript	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/initPersonalization.bundle.js?ver=9e12c2ffed8b366e72d7 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/frontend/galaxy-helpers/public/galaxy-helpers.js?v=l-d6915bf4-7324-4b16-ad73-f63d3d4067d0 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7022cad501999201306c3542290df7945db17d5249478c3b8295b4e4d85ba6eb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 3222648a6d70343df21c8c5701c2e520.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 03 Nov 2022 06:54:59 GMT server cloudflare etag W/"b7eaa1851b39189f3089e87af9633eb2" x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript cache-control no-cache cf-ray 7e638dd16925bb44-FRA x-amz-cf-id uYWpy6rn7VJt35iHWbamb05Wn97LirLBMZ8aL5eEXgUGJjJLB15hrg==
GET H3	200	favicon.ico www.firstgroup-sa.co.za/integration/first-hotels/public/images/	10 KB 10 KB	235ms 234ms	Image image/x-icon	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/favicon.ico Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cde46b19a4a03ecf7f50494b16efb67476affd0fc21021b57d0a9ebdd72cd2ab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 4448f6f0cf46259e83792c753f97a4de.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:30 GMT server cloudflare etag W/"2f25f9ec6b8e9ac274f2279472a502a1" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/x-icon cache-control no-cache cf-ray 7e638dd1793fbb44-FRA x-amz-cf-id VEcKPDd-XIpp2Rwl8F4d2rvz0Uvrp0J-xxGyaevCc87H8NfiT64fVA==
GET H2	200	midlands-saddle-trout_logo.png image-tc.galaxy.tf/wipng-bwsbz4ladjitzhtg5dy7jctzr/	9 KB 9 KB	540ms 495ms	Image image/png	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wipng-bwsbz4ladjitzhtg5dy7jctzr/midlands-saddle-trout_logo.png?width=200 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d3ccf3dab9c5fb2c6e9d4973b90d7d39b5821030d73ad6a91590f2dd0cc31c9 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:54 GMT x-amz-version-id IYxtpUGp3FnA75PGZn0ij76fnip9EPU1 x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 b0954612f115b3d0a0db0a669e45ae8e.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 8793 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Wed, 22 Jun 2022 13:18:21 GMT server cloudflare etag "b94953d0f3ad5ce26ff72763cf86fd71" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/png access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd1c92e4d2b-FRA x-amz-cf-id gp-nryn4u-ITl83n34lsqE-CtnIYGMdIUussozcpaEPLpbZ8LlwG_g==
OPTIONS H2	200	107113 api.tsa-db.com/v1/data/hotelID/ Frame	0 0	165ms 26ms	Preflight application/json	2600:9000:20c3:9c00:16:41f8:18c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.tsa-db.com/v1/data/hotelID/107113 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20c3:9c00:16:41f8:18c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.firstgroup-sa.co.za Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent access-control-allow-methods OPTIONS,GET access-control-allow-origin * access-control-max-age 86400 age 5499 cache-control max-age=86400, s-maxage=86400, proxy-revalidate content-length 0 content-type application/json date Thu, 13 Jul 2023 16:51:14 GMT via 1.1 ae3f020e2e89e632d339db198e9ba75a.cloudfront.net (CloudFront) x-amz-apigw-id IAu8bHBQjoEFtgw= x-amz-cf-id 4vIwHfvxqK8faq3sSD2HTDcgxcX69bYDpurwTR5Q36P18TMFsbRLTw== x-amz-cf-pop MUC50-C1 x-amzn-requestid de83f887-ce95-4837-90f8-edf5b02a39ec x-cache Hit from cloudfront
GET H3	200	kernel-host.html Show response onboard.triptease.io/kernel/v6723.80224/ Frame 50B1	57 KB 19 KB	41ms 21ms	Document text/html	2606:4700:3035::ac43:c0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/kernel/v6723.80224/kernel-host.html?originHost=www.firstgroup-sa.co.za Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:c0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b78743307d11fd68f62eb7687efaf3d698ffe21050ef33516e9eb936787e1ef3 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type age 85207 alt-svc h3=":443"; ma=86400 cache-control public, max-age=31536000 cf-cache-status HIT cf-ray 7e638dd1efd918e2-FRA content-encoding br content-type text/html; charset=utf-8 date Thu, 13 Jul 2023 18:22:53 GMT expires Thu, 11 Jul 2024 18:42:46 GMT last-modified Wed, 12 Jul 2023 16:55:25 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R2rEaF1nR86%2F%2BhpOAJgV1qoje4xcy1cZxS%2FjGASYOq6D%2FGX9hVHK0BIum28lmDjhwu381AJDRUX5exwn8uVStzUcoGTjmNKU3kMODpo1yCvjJVaIZvpLMyKfybUH7%2FI7cuGjUzwjlDVDTTEW8poggcZ%2BRw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1689180925751385 x-goog-hash crc32c=ddxp/Q== md5=mxOyPz1oQY5gFn/kbkbFLw== x-goog-meta-build-version 6723.80224 x-goog-meta-git-hash 0c5110c9468fee9d788e1fdce1d618eb4770da54 x-goog-metageneration 2 x-goog-storage-class MULTI_REGIONAL x-goog-stored-content-encoding identity x-goog-stored-content-length 58293 x-guploader-uploadid ADPycdsVk-6rkDp7B18udYjIV6joeRSF-Kd2rO2x5tqaRd_CRQcK7IrZtVD_FXwKE61mMSUWOInafnypc_9pkpmAESea-eq-3UfV
GET H3	200	invisible.js Show response www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/scripts/jsd/f5fedcf7/ Frame 0C19 Redirect Chain https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/scripts/invisible.js https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/scripts/jsd/f5fedcf7/invisible.js	7 KB 3 KB	13ms 13ms	Script application/javascript	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/scripts/jsd/f5fedcf7/invisible.js Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c611844ba12d90fb60a27c6b4d2f1cb6cb08d44350eb4717686632daec1b749c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br x-content-type-options nosniff server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public cf-ray 7e638dd1d9b3bb44-FRA alt-svc h3=":443"; ma=86400 Redirect headers date Thu, 13 Jul 2023 18:22:53 GMT server cloudflare vary accept-encoding access-control-allow-origin * location /cdn-cgi/challenge-platform/h/g/scripts/jsd/f5fedcf7/invisible.js cache-control max-age=300, public cf-ray 7e638dd1b98bbb44-FRA alt-svc h3=":443"; ma=86400
GET H2	200	1004973-10041242.js Show response cdn-4.convertexperiments.com/js/	231 KB 68 KB	121ms 74ms	Script application/javascript	2a02:26f0:1700:189::14a9 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn-4.convertexperiments.com/js/1004973-10041242.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:189::14a9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 3e8aead277c0bd324292cb99774e1696da1abb0de2960c8a63f1e301944a4838 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-type application/javascript date Thu, 13 Jul 2023 18:22:53 GMT content-encoding gzip cache-control public, max-age=300 vary Accept-Encoding expires Thu, 13 Jul 2023 18:27:53 GMT
GET H3	200	831287870643310 Show response connect.facebook.net/signals/config/	305 KB 87 KB	12ms 12ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/831287870643310?v=2.9.111&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash d1ea5254bb3b52ef9128d62ec65822471fb3d07a897b11eaee89dd71832d282e Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 13 Jul 2023 18:22:53 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 88837 x-xss-protection 0 pragma public x-fb-debug Som26ldJFl50iP6Ux0Ypo1QaSBh57lZe9WLWKlv0oKtsca0syL90DZdRDkIsWNinbFbWX1p4AIuc77SB04heng== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	48ms 11ms	Image text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1724388720976059&ev=PageView&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DTFQhuH8N3pYUloW1WkmZVjUjd0KyLze5o_Ta0VB2Ivs&rl=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&if=false&ts=1689272573732&sw=1600&sh=1200&v=2.9.111&r=stable&ec=0&o=30&fbp=fb.2.1689272573729.294404374&cs_est=true&it=1689272573414&coo=false&rqm=GET Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 13 Jul 2023 18:22:53 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
POST H3	200	7e638dca9c331c7f Show response www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 0C19	0 301 B	31ms 29ms	XHR text/plain	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/h/g/cv/result/7e638dca9c331c7f Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/cdn-cgi/challenge-platform/scripts/invisible.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Response headers date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br server cloudflare cf-ray 7e638dd30b24bb44-FRA alt-svc h3=":443"; ma=86400 content-type text/plain; charset=UTF-8
GET H3	200	www-player.css www.youtube.com/s/player/f2f137c6/ Frame D2D9	376 KB 47 KB	14ms 14ms	Stylesheet text/css	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/f2f137c6/www-player.css Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fd4092bacea7c442fc5033af93696fb2544bc58e71bf9eb40658694fd464f4a4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 16:11:15 GMT content-encoding br x-content-type-options nosniff age 7898 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 47941 x-xss-protection 0 last-modified Mon, 10 Jul 2023 01:48:40 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Fri, 12 Jul 2024 16:11:15 GMT
GET H3	200	www-embed-player.js Show response www.youtube.com/s/player/f2f137c6/www-embed-player.vflset/ Frame D2D9	311 KB 93 KB	24ms 23ms	Script text/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/f2f137c6/www-embed-player.vflset/www-embed-player.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 63e7450a89e66a53c8e02170ecd4a746fdb98b075d540b0537b79df6f63ffdf6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 16:52:04 GMT content-encoding br x-content-type-options nosniff age 5449 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 95618 x-xss-protection 0 last-modified Mon, 10 Jul 2023 01:48:40 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Fri, 12 Jul 2024 16:52:04 GMT
GET H3	200	base.js Show response www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/ Frame D2D9	2 MB 754 KB	29ms 28ms	Script text/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 351f8ad90f9ab93eae3461926df367e60e8bc2a805490a7a6965be7540050daa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Wed, 12 Jul 2023 14:17:38 GMT content-encoding gzip x-content-type-options nosniff age 101115 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 772453 x-xss-protection 0 last-modified Mon, 10 Jul 2023 01:48:40 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 11 Jul 2024 14:17:38 GMT
GET H3	200	fetch-polyfill.js Show response www.youtube.com/s/player/f2f137c6/fetch-polyfill.vflset/ Frame D2D9	9 KB 3 KB	28ms 27ms	Script text/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/f2f137c6/fetch-polyfill.vflset/fetch-polyfill.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ac8177161c3038b07597ec544de3c00f46e1a0aa6b4b4c045ff0495553cc5069 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 16:54:15 GMT content-encoding br x-content-type-options nosniff age 5318 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2625 x-xss-protection 0 last-modified Mon, 10 Jul 2023 01:48:40 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Fri, 12 Jul 2024 16:54:15 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	226 KB 79 KB	22ms 21ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-3R5SJEDWK4&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TL2MM4B Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 01b7633625ebedd4d30d299f4425d5aec7c123c1a0589eaecec1f92553d770e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 80402 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 13 Jul 2023 18:22:53 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	230 KB 80 KB	28ms 27ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-LP9ZQF3SMX&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9Q4XPK Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f43a0aa0e9019d7c2552c390374ffd94e2a36814d41a9fa7b35332f9fc1e262c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:53 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 82030 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 13 Jul 2023 18:22:53 GMT
GET H3	200	2351337388229475 Show response connect.facebook.net/signals/config/	382 KB 109 KB	13ms 10ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/2351337388229475?v=2.9.111&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 07202ea8f693f219bc6e1aa8d92c27082d5dc8f5e4bf26f9676cea3d63bdc5a8 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 13 Jul 2023 18:22:53 GMT document-policy force-load-at-top content-security-policy-report-only default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 111316 x-xss-protection 0 pragma public x-fb-debug R8kk4SvUR4aHGRgOrd7MmeqW9T0nk4I476LIJIKsqhwg6v+MIN3i6gJR4zTpEri5jbFKjo2N0De12fbTSKA9YQ== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=() priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 31 B	12ms 8ms	Image text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=831287870643310&ev=PageView&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DTFQhuH8N3pYUloW1WkmZVjUjd0KyLze5o_Ta0VB2Ivs&rl=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&if=false&ts=1689272573970&sw=1600&sh=1200&v=2.9.111&r=stable&ec=0&o=30&fbp=fb.2.1689272573729.294404374&it=1689272573414&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 13 Jul 2023 18:22:53 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H3	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v18/ Frame D2D9	15 KB 15 KB	18ms 18ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Wed, 12 Jul 2023 00:06:15 GMT x-content-type-options nosniff age 152198 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15344 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:32:55 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 11 Jul 2024 00:06:15 GMT
GET H3	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v18/ Frame D2D9	15 KB 15 KB	22ms 19ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 17:47:45 GMT x-content-type-options nosniff age 434108 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15552 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:33:02 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 17:47:45 GMT
GET H2	200	firstresortslogo-100.png image-tc.galaxy.tf/wipng-c6svrhnya6za08pxmjouujwtv/	14 KB 14 KB	497ms 491ms	Image image/png	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wipng-c6svrhnya6za08pxmjouujwtv/firstresortslogo-100.png?width=220 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 61877efbe8988e059aeb854788d1badb0da79a9fe4e05f662022e283cab17ec2 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:54 GMT x-amz-version-id 3yLuIvmxBBJBRTZMu2SOWPIHeH1T3m2x x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 14516 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Tue, 14 Sep 2021 08:19:34 GMT server cloudflare etag "096908df255a88c44659153406f193a1" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/png access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd38c164d2b-FRA x-amz-cf-id Ps9wDwqwT8S_HuDgLUI838ln5939ek3UKTTHaJGEvjTas93xT-8lAQ==
GET H2	200	3-stars.png image-tc.galaxy.tf/wipng-1eqsyl9kdk9c262hepoau5qvf/	50 KB 50 KB	518ms 513ms	Image image/png	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wipng-1eqsyl9kdk9c262hepoau5qvf/3-stars.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c15f0fe9f52687970a5392e3c23a6960b905f8c7f7d3c144d5ab3ba9e945020 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:54 GMT x-amz-version-id u5oseC8ADM6BZzUGietU6pYHq1FakaYo x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 e7e7960d7731a7583cedd8f1ff1aca38.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC alt-svc h3=":443"; ma=86400 content-length 51245 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Thu, 23 Mar 2023 12:04:35 GMT server cloudflare etag "75280d850c0740859961e120a1f95023" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/png access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd38c184d2b-FRA x-amz-cf-id izZXbhAcuQ3eIZ2TVPcI0TED6oLkxDbNe4KcydSCkTgoKOy9WoSOZA==
GET H3	200	kernel.js onboard.triptease.io/kernel/v6723.80224/ Frame 50B1	63 KB 20 KB	34ms 34ms	Other application/javascript	2606:4700:3035::ac43:c0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/kernel/v6723.80224/kernel.js? Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:c0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 64bc5a3d83430341c57babaaea1963842b76a3f66e2e46d38116a2b68b71f2e5 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers accept-language de-DE,de;q=0.9 Referer https://onboard.triptease.io/kernel/v6723.80224/kernel-host.html?originHost=www.firstgroup-sa.co.za User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:54 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status HIT x-goog-meta-git-hash 0c5110c9468fee9d788e1fdce1d618eb4770da54 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 91325 x-guploader-uploadid ADPycdsocPNZDCPSMSljJUGTi0JQO6BcI4BlOwmEYPMKYOsKhQgB7eJYM8ggSkez5TfCL3waf-No1QPIiS1Us3Zmc0xbSA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-meta-build-version 6723.80224 alt-svc h3=":443"; ma=86400 last-modified Wed, 12 Jul 2023 16:55:25 GMT server cloudflare etag W/"5cb7eb80f994a21d3d93473b2136bde3" vary Accept-Encoding x-goog-generation 1689180925808984 content-type application/javascript; charset=utf-8 access-control-allow-origin * x-goog-hash crc32c=OC4uaA==, md5=XLfrgPmUoh09k0c7ITa94w== access-control-expose-headers Content-Type cache-control public, max-age=31536000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xY3xuniCvVHzGj0KTq3kdjEtoQgFf8%2F1bhekV%2FsVWpUMIdEsJxanW1slRvUj%2BJqfHdcXqCA%2BaaAPpKyozXsvndywxq9YmVckVkm2NoV5gACGtYMUxQ85EwDVvlkgphIFSnIba%2FmEC885ld8DDR9xIDY0NQ%3D%3D"}],"group":"cf-nel","max_age":604800} x-goog-stored-content-length 64193 cf-ray 7e638dd3aa7b18e2-FRA expires Thu, 11 Jul 2024 17:00:49 GMT
GET H2	200	modules.fba0c9b2e1c5e125e170.js Show response script.hotjar.com/	270 KB 69 KB	99ms 21ms	Script application/javascript	18.173.154.61 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.fba0c9b2e1c5e125e170.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-3449617.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.173.154.61 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-173-154-61.muc50.r.cloudfront.net Software / Resource Hash 4e930b31445643295bfd2cfaeeaba015e08766fd8b7ff3b61db88003ad6720a0 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 07:23:07 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=2592000; includeSubDomains via 1.1 d11d7fba872e54649066e59f703ad3e6.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P3 age 298787 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 70330 last-modified Mon, 10 Jul 2023 07:22:19 GMT etag "0054d18e8d659772b0e915a12ecd8b15" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-robots-tag none x-amz-cf-id A7Hgly4BUFLZOJJuxxVcNTIzkVMtHz_hfvr7kQwMx467--PKzaI5xA==
GET H2	200	/ www.google.com/pagead/1p-user-list/684551382/	42 B 108 B	91ms 28ms	Image image/gif	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/684551382/?random=1689272573496&cv=11&fst=1689271200000&bg=ffffff&guid=ON&async=1&gtm=45He37a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&fmt=3&is_vtc=1&random=3832815807&rmt_tld=0&ipr=y Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/684551382/	42 B 455 B	89ms 26ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/684551382/?random=1689272573496&cv=11&fst=1689271200000&bg=ffffff&guid=ON&async=1&gtm=45He37a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&fmt=3&is_vtc=1&random=3832815807&rmt_tld=1&ipr=y Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/684551679/	42 B 455 B	91ms 27ms	Image image/gif	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/684551679/?random=1689272573499&cv=11&fst=1689271200000&bg=ffffff&guid=ON&async=1&gtm=45He37a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&fmt=3&is_vtc=1&random=3793848430&rmt_tld=0&ipr=y Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/684551679/	42 B 108 B	89ms 26ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/684551679/?random=1689272573499&cv=11&fst=1689271200000&bg=ffffff&guid=ON&async=1&gtm=45He37a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&ref=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&frm=0&tiba=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&fmt=3&is_vtc=1&random=3793848430&rmt_tld=1&ipr=y Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	3 B 214 B	32ms 24ms	XHR text/plain	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=59267360&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&dp=%2Fmidlands-saddle-and-trout&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHBACEABRAAAACAAI~&jid=462696873&gjid=1861127149&cid=1363120108.1689272574&tid=UA-98837830-1&_gid=1119738476.1689272574&_r=1&_slc=1&gtm=45He37a0n81K9Q4XPK&cd1=no_data&cd2=not_applicable&cd4=not_applicable&cd5=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&z=63840455 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	3 B 68 B	34ms 32ms	XHR text/plain	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=59267360&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACEABRAAAACAEK~&jid=1258653074&gjid=1776177034&cid=1363120108.1689272574&tid=UA-162681275-1&_gid=1119738476.1689272574&_r=1&_slc=1&gtm=45He37a0n81TL2MM4B&cd1=not_applicable&cd2=not_applicable&cd3=First%20Group%20Management%20MB&cd4=First%20Resorts&cd5=107113&cd6=Midlands%20Saddle%20Trout&cd7=Mooi%20River&cd8=South%20Africa&cd9=KwaZulu-Natal&cd10=middle_east_and_africa&cd11=Africa&cd12=galaxy&cd13=custom&cg1=web&cg2=not_applicable&cg3=group_property&cd19=tvs_no&cd20=iHotelier%20BE4&cd21=group_property&cd22=0&cd23=4&cd24=1&cd25=en&cd26=web&cd27=not_applicable&cd28=not_applicable&cd29=not_applicable&cd30=no&cd31=no&cd34=%7C&cd36=%7C&cd38=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DTFQhuH8N3pYUloW1WkmZVjUjd0KyLze5o_Ta0VB2Ivs&cd39=firstgroup-sa.co.za&cd40=firstgroup-sa.co.za&cd41=GTM-TL2MM4B&cd42=64&cd54=be4&cd59=0&z=1996112278 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	4 B 24 B	24ms 23ms	XHR text/plain	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=59267360&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACEABRAAAACAEK~&jid=1863364077&gjid=1070624354&cid=1363120108.1689272574&tid=UA-135537499-5&_gid=1119738476.1689272574&_r=1&_slc=1&gtm=45He37a0n81K9Q4XPK&cd1=not_set&cd2=not_applicable&cd3=not_applicable&cd4=not_applicable&cd5=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DTFQhuH8N3pYUloW1WkmZVjUjd0KyLze5o_Ta0VB2Ivs&cd6=Mooi%20River&cd7=South%20Africa&cd8=KwaZulu-Natal&cd9=en&cd10=First%20Resorts&cd11=107113&cd12=Midlands%20Saddle%20Trout&cd13=0&cd14=no&cg1=not_applicable&cd20=no&z=1746960065 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	4 B 24 B	23ms 22ms	XHR text/plain	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=59267360&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACEABRAAAACAEK~&jid=1082317423&gjid=848561107&cid=1363120108.1689272574&tid=UA-135537499-1&_gid=1119738476.1689272574&_r=1&_slc=1&gtm=45He37a0n81K9Q4XPK&cd1=not_set&cd2=not_applicable&cd3=not_applicable&cd4=not_applicable&cd5=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DTFQhuH8N3pYUloW1WkmZVjUjd0KyLze5o_Ta0VB2Ivs&cd6=Mooi%20River&cd7=South%20Africa&cd8=KwaZulu-Natal&cd9=en&cd10=First%20Resorts&cd11=107113&cd12=Midlands%20Saddle%20Trout&cd13=0&cd14=no&cg1=not_applicable&cd20=no&z=1819586289 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	14ms 13ms	Image image/gif	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=59267360&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&ul=en-us&de=UTF-8&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Google%20Optimize&ea=2kyco3QpSfCTG6iMjPW3Sg&_u=aHDACEABRAAAACAEK~&jid=&gjid=&cid=1363120108.1689272574&tid=UA-135537499-1&_gid=1119738476.1689272574&gtm=45He37a0n81K9Q4XPK&cd1=not_set&cd2=not_applicable&cd3=not_applicable&cd4=not_applicable&cd5=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DTFQhuH8N3pYUloW1WkmZVjUjd0KyLze5o_Ta0VB2Ivs&cd6=Mooi%20River&cd7=South%20Africa&cd8=KwaZulu-Natal&cd9=en&cd10=First%20Resorts&cd11=107113&cd12=Midlands%20Saddle%20Trout&cd13=0&cd14=no&cg1=not_applicable&cd20=no&z=999915859 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 07:45:03 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 38271 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 355 B	64ms 19ms	XHR text/plain	2a00:1450:400c:c07::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-135537499-5&cid=1363120108.1689272574&jid=1863364077&gjid=1070624354&_gid=1119738476.1689272574&_u=aHDACEABRAAAACAEK~&z=1824424056 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 70 B	65ms 20ms	XHR text/plain	2a00:1450:400c:c07::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-135537499-1&cid=1363120108.1689272574&jid=1082317423&gjid=848561107&_gid=1119738476.1689272574&_u=aHDACEABRAAAACAEK~&z=860404610 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 260 B	47ms 17ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-3R5SJEDWK4&gtm=45je37a0&_p=59267360&cid=1363120108.1689272574&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1689272574&sct=1&seg=0&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&en=page_view&_fv=1&_ss=1&ep.hotel_name=Midlands%20Saddle%20Trout&ep.hotel_id=107113&ep.hotel_bid=not_applicable&ep.hotel_brand_name=First%20Group%20Management%20MB&ep.hotel_chain_id=not_applicable&ep.hotel_city=Mooi%20River&ep.hotel_continent=Africa&ep.hotel_country=South%20Africa&ep.hotel_state=KwaZulu-Natal&ep.hotel_sub_brand_name=First%20Resorts&ep.hotel_tc_region=middle_east_and_africa&ep.hotel_booking_engine=iHotelier%20BE4&ep.page_has_tvs=no&ep.page_language=en&ep.page_section=not_applicable&ep.page_subsection=not_applicable&ep.site_cms=galaxy&ep.site_galaxy_product=custom&ep.site_tvs=tvs_no&ep.hotel_property_type=group_property&ep.hotel_star_rating=0&ep.hotel_room_types_count=4&epn.site_number_of_languages=1&ep.site_global_product=web&ep.page_content_group=not_applicable&ep.site_be_version=be4&epn.page_tvs_videos_count=0&up.user_logged_in=no Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.facebook.com/tr/	0 18 B	8ms 8ms	Image text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=2351337388229475&ev=PageView&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DTFQhuH8N3pYUloW1WkmZVjUjd0KyLze5o_Ta0VB2Ivs&rl=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&if=false&ts=1689272574307&sw=1600&sh=1200&v=2.9.111&r=stable&ec=0&o=30&fbp=fb.2.1689272573729.294404374&cs_est=true&it=1689272573414&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 13 Jul 2023 18:22:54 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0 priority u=3,i
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	42ms 41ms	Image image/gif	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-135537499-5&cid=1363120108.1689272574&jid=1863364077&_u=aHDACEABRAAAACAEK~&z=465155473 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	40ms 39ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-135537499-5&cid=1363120108.1689272574&jid=1863364077&_u=aHDACEABRAAAACAEK~&z=465155473 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 45 B	28ms 14ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-LP9ZQF3SMX&gtm=45je37c0h2&_p=59267360&cid=1363120108.1689272574&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1689272574&sct=1&seg=0&dl=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&dr=https%3A%2F%2Fdd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com%2F&dt=Luxury%20Hotels%20%26%20Holiday%20Accommodation%20Midlands%20%7C%20Most%20Romantic%20Spa%20Getaways%20Self-Catering&en=page_view&_fv=1&_ss=1&ep.page_section=not_applicable&ep.page_subsection=not_applicable&ep.page_content_group=not_applicable&ep.page_full_url=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout%23msdynttrid%3DTFQhuH8N3pYUloW1WkmZVjUjd0KyLze5o_Ta0VB2Ivs&ep.page_language=en&ep.page_containing_tvs=no&ep.hotel_city=Mooi%20River&ep.hotel_country=South%20Africa&ep.hotel_state=KwaZulu-Natal&ep.hotel_continent=Africa&ep.hotel_brand_name=First%20Resorts&ep.hotel_id=107113&ep.hotel_name=Midlands%20Saddle%20Trout&ep.hotel_star_rating=0&ep.hotel_property_type=group_property&ep.hotel_booking_engine_provider=iHotelier%20BE4&up.user_logged_in_session=no Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame 382F	0 15 B	18ms 8ms	Document text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.firstgroup-sa.co.za Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Thu, 13 Jul 2023 18:22:54 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H3	200	id Show response googleads.g.doubleclick.net/pagead/ Frame D2D9 Redirect Chain https://googleads.g.doubleclick.net/pagead/id https://googleads.g.doubleclick.net/pagead/id?slf_rd=1	100 B 146 B	22ms 22ms	XHR application/json	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 5599924b194ec6b14a300da0c4e79c5132719746e78227b5281dd973e925c924 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:54 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 120 x-xss-protection 0 pragma no-cache server cafe content-type application/json; charset=UTF-8 access-control-allow-origin https://www.youtube.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 pragma no-cache server cafe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 access-control-allow-origin https://www.youtube.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ad_status.js Show response static.doubleclick.net/instream/ Frame D2D9	29 B 495 B	51ms 13ms	Script text/javascript	2a00:1450:4001:813::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://static.doubleclick.net/instream/ad_status.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/www-embed-player.vflset/www-embed-player.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:21:08 GMT x-content-type-options nosniff age 106 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 29 x-xss-protection 0 last-modified Thu, 12 Dec 2013 23:40:16 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=900 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 13 Jul 2023 18:36:08 GMT
GET H3	200	ga-audiences www.google.com/ads/	42 B 63 B	41ms 40ms	Image image/gif	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-135537499-1&cid=1363120108.1689272574&jid=1082317423&_u=aHDACEABRAAAACAEK~&z=1097488769 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	41ms 40ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-135537499-1&cid=1363120108.1689272574&jid=1082317423&_u=aHDACEABRAAAACAEK~&z=1097488769 Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
OPTIONS H2	200	Create jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame	0 0	76ms 26ms	Preflight text/html	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,x-goog-api-key,x-user-agent Access-Control-Request-Method POST Origin https://www.youtube.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-goog-api-key,x-user-agent access-control-allow-methods DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT access-control-allow-origin https://www.youtube.com access-control-max-age 3600 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 content-type text/html date Thu, 13 Jul 2023 18:22:54 GMT server ESF vary origin referer x-origin x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 0
POST H2	200	Create Show response jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame D2D9	68 KB 31 KB	31ms 30ms	XHR application/json+protobuf	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash b9ec6af2a0c142cb828e02568bb17de6fb352590d837a702768f2e4ef39c12f1 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-User-Agent grpc-web-javascript/0.1 Referer https://www.youtube.com/ X-Goog-Api-Key AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json+protobuf Response headers date Thu, 13 Jul 2023 18:22:54 GMT content-encoding gzip x-content-type-options nosniff server ESF vary Origin, X-Origin, Referer x-frame-options SAMEORIGIN content-type application/json+protobuf; charset=UTF-8 access-control-allow-origin https://www.youtube.com access-control-expose-headers vary,vary,vary,content-encoding,date,server,content-length cache-control private access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31856 x-xss-protection 0
POST H3	200	player Show response www.youtube.com/youtubei/v1/ Frame D2D9	64 KB 23 KB	246ms 245ms	XHR application/json	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/youtubei/v1/player?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=false Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software scaffolding on HTTPServer2 / Resource Hash 09c37170ce237f18587b0a8c6eb73a8cdb7ee8b313fd2b7c9701dfd92e8852c3 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-Youtube-Bootstrap-Logged-In false accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-Youtube-Client-Name 56 X-Youtube-Client-Version 1.20230709.00.00 X-Goog-Visitor-Id CgtxMVlqbF8zUXA2dyj9gcGlBg%3D%3D Response headers date Thu, 13 Jul 2023 18:22:54 GMT content-encoding br x-content-type-options nosniff server scaffolding on HTTPServer2 x-frame-options SAMEORIGIN vary Origin, X-Origin, Referer content-type application/json; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 23344 x-xss-protection 0 expires Thu, 13 Jul 2023 18:22:54 GMT
GET H3	200	rL43kvhtVfQZ9Jo2nKMlf8e4yf2ohUdnUaT63cNr6lg.js Show response www.google.com/js/th/ Frame D2D9	38 KB 14 KB	15ms 15ms	Script text/javascript	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/js/th/rL43kvhtVfQZ9Jo2nKMlf8e4yf2ohUdnUaT63cNr6lg.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash acbe3792f86d55f419f49a369ca3257fc7b8c9fda885476751a4faddc36bea58 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 21:19:02 GMT content-encoding br x-content-type-options nosniff age 248632 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 14720 x-xss-protection 0 last-modified Mon, 26 Jun 2023 15:30:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 09 Jul 2024 21:19:02 GMT
GET H3	200	embed.js Show response www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/ Frame D2D9	28 KB 8 KB	15ms 14ms	Script text/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/embed.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1276c576f6bac7f4ee8863f76468b8c53a3169d557fb2dcdf474e9eda3fd833d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Wed, 12 Jul 2023 13:37:13 GMT content-encoding br x-content-type-options nosniff age 103541 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 8141 x-xss-protection 0 last-modified Mon, 10 Jul 2023 01:48:40 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 11 Jul 2024 13:37:13 GMT
GET DATA	200 OK	truncated / Frame D2D9	175 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/png
GET H2	200	AOPolaT1LYYbpOw1hd8FF9JVeudO2dPTqLmFdeR8nFV1=s68-c-k-c0x00ffffff-no-rj yt3.ggpht.com/ytc/ Frame D2D9	3 KB 4 KB	343ms 308ms	Image image/jpeg	2a00:1450:4001:80b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://yt3.ggpht.com/ytc/AOPolaT1LYYbpOw1hd8FF9JVeudO2dPTqLmFdeR8nFV1=s68-c-k-c0x00ffffff-no-rj Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 02a40f2e04358612332400244cd5334e264ea2de1c828722881dcf31c4371a95 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff age 0 content-disposition inline;filename="unnamed.jpg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3572 x-xss-protection 0 server fife etag "v65" vary Origin content-type image/jpeg access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Fri, 14 Jul 2023 18:22:54 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame 2648	0 15 B	18ms 14ms	Document text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.firstgroup-sa.co.za Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Thu, 13 Jul 2023 18:22:54 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
OPTIONS H3	200	GenerateIT jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame	0 0	25ms 24ms	Preflight text/html	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,x-goog-api-key,x-user-agent Access-Control-Request-Method POST Origin https://www.youtube.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-goog-api-key,x-user-agent access-control-allow-methods DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT access-control-allow-origin https://www.youtube.com access-control-max-age 3600 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 content-type text/html date Thu, 13 Jul 2023 18:22:54 GMT server ESF vary origin referer x-origin x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 0
POST H3	200	GenerateIT Show response jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame D2D9	90 B 134 B	26ms 26ms	XHR application/json+protobuf	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 604b18c79819e35553473a034b41f60b03904b3a21a0c78ea6372fcbe4f28217 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-User-Agent grpc-web-javascript/0.1 Referer https://www.youtube.com/ X-Goog-Api-Key AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json+protobuf Response headers date Thu, 13 Jul 2023 18:22:54 GMT content-encoding gzip x-content-type-options nosniff server ESF vary Origin, X-Origin, Referer x-frame-options SAMEORIGIN content-type application/json+protobuf; charset=UTF-8 access-control-allow-origin https://www.youtube.com access-control-expose-headers vary,vary,vary,content-encoding,date,server,content-length cache-control private access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 110 x-xss-protection 0
GET H3	204	generate_204 www.youtube.com/ Frame D2D9	0 10 B	16ms 15ms	Image text/plain	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.youtube.com/generate_204?_Mkeow Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:54 GMT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0
POST H3	204	qoe Show response www.youtube.com/api/stats/ Frame D2D9	0 19 B	21ms 21ms	XHR text/html	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/api/stats/qoe?fmt=244&afmt=250&cpn=Kk9qsfS74t8Vk3_0&el=embedded&ns=yt&fexp=23983296%2C24004644%2C24007246%2C24080738%2C24135310%2C24208765%2C24362633%2C24362687%2C24364789%2C24366065%2C24366917%2C24368832%2C24370597%2C24380264%2C24383853%2C24415864%2C24416290%2C24439361%2C24559328&cl=546728719&seq=1&docid=NIVQmaxs6TE&ei=_kCwZIf9IczI1gLC9rboBQ&event=streamingstats&plid=AAYAYmu-8vWELtZJ&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FNIVQmaxs6TE%3Fplaylist%3DNIVQmaxs6TE%26rel%3D0%26autoplay%3D1%26controls%3D0%26showinfo%3D0%26loop%3D1%26mute%3D1&qclc=ChBLazlxc2ZTNzR0OFZrM18wEAE&embargoed=0&cbr=Chrome&cbrver=114.0.5735.198&c=WEB_EMBEDDED_PLAYER&cver=1.20230709.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&vps=0.000:N,0.051:B,0.312:B,0.312:B&cat=streaming&cmt=0.051:0.000,0.312:0.000&afs=0.311:250::i&vfs=0.312:244:248::r&view=0.312:4800:1079&bwe=0.312:130000&bat=0.312:1:1&vis=0.312:0&bh=0.312:0.000 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/x-www-form-urlencoded X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230709.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgtxMVlqbF8zUXA2dyj9gcGlBg%3D%3D X-YouTube-Ad-Signals dt=1689272574334&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:54 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 access-control-allow-origin https://www.youtube.com cache-control no-cache, must-revalidate access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	videoplayback Show response rr1---sn-5hnekn7k.googlevideo.com/ Frame D2D9	236 KB 237 KB	106ms 49ms	Fetch application/vnd.yt-ump	2a00:1450:400e:2::6 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr1---sn-5hnekn7k.googlevideo.com/videoplayback?expire=1689294174&ei=_kCwZIf9IczI1gLC9rboBQ&ip=2a00%3Ac98%3A2050%3Aa007%3A2%3A%3A4&id=o-AKwSyA-7qk_r3sx2hL_2iEa28ZdLuprcUhEsZFTDzSab&itag=244&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-5hnekn7k%2Csn-5hne6nsd&ms=au%2Crdu&mv=m&mvi=1&pl=44&initcwndbps=347500&spc=Ul2SqzcJ1HUOVV6yXgdX-d5Oggiao9qtwkoY94JVpw&vprv=1&svpuc=1&mime=video%2Fwebm&ns=Ak4r2OJ8_VQt9_qW_XbJ750O&gir=yes&clen=2574516&dur=30.000&lmt=1658290311840788&mt=1689272263&fvip=1&keepalive=yes&fexp=24007246%2C24362687%2C51000024&beids=24350018&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=q0Rv63q8oIRukA&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRQIgHOGWmG1WoJ_mxs83xrR25ExKPV5tUmaT8u7bnLUyXjoCIQDGtLb6W4sasEzauRF9o_Ki8sD5eKY4skHLWjTRPn0tDQ%3D%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgT90qdHJQ6Jpuu_PsQGKOs3ybRn3mCrj76WmeZ3lw7IICIFzNBTzkvZuHlznqK5MlNUa0XWTtL2zoBELofjyeV2ub&alr=yes&cpn=Kk9qsfS74t8Vk3_0&cver=1.20230709.00.00&range=0-241733&rn=1&rbuf=0&pot=MmTyeNEUVx-XCvJAJTI5u16AUSdacnu7eXx8cE-7N0LwGIoOuzBKwTW1h90noE847ChfyGDtdvFk91-iirPCqSRC8-zktxfF0SK9OxNfKFqtly_Cnq9qxgJ1MAkRapShnWClnF_G&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400e:2::6 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 9d12e3b249ee18dff8cb43ee12507a7cf8a3025efcdfdac5481fad931753644d Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Thu, 13 Jul 2023 18:22:54 GMT X-Restrict-Formats-Hint None X-Content-Type-Options nosniff Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive Alt-Svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" Last-Modified Wed, 20 Jul 2022 04:11:51 GMT Server gvs 1.0 Vary Origin Content-Type application/vnd.yt-ump Access-Control-Allow-Origin https://www.youtube.com Access-Control-Expose-Headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Cache-Control private, max-age=21300 Access-Control-Allow-Credentials true Timing-Allow-Origin https://www.youtube.com Expires Thu, 13 Jul 2023 18:22:54 GMT
POST H/1.1	200 OK	videoplayback Show response rr1---sn-5hnekn7k.googlevideo.com/ Frame D2D9	14 KB 15 KB	85ms 29ms	Fetch application/vnd.yt-ump	2a00:1450:400e:2::6 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr1---sn-5hnekn7k.googlevideo.com/videoplayback?expire=1689294174&ei=_kCwZIf9IczI1gLC9rboBQ&ip=2a00%3Ac98%3A2050%3Aa007%3A2%3A%3A4&id=o-AKwSyA-7qk_r3sx2hL_2iEa28ZdLuprcUhEsZFTDzSab&itag=250&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-5hnekn7k%2Csn-5hne6nsd&ms=au%2Crdu&mv=m&mvi=1&pl=44&initcwndbps=347500&spc=Ul2SqzcJ1HUOVV6yXgdX-d5Oggiao9qtwkoY94JVpw&vprv=1&svpuc=1&mime=audio%2Fwebm&ns=Ak4r2OJ8_VQt9_qW_XbJ750O&gir=yes&clen=13885&dur=30.021&lmt=1658290308483560&mt=1689272263&fvip=1&keepalive=yes&fexp=24007246%2C24362687%2C51000024&beids=24350018&c=WEB_EMBEDDED_PLAYER&txp=5311224&n=q0Rv63q8oIRukA&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRQIhANlL6vdGwGxspCtnckbQ6HJ-LbJnri2JalR7W3MXbriBAiAU5b4Yl6Iwzh0-NjmCZuKC0scQVY3YbAHXBN40p9sBRQ%3D%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgT90qdHJQ6Jpuu_PsQGKOs3ybRn3mCrj76WmeZ3lw7IICIFzNBTzkvZuHlznqK5MlNUa0XWTtL2zoBELofjyeV2ub&alr=yes&cpn=Kk9qsfS74t8Vk3_0&cver=1.20230709.00.00&range=0-13884&rn=2&rbuf=0&pot=MmTyeNEUVx-XCvJAJTI5u16AUSdacnu7eXx8cE-7N0LwGIoOuzBKwTW1h90noE847ChfyGDtdvFk91-iirPCqSRC8-zktxfF0SK9OxNfKFqtly_Cnq9qxgJ1MAkRapShnWClnF_G&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400e:2::6 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 02dcf9de98ef748c75b040660886125b0b68c0f9a4b017bcd8b29fcd9b468889 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Thu, 13 Jul 2023 18:22:54 GMT X-Content-Type-Options nosniff Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive Alt-Svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" Last-Modified Wed, 20 Jul 2022 04:11:48 GMT Server gvs 1.0 Vary Origin Content-Type application/vnd.yt-ump Access-Control-Allow-Origin https://www.youtube.com Access-Control-Expose-Headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms Cache-Control private, max-age=21300 Access-Control-Allow-Credentials true Timing-Allow-Origin https://www.youtube.com Expires Thu, 13 Jul 2023 18:22:54 GMT
GET H3	200	endscreen.js Show response www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/ Frame D2D9	33 KB 8 KB	14ms 14ms	Script text/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/endscreen.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff939c661a2350207cc3eb2d9e65e752f15a102e845afec7a69c8b18330ed955 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 10 Jul 2023 07:20:33 GMT content-encoding br x-content-type-options nosniff age 298941 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 8353 x-xss-protection 0 last-modified Mon, 10 Jul 2023 01:48:40 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 09 Jul 2024 07:20:33 GMT
POST H3	200	next Show response www.youtube.com/youtubei/v1/ Frame D2D9	37 KB 6 KB	355ms 354ms	XHR application/json	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/youtubei/v1/next?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=false Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software scaffolding on HTTPServer2 / Resource Hash 623e1b78f279cb89851156a5c877ed773223be39ad4e484a42ce72262c1521cc Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-Youtube-Bootstrap-Logged-In false accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-Youtube-Client-Name 56 X-Youtube-Client-Version 1.20230709.00.00 X-Goog-Visitor-Id CgtxMVlqbF8zUXA2dyj9gcGlBg%3D%3D Response headers date Thu, 13 Jul 2023 18:22:55 GMT content-encoding br x-content-type-options nosniff server scaffolding on HTTPServer2 x-frame-options SAMEORIGIN vary Origin, X-Origin, Referer content-type application/json; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 6407 x-xss-protection 0 expires Thu, 13 Jul 2023 18:22:55 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame FC23	0 15 B	8ms 7ms	Document text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.firstgroup-sa.co.za Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Thu, 13 Jul 2023 18:22:54 GMT priority u=0,i server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
POST H3	200	videoplayback Show response rr1---sn-5hnekn7k.googlevideo.com/ Frame D2D9	236 KB 236 KB	30ms 14ms	Fetch application/vnd.yt-ump	2a00:1450:400e:2::6 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr1---sn-5hnekn7k.googlevideo.com/videoplayback?expire=1689294174&ei=_kCwZIf9IczI1gLC9rboBQ&ip=2a00%3Ac98%3A2050%3Aa007%3A2%3A%3A4&id=o-AKwSyA-7qk_r3sx2hL_2iEa28ZdLuprcUhEsZFTDzSab&itag=244&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-5hnekn7k%2Csn-5hne6nsd&ms=au%2Crdu&mv=m&mvi=1&pl=44&initcwndbps=347500&spc=Ul2SqzcJ1HUOVV6yXgdX-d5Oggiao9qtwkoY94JVpw&vprv=1&svpuc=1&mime=video%2Fwebm&ns=Ak4r2OJ8_VQt9_qW_XbJ750O&gir=yes&clen=2574516&dur=30.000&lmt=1658290311840788&mt=1689272263&fvip=1&keepalive=yes&fexp=24007246%2C24362687%2C51000024&beids=24350018&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=q0Rv63q8oIRukA&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRQIgHOGWmG1WoJ_mxs83xrR25ExKPV5tUmaT8u7bnLUyXjoCIQDGtLb6W4sasEzauRF9o_Ki8sD5eKY4skHLWjTRPn0tDQ%3D%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgT90qdHJQ6Jpuu_PsQGKOs3ybRn3mCrj76WmeZ3lw7IICIFzNBTzkvZuHlznqK5MlNUa0XWTtL2zoBELofjyeV2ub&alr=yes&cpn=Kk9qsfS74t8Vk3_0&cver=1.20230709.00.00&range=241734-483148&rn=3&rbuf=4117&pot=MmTyeNEUVx-XCvJAJTI5u16AUSdacnu7eXx8cE-7N0LwGIoOuzBKwTW1h90noE847ChfyGDtdvFk91-iirPCqSRC8-zktxfF0SK9OxNfKFqtly_Cnq9qxgJ1MAkRapShnWClnF_G&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400e:2::6 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash fbcab2f49f2260c2e1c3b53edb13b6f528a14714fba193377ae8d3be752dafd4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Thu, 13 Jul 2023 18:22:55 GMT date Thu, 13 Jul 2023 18:22:55 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:51 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21299 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
POST H3	200	videoplayback Show response rr1---sn-5hnekn7k.googlevideo.com/ Frame D2D9	374 B 398 B	71ms 58ms	Fetch application/vnd.yt-ump	2a00:1450:400e:2::6 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr1---sn-5hnekn7k.googlevideo.com/videoplayback?expire=1689294174&ei=_kCwZIf9IczI1gLC9rboBQ&ip=2a00%3Ac98%3A2050%3Aa007%3A2%3A%3A4&id=o-AKwSyA-7qk_r3sx2hL_2iEa28ZdLuprcUhEsZFTDzSab&itag=248&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-5hnekn7k%2Csn-5hne6nsd&ms=au%2Crdu&mv=m&mvi=1&pl=44&initcwndbps=347500&spc=Ul2SqzcJ1HUOVV6yXgdX-d5Oggiao9qtwkoY94JVpw&vprv=1&svpuc=1&mime=video%2Fwebm&ns=Ak4r2OJ8_VQt9_qW_XbJ750O&gir=yes&clen=7804629&dur=30.000&lmt=1658290312237003&mt=1689272263&fvip=1&keepalive=yes&fexp=24007246%2C24362687%2C51000024&beids=24350018&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=q0Rv63q8oIRukA&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgRcLVR1hi4HhycRwRxk8P0OZZXcPbEbGRklYYANWyQBkCIGDzRylBov5bSstkNTokczApPturMib0LAgeayYTcmUg&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgT90qdHJQ6Jpuu_PsQGKOs3ybRn3mCrj76WmeZ3lw7IICIFzNBTzkvZuHlznqK5MlNUa0XWTtL2zoBELofjyeV2ub&alr=yes&cpn=Kk9qsfS74t8Vk3_0&cver=1.20230709.00.00&range=0-318&rn=4&rbuf=0&pot=MmTyeNEUVx-XCvJAJTI5u16AUSdacnu7eXx8cE-7N0LwGIoOuzBKwTW1h90noE847ChfyGDtdvFk91-iirPCqSRC8-zktxfF0SK9OxNfKFqtly_Cnq9qxgJ1MAkRapShnWClnF_G&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400e:2::6 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 8c0ca24d1bf1201449a20ae303c8e0a4fa8fde5ca5f942f3430c0ffef10f0f8c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Thu, 13 Jul 2023 18:22:55 GMT date Thu, 13 Jul 2023 18:22:55 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:52 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21299 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
GET H3	200	calendar.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	491 B 685 B	183ms 182ms	Image image/svg+xml	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/calendar.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 70bf367f8a864b1ffff64191ae85b7f6bd66f5127b7acdaa73db9e4e46c8981a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 3e49d1b7d94458397e7bc6421c922a18.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:13 GMT server cloudflare etag W/"2f714d01df95c551b9ab4b6e5ea28175" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e638dd9dc6abb44-FRA x-amz-cf-id mVde-ujB2Uv5aLQDl3odirFG8m00H-oMPQAcjOF-7i3_3Z-693uO6g==
GET H3	200	bed.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	1 KB 927 B	237ms 235ms	Image image/svg+xml	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/bed.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash acd49b929d9d8836eb1f57feb264259aaafc6c6a0ba9cfb9b803150f040814f8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 9f63706579db7391acaa39a0dddcff5e.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:32 GMT server cloudflare etag W/"9fda7d9765c377fcb092ef755a545920" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e638dd9dc6dbb44-FRA x-amz-cf-id NaOsw9GEej67YlW7YxRd7NuQwxoUFrsiUTpTRZ3_fQDrhbqayIvB-w==
GET H2	200	first-group-girls-getaway_square.jpg image-tc.galaxy.tf/wijpeg-43eo734m1q34kx0z5q1q4tvsw/	43 KB 44 KB	531ms 529ms	Image image/jpeg	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-43eo734m1q34kx0z5q1q4tvsw/first-group-girls-getaway_square.jpg?crop=320%2C0%2C1280%2C1280&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4be803935fb7a669bbb3c4ef343de5c83b4c55b1b4e1c974bbfdbc2c774264ec Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT x-amz-version-id 04cqhkiPWN1V9FSh0oIogU2Ik45sLNb0 x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 2bb98457c96f801517f8d0d98344cd3c.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop ZRH55-P1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 44515 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 01 Aug 2022 08:43:20 GMT server cloudflare etag "20b4166dde6d059c55c3ce363923646a" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd9de564d2b-FRA x-amz-cf-id Rg2bMFX8DYEas7eLezu-17NXgkE8KGMLrrvDfcp-Rl_L3XLnTiP0eA==
GET H2	200	first-group-book-early-and-save_square.jpg image-tc.galaxy.tf/wijpeg-15bql94tumbk4we2zprk4d298/	51 KB 52 KB	484ms 482ms	Image image/jpeg	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-15bql94tumbk4we2zprk4d298/first-group-book-early-and-save_square.jpg?crop=360%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2cbb50e7dc8c4e2a322db01d714dbb0b459d59d928d6b9cc9d75924f48dacd24 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT x-amz-version-id s6cnSkBcC3VekKzIYWEysyMmgAcEw9Lo x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 52613 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 01 Aug 2022 20:49:05 GMT server cloudflare etag "a5ffbeb89bd9e8c952651cf7d0d661db" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd9de594d2b-FRA x-amz-cf-id LtWMXEiO7hvXghwTfJF8-2R6SYTXrANFZQUhquv7RE3uYwwl-fmjUA==
GET H2	200	couples-midweek-getaway-at-mst_square.jpg image-tc.galaxy.tf/wijpeg-a96xm37j5z2twqi5wlhf9z049/	77 KB 77 KB	586ms 584ms	Image image/jpeg	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-a96xm37j5z2twqi5wlhf9z049/couples-midweek-getaway-at-mst_square.jpg?crop=390%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0821c698a9c3cfe81b780427d8bc52da508f17648197ae4803205dc1e4d059ab Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT x-amz-version-id IdFA2IbUQ9kiIK3DsJZgjYC77GGjklUZ x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop ZRH55-P1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 78661 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 22 Aug 2022 07:21:36 GMT server cloudflare etag "39a30a44456efabd8ea99b884f352567" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd9de5a4d2b-FRA x-amz-cf-id V5LUdXNJG72C-yQEgJQQjktEI1Ipimgo1jDx8T2nFmEiKbLACOBm5Q==
GET H2	200	6784-fg-25-midweek-offer-banner-v1_square.jpg image-tc.galaxy.tf/wijpeg-bk0968vlevzgq53irm5kqs9k1/	62 KB 63 KB	508ms 506ms	Image image/jpeg	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-bk0968vlevzgq53irm5kqs9k1/6784-fg-25-midweek-offer-banner-v1_square.jpg?crop=390%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 681c4645cf2b8830900bbbebf4efe20e9a6efba6d9bc539b2156af681b94937b Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT x-amz-version-id dOOuBI41Nf_unEizFkfecgKf2AiFXjst x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 c7311454ce938e04f3523616a5b033da.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop ZRH55-P1 x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 63506 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Wed, 11 Jan 2023 08:12:10 GMT server cloudflare etag "996ba1213a1c9ff6762b4c430d1cbee5" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd9de5c4d2b-FRA x-amz-cf-id m1CtQ1liLLrD9nEJsidpMrsRg7Wh3HNzJ421kweC8e689YGE2x_Rpg==
GET H2	200	6784-fg-30-7-night-offer-banner-v1_square.jpg image-tc.galaxy.tf/wijpeg-9hazeuop3wx77by2zv8acy351/	46 KB 46 KB	519ms 517ms	Image image/jpeg	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-9hazeuop3wx77by2zv8acy351/6784-fg-30-7-night-offer-banner-v1_square.jpg?crop=390%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 906aa2e898f3baf773671b2ff25bf956a3dd17bf48753a345ace276047947bbd Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT x-amz-version-id k99wqaLmhJbz.5LZPfAZvX3HlbYZOwcu x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 6678c1810851ff197cbe3fe4c41e86a6.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop ZRH55-P1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 47265 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Wed, 11 Jan 2023 09:50:30 GMT server cloudflare etag "e806d24ffc6ab7c4a938c080dafb7e7d" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd9de5d4d2b-FRA x-amz-cf-id X147u22_BJH4DSntukQWRzf6-9Sxv2Hd3-j9AI_YfxCMnzKoxgFqRA==
GET H2	200	midlands-saddle-trout-couple-s-getaway_square.jpg image-tc.galaxy.tf/wijpeg-c7axu2wrgaltxoe1o311lr40d/	47 KB 47 KB	503ms 502ms	Image image/jpeg	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-c7axu2wrgaltxoe1o311lr40d/midlands-saddle-trout-couple-s-getaway_square.jpg?crop=360%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 63fea1d2fc7525fc77432818b292c2aa54790f3545aeb3604c31d425ca213288 Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT x-amz-version-id jMU6_xBnJ7DlV4EGNWbgnuExFU3RCjMr x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 a350f357b825293e306b1b0a2cb490c0.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 48284 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 01 Aug 2022 19:38:52 GMT server cloudflare etag "3f3744db4dd334b95460dacc5871172d" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd9de604d2b-FRA x-amz-cf-id 35JqmUrflJV9B55SUSJe4Q-BhpXJJ98TDBPsSm9rzJUktgkNf2JeBw==
GET H2	200	first-group-coulpe-s-spa-getaway_square.jpg image-tc.galaxy.tf/wijpeg-ce06wsvz7fmur8qopk53090jw/	39 KB 39 KB	458ms 456ms	Image image/jpeg	2606:4700::6811:b73a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://image-tc.galaxy.tf/wijpeg-ce06wsvz7fmur8qopk53090jw/first-group-coulpe-s-spa-getaway_square.jpg?crop=360%2C0%2C1200%2C1200&width=600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:b73a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e20d0ddf02cdfdd6dc8bac3e8d4405be92caacb961d84b1e25b908297c7f57d Security Headers Name Value Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT x-amz-version-id FUCYWaIYAHLWOEnmJSDXu0g6L97XXs10 x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubdomains; preload via 1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront) content-security-policy default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none' x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront cf-cache-status DYNAMIC x-amz-replication-status REPLICA alt-svc h3=":443"; ma=86400 content-length 39687 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 01 Aug 2022 15:14:21 GMT server cloudflare etag "c6242d97f3bf1a9ed19b3d091d09db66" x-frame-options SAMEORIGIN access-control-allow-methods GET, HEAD, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control no-cache vary Accept-Encoding accept-ranges bytes cf-ray 7e638dd9de624d2b-FRA x-amz-cf-id Bb7A9PxPyLDyE2gUpUhCBmQinsAs3aRfsixiqiRJ0WCNPnUCKlnx8w==
POST H3	200	log_event Show response www.youtube.com/youtubei/v1/ Frame D2D9	28 B 54 B	34ms 33ms	XHR application/json	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/www-embed-player.vflset/www-embed-player.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software scaffolding on HTTPServer2 / Resource Hash d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 X-Goog-Request-Time 1689272575022 Content-Type application/json X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230709.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgtxMVlqbF8zUXA2dyj9gcGlBg%3D%3D X-YouTube-Ad-Signals dt=1689272574227&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers date Thu, 13 Jul 2023 18:22:55 GMT content-encoding br x-content-type-options nosniff server scaffolding on HTTPServer2 x-frame-options SAMEORIGIN vary Origin, X-Origin, Referer content-type application/json; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31 x-xss-protection 0 expires Thu, 13 Jul 2023 18:22:55 GMT
POST H3	200	videoplayback Show response rr1---sn-5hnekn7k.googlevideo.com/ Frame D2D9	252 KB 252 KB	19ms 18ms	Fetch application/vnd.yt-ump	2a00:1450:400e:2::6 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr1---sn-5hnekn7k.googlevideo.com/videoplayback?expire=1689294174&ei=_kCwZIf9IczI1gLC9rboBQ&ip=2a00%3Ac98%3A2050%3Aa007%3A2%3A%3A4&id=o-AKwSyA-7qk_r3sx2hL_2iEa28ZdLuprcUhEsZFTDzSab&itag=244&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-5hnekn7k%2Csn-5hne6nsd&ms=au%2Crdu&mv=m&mvi=1&pl=44&initcwndbps=347500&spc=Ul2SqzcJ1HUOVV6yXgdX-d5Oggiao9qtwkoY94JVpw&vprv=1&svpuc=1&mime=video%2Fwebm&ns=Ak4r2OJ8_VQt9_qW_XbJ750O&gir=yes&clen=2574516&dur=30.000&lmt=1658290311840788&mt=1689272263&fvip=1&keepalive=yes&fexp=24007246%2C24362687%2C51000024&beids=24350018&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=q0Rv63q8oIRukA&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRQIgHOGWmG1WoJ_mxs83xrR25ExKPV5tUmaT8u7bnLUyXjoCIQDGtLb6W4sasEzauRF9o_Ki8sD5eKY4skHLWjTRPn0tDQ%3D%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgT90qdHJQ6Jpuu_PsQGKOs3ybRn3mCrj76WmeZ3lw7IICIFzNBTzkvZuHlznqK5MlNUa0XWTtL2zoBELofjyeV2ub&alr=yes&cpn=Kk9qsfS74t8Vk3_0&cver=1.20230709.00.00&range=483149-741013&rn=5&rbuf=7243&pot=MmTyeNEUVx-XCvJAJTI5u16AUSdacnu7eXx8cE-7N0LwGIoOuzBKwTW1h90noE847ChfyGDtdvFk91-iirPCqSRC8-zktxfF0SK9OxNfKFqtly_Cnq9qxgJ1MAkRapShnWClnF_G&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400e:2::6 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 7294739580c8ec5655fb8853d0804bfd80116adde585ab4952b492ad04cbd716 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Thu, 13 Jul 2023 18:22:55 GMT date Thu, 13 Jul 2023 18:22:55 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:51 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21299 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
POST H3	204	qoe Show response www.youtube.com/api/stats/ Frame D2D9	0 19 B	26ms 26ms	XHR text/html	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/api/stats/qoe?fmt=248&afmt=250&cpn=Kk9qsfS74t8Vk3_0&el=embedded&ns=yt&fexp=23983296%2C24004644%2C24007246%2C24080738%2C24135310%2C24208765%2C24362633%2C24362687%2C24364789%2C24366065%2C24366917%2C24368832%2C24370597%2C24380264%2C24383853%2C24415864%2C24416290%2C24439361%2C24559328&cl=546728719&seq=2&docid=NIVQmaxs6TE&ei=_kCwZIf9IczI1gLC9rboBQ&event=streamingstats&plid=AAYAYmu-8vWELtZJ&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FNIVQmaxs6TE%3Fplaylist%3DNIVQmaxs6TE%26rel%3D0%26autoplay%3D1%26controls%3D0%26showinfo%3D0%26loop%3D1%26mute%3D1&qclc=ChBLazlxc2ZTNzR0OFZrM18wEAI&embargoed=0&cbr=Chrome&cbrver=114.0.5735.198&c=WEB_EMBEDDED_PLAYER&cver=1.20230709.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&bh=0.548:3.440,0.631:7.840&cmt=0.548:0.001,0.631:0.043&vps=0.548:PL,0.631:PL,0.631:PL&user_intent=0&vfs=0.631:248:248:244:r&view=0.631:4800:1079&bwm=0.631:755503:0.482&bwe=0.631:504918&bat=0.631:1:1&df=0.631:0 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/x-www-form-urlencoded X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230709.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgtxMVlqbF8zUXA2dyj9gcGlBg%3D%3D X-YouTube-Ad-Signals dt=1689272574334&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:55 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 access-control-allow-origin https://www.youtube.com cache-control no-cache, must-revalidate access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	videoplayback Show response rr1---sn-5hnekn7k.googlevideo.com/ Frame D2D9	2 MB 2 MB	42ms 42ms	Fetch application/vnd.yt-ump	2a00:1450:400e:2::6 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr1---sn-5hnekn7k.googlevideo.com/videoplayback?expire=1689294174&ei=_kCwZIf9IczI1gLC9rboBQ&ip=2a00%3Ac98%3A2050%3Aa007%3A2%3A%3A4&id=o-AKwSyA-7qk_r3sx2hL_2iEa28ZdLuprcUhEsZFTDzSab&itag=248&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-5hnekn7k%2Csn-5hne6nsd&ms=au%2Crdu&mv=m&mvi=1&pl=44&initcwndbps=347500&spc=Ul2SqzcJ1HUOVV6yXgdX-d5Oggiao9qtwkoY94JVpw&vprv=1&svpuc=1&mime=video%2Fwebm&ns=Ak4r2OJ8_VQt9_qW_XbJ750O&gir=yes&clen=7804629&dur=30.000&lmt=1658290312237003&mt=1689272263&fvip=1&keepalive=yes&fexp=24007246%2C24362687%2C51000024&beids=24350018&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=q0Rv63q8oIRukA&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgRcLVR1hi4HhycRwRxk8P0OZZXcPbEbGRklYYANWyQBkCIGDzRylBov5bSstkNTokczApPturMib0LAgeayYTcmUg&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgT90qdHJQ6Jpuu_PsQGKOs3ybRn3mCrj76WmeZ3lw7IICIFzNBTzkvZuHlznqK5MlNUa0XWTtL2zoBELofjyeV2ub&alr=yes&cpn=Kk9qsfS74t8Vk3_0&cver=1.20230709.00.00&range=2153324-4011918&rn=6&rbuf=10240&pot=MmTyeNEUVx-XCvJAJTI5u16AUSdacnu7eXx8cE-7N0LwGIoOuzBKwTW1h90noE847ChfyGDtdvFk91-iirPCqSRC8-zktxfF0SK9OxNfKFqtly_Cnq9qxgJ1MAkRapShnWClnF_G&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400e:2::6 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 865ae0fab97c1e5a37713edac972cf0c98f1b7a10ff446c43c2f732b71aa53ee Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Thu, 13 Jul 2023 18:22:55 GMT date Thu, 13 Jul 2023 18:22:55 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:52 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21299 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
GET H3	204	playback Show response www.youtube.com/api/stats/ Frame D2D9	0 17 B	24ms 23ms	XHR text/html	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/api/stats/playback?ns=yt&el=embedded&cpn=Kk9qsfS74t8Vk3_0&ver=2&cmt=0.059&fmt=248&fs=0&rt=0.648&euri=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&lact=686&cl=546728719&mos=1&volume=100&cbr=Chrome&cbrver=114.0.5735.198&c=WEB_EMBEDDED_PLAYER&cver=1.20230709.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&autoplay=1&epm=1&delay=4&hl=de_DE&cr=DE&len=30.021&fexp=23983296%2C24004644%2C24007246%2C24080738%2C24135310%2C24208765%2C24362633%2C24362687%2C24364789%2C24366065%2C24366917%2C24368832%2C24370597%2C24380264%2C24383853%2C24415864%2C24416290%2C24439361%2C24559328&rtn=3&afmt=250&size=4800%3A1079&inview=0&muted=1&docid=NIVQmaxs6TE&ei=_kCwZIf9IczI1gLC9rboBQ&plid=AAYAYmu-8vWELtZJ&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FNIVQmaxs6TE%3Fplaylist%3DNIVQmaxs6TE%26rel%3D0%26autoplay%3D1%26controls%3D0%26showinfo%3D0%26loop%3D1%26mute%3D1&list=TLGGSwT3bhDHDdgxMzA3MjAyMw&of=-_xhI4eL4MjOL53E0nwGhA&vm=CAEQABgEOjJBRmtzQzRxbkNKYWs2NlljdzdsMFJSUlR1TkhnejVHRzFvdmdNVnZKTmg5Y1FLYUVpZ2JYQVBta0tESkNiQlFIZmlmVjRPUVk3WHRCZXlVY0E0a0swWWFJOHplZXlDTFA4RW81dmllRGx2Sk5XSDZBWTRlVE82SVlUd2l3b3otbENHSHJPVGNUdHoxWmgB Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230709.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgtxMVlqbF8zUXA2dyj9gcGlBg%3D%3D X-YouTube-Ad-Signals dt=1689272574334&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:55 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	204	ptracking Show response www.youtube.com/ Frame D2D9	0 20 B	23ms 22ms	XHR text/html	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/ptracking?html5=1&video_id=NIVQmaxs6TE&cpn=Kk9qsfS74t8Vk3_0&ei=_kCwZIf9IczI1gLC9rboBQ&ptk=youtube_none&pltype=contentugc Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230709.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgtxMVlqbF8zUXA2dyj9gcGlBg%3D%3D X-YouTube-Ad-Signals dt=1689272574334&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:55 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	id Show response googleads.g.doubleclick.net/pagead/ Frame D2D9 Redirect Chain https://googleads.g.doubleclick.net/pagead/id https://googleads.g.doubleclick.net/pagead/id?slf_rd=1	100 B 146 B	23ms 22ms	XHR application/json	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 Protocol H3 Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 75664c9099c9ad2adde55a7874133b7534cfb4ca8b351402afaceb63f682126e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 120 x-xss-protection 0 pragma no-cache server cafe content-type application/json; charset=UTF-8 access-control-allow-origin https://www.youtube.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers date Thu, 13 Jul 2023 18:22:55 GMT x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 pragma no-cache server cafe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 access-control-allow-origin https://www.youtube.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	AOPolaT1LYYbpOw1hd8FF9JVeudO2dPTqLmFdeR8nFV1=s88-c-k-c0x00ffffff-no-rj yt3.ggpht.com/ytc/ Frame D2D9	5 KB 5 KB	44ms 33ms	Image image/jpeg	2a00:1450:4001:80b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://yt3.ggpht.com/ytc/AOPolaT1LYYbpOw1hd8FF9JVeudO2dPTqLmFdeR8nFV1=s88-c-k-c0x00ffffff-no-rj Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 174c5978e88be3436aae3b820605b7197f73c84141764c902224d973d607da3f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:55 GMT x-content-type-options nosniff age 0 content-disposition inline;filename="unnamed.jpg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4893 x-xss-protection 0 server fife etag "v65" vary Origin content-type image/jpeg access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Fri, 14 Jul 2023 18:22:55 GMT
GET H3	200	minus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	141 B 554 B	201ms 200ms	Image image/png	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/minus2.png Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 81ee91b271d16e2cfce70838aae0a41831cc99e8ffa7c070c021e9d803b5b03a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:56 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 e075180747b4645a70b98f1d8e4d8896.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 141 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:26 GMT server cloudflare etag "46201ff060cf4e3609f7dbad20bf7534" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e638ddf0b44bb44-FRA x-amz-cf-id SO-NSQwcdFZSxAphDN00gw4lZDFAwwox3h4B8_ED2llZdCuzik7htA==
GET H3	200	plus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	292 B 705 B	186ms 185ms	Image image/png	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/plus2.png Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dadd2fe93bedffecaca7fed58fd74af66da5fefff858b48cb2d45494236f4d4c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:56 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 af0a4579a75789980eb9374096ea1816.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 292 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:12 GMT server cloudflare etag "81ed7bc1309fce5cd1b0c43e40a61b2d" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e638ddf0b46bb44-FRA x-amz-cf-id PWoSVq5MqJKkSa1DHUdLqfvKnk-nGBKmtGc8PLfWb5I1FVl-3np4vQ==
GET H3	200	adult.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	504 B 706 B	360ms 360ms	Image image/svg+xml	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/adult.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0854d432df5634f3e1bcba1668e56d8de1e0cb55ede3a6bbcee97b463b06df9e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:56 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 12b082104e9893409b9ae6386e88d350.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:13 GMT server cloudflare etag W/"32626b48f6cec679f75b8c37a10e3dbd" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e638ddf0b48bb44-FRA x-amz-cf-id rFu9jkYExUoHWc5PK1_B-voaDf1B_uBY1FFfh-HgC3dbpCRrb5fpqQ==
GET H3	200	default.js Show response onboard.triptease.io/integrations/v6723.80224/	155 KB 49 KB	75ms 75ms	Script application/javascript	2606:4700:3035::ac43:c0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/integrations/v6723.80224/default.js Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:c0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 440ea5785aad5917f6dd71584e927bac13a352327a9a2f4a926c7fc2da935ed2 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:56 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status HIT x-goog-meta-git-hash 0c5110c9468fee9d788e1fdce1d618eb4770da54 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 87284 x-guploader-uploadid ADPycduuG5ChlLZlz6Na_CiGV51P9yAecZRbUpN0tWeZ4gHEZU7cC_RZRg6u0N5jjMrOmqyJ6IjkZwtOA13ssNW0pAWQKFXVlC89 x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-meta-build-version 6723.80224 alt-svc h3=":443"; ma=86400 last-modified Wed, 12 Jul 2023 16:58:41 GMT server cloudflare etag W/"a2651c654ae88ed8070e658a8622bad1" vary Accept-Encoding x-goog-generation 1689181121073850 content-type application/javascript; charset=utf-8 access-control-allow-origin * x-goog-hash crc32c=XssUfA==, md5=omUcZUrojtgHDmWKhiK60Q== access-control-expose-headers Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace cache-control public, max-age=31536000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rul1gv5OfkqiuUJlNnHZOyAvtGCku6SoCKA5hk8gNeRU7dBe84oeLYgdRoW0SE5Biq0WHmKKYyofkj1ozbeV%2BWJ8w2bmqVfJhLzt3SmpM0cVvcatePjW6skcnwNcsq5M%2BT6lxnMMV6anS5jS8aQ8w8jPzg%3D%3D"}],"group":"cf-nel","max_age":604800} x-goog-stored-content-length 158569 cf-ray 7e638ddfee95699f-FRA expires Thu, 11 Jul 2024 18:01:12 GMT
GET H3	200	minus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	141 B 554 B	175ms 174ms	Image image/png	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/minus2.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 81ee91b271d16e2cfce70838aae0a41831cc99e8ffa7c070c021e9d803b5b03a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:56 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 e075180747b4645a70b98f1d8e4d8896.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 141 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:26 GMT server cloudflare etag "46201ff060cf4e3609f7dbad20bf7534" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e638de0bdb0bb44-FRA x-amz-cf-id WqJPW3YFwG7x4lTmF2tSZpNYgbJWfntiO1Dc-rNj34Tj1ohPlZiCJQ==
GET H3	200	plus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	292 B 705 B	160ms 159ms	Image image/png	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/plus2.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dadd2fe93bedffecaca7fed58fd74af66da5fefff858b48cb2d45494236f4d4c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:56 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 af0a4579a75789980eb9374096ea1816.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 292 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:12 GMT server cloudflare etag "81ed7bc1309fce5cd1b0c43e40a61b2d" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e638de0bdb4bb44-FRA x-amz-cf-id JIuMHSIKAzRmZhQDEVFNaJrP8PmgKi233JKNJv1rG07txSfrV5k1jw==
GET H3	200	child.svg www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/	519 B 721 B	142ms 142ms	Image image/svg+xml	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/svg/child.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1008f86262ea5d3c1d8917291494386829d0bd2869d033c148d9b163099b1635 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:56 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 19fefe7d41cfedb99873c7b5cd95d410.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 content-encoding br x-cache Miss from cloudfront alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:13 GMT server cloudflare etag W/"67e4895ea6c606c63b4b64b36034c5e0" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control no-cache cf-ray 7e638de1aef0bb44-FRA x-amz-cf-id _lN4ZLCdxHtd_XD9duVvfNRZ8U3SXURGYjQLNaCGTHGLpjNqST2vBw==
GET H3	200	minus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	141 B 555 B	167ms 166ms	Image image/png	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/minus2.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 81ee91b271d16e2cfce70838aae0a41831cc99e8ffa7c070c021e9d803b5b03a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:56 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 e075180747b4645a70b98f1d8e4d8896.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 141 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:26 GMT server cloudflare etag "46201ff060cf4e3609f7dbad20bf7534" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e638de3390fbb44-FRA x-amz-cf-id 7L4gIdMzDUR5sja_gDDCJ1HG1nvd0wGprmaUE2QEMG8xZzyQMsxLHA==
GET H3	200	plus2.png www.firstgroup-sa.co.za/integration/first-hotels/public/images/	292 B 705 B	170ms 170ms	Image image/png	2606:4700::6811:b83a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.firstgroup-sa.co.za/integration/first-hotels/public/images/plus2.png Requested by Host: www.firstgroup-sa.co.za URL: https://www.firstgroup-sa.co.za/integration/first-hotels/public/vendor/lazysizes.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:b83a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dadd2fe93bedffecaca7fed58fd74af66da5fefff858b48cb2d45494236f4d4c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:56 GMT strict-transport-security max-age=31536000; includeSubdomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 af0a4579a75789980eb9374096ea1816.cloudfront.net (CloudFront) x-amz-cf-pop CDG3-C2 x-cache RefreshHit from cloudfront alt-svc h3=":443"; ma=86400 content-length 292 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Fri, 17 Sep 2021 12:35:12 GMT server cloudflare etag "81ed7bc1309fce5cd1b0c43e40a61b2d" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/png cache-control no-cache accept-ranges bytes cf-ray 7e638de33911bb44-FRA x-amz-cf-id cnKlPGUMV7vtzSQ2sdjKlzidaLZ9p_FRfJIKKJF56_BmHruvC9pZfw==
GET H3	204	watchtime Show response www.youtube.com/api/stats/ Frame D2D9	0 18 B	22ms 21ms	XHR text/html	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/api/stats/watchtime?ns=yt&el=embedded&cpn=Kk9qsfS74t8Vk3_0&ver=2&cmt=2.414&fmt=248&fs=0&rt=3.003&euri=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&lact=3041&cl=546728719&state=playing&volume=100&cbr=Chrome&cbrver=114.0.5735.198&c=WEB_EMBEDDED_PLAYER&cver=1.20230709.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&autoplay=1&delay=4&hl=de_DE&cr=DE&len=30&rtn=13&afmt=250&idpj=-8&ldpj=-18&rti=3&size=4800%3A1079&inview=0&st=0&et=2.414&muted=1&docid=NIVQmaxs6TE&ei=_kCwZIf9IczI1gLC9rboBQ&plid=AAYAYmu-8vWELtZJ&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FNIVQmaxs6TE%3Fplaylist%3DNIVQmaxs6TE%26rel%3D0%26autoplay%3D1%26controls%3D0%26showinfo%3D0%26loop%3D1%26mute%3D1&list=TLGGSwT3bhDHDdgxMzA3MjAyMw&of=-_xhI4eL4MjOL53E0nwGhA&vm=CAEQABgEOjJBRmtzQzRxbkNKYWs2NlljdzdsMFJSUlR1TkhnejVHRzFvdmdNVnZKTmg5Y1FLYUVpZ2JYQVBta0tESkNiQlFIZmlmVjRPUVk3WHRCZXlVY0E0a0swWWFJOHplZXlDTFA4RW81dmllRGx2Sk5XSDZBWTRlVE82SVlUd2l3b3otbENHSHJPVGNUdHoxWmgB Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230709.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgtxMVlqbF8zUXA2dyj9gcGlBg%3D%3D X-YouTube-Ad-Signals dt=1689272574334&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:57 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	identity Show response onboard.triptease.io/	161 B 835 B	13ms 12ms	Fetch application/json	2606:4700:3035::ac43:c0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/identity Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:c0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 71823232ed14dd20133dc2703c930937ff32d65f06fbf484ed76f727315a06e0 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:57 GMT strict-transport-security max-age=15552000 content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UcZNaFQyQ1ta4QlzYgkv16PfmFs4phZFFxmfyMmtEHdO1prcX2RpThFucAfICWo7g3OlCUs2kw8SeyGCEHv9Td9qqnnkKBt%2F%2F1C0bTMtRFEWCka%2BFmiIWGMdPEwQJ%2FENpanjfpqJSivulzuFir8ACMbcTA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=utf-8 access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-store, no-cache access-control-allow-credentials true cf-ray 7e638de9bad118e2-FRA alt-svc h3=":443"; ma=86400
GET H3	200	claim Show response onboard.triptease.io/	2 B 554 B	177ms 177ms	Fetch application/json	2606:4700:3035::ac43:c0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/claim?apiKey=d50e117bb1474b8d9a401cbd68d286a9 Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:c0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:57 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H1YVy6ffvS1mo8JHhoYUzXjm7o9uuF49vL8Q0cr2JqO99%2FwnFiy4ycXNmISmJMjM3kYvzN9nGa3fygswN02X5Vmgt1KQ6Ce1oBSDnhiWE%2BgjM6RvHebsC6ug1%2BqIDCHZ6s3SanLVFJQVORJyvukQHkIIFQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=utf-8 access-control-allow-origin https://www.firstgroup-sa.co.za cache-control no-cache, no-store, max-age=0 access-control-allow-credentials true cf-ray 7e638dea2b4118e2-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept alt-svc h3=":443"; ma=86400
GET H2	200	bootstrap-message-engine.js Show response targeted-messages.triptease.io/static/	85 KB 30 KB	103ms 26ms	Script application/javascript	2606:4700:3034::6815:1478
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Requested by Host: onboard.triptease.io URL: https://onboard.triptease.io/bootstrap.js?integrationId=01FZGACC90HYFT4DTPHMABCEX6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:1478 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash 9df48ba65eec9d823816907a7646e55041f9bac1a3b62d2a52e3e99a63063eb6 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Origin https://www.firstgroup-sa.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:57 GMT strict-transport-security max-age=15552000 content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-goog-meta-goog-reserved-file-mtime 1688717634 age 297 x-guploader-uploadid ADPycdt_RaNzOa4MloKWKzKXU6hkPhz5zX8J5NWTLHpILrrKVLcg7_8vFNnwjCQ1u8AkwQ9Bvoq9ya9TQHENOhoxdkKl_3mJw5Cu x-goog-storage-class STANDARD x-goog-metageneration 2 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=86400 last-modified Fri, 07 Jul 2023 08:13:58 GMT server cloudflare etag W/"d9c653d42b3870bc7a45671d00744842" vary Accept-Encoding x-goog-generation 1688717638091593 content-type application/javascript access-control-allow-origin * x-goog-hash crc32c=MqTtEA==, md5=2cZT1Cs4cLx6RWcdAHRIQg== access-control-expose-headers Content-Type cache-control public, max-age=600 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=raXVak9uZd6BDKxRPH7JzB879wmMAkUstBourfzd9NzsfNuOXxhSprwNh8g7RidwXqPl%2B9C1b%2FeJOOFaqAK91Rwx4kWgQRUf8bt7%2Fq2rAwtCUwWB64CvcqiNT3DewFvJBjOzJjvAWhM1kNojob9IPMrlMbpJ0brs%2FQ7nswY%3D"}],"group":"cf-nel","max_age":604800} x-goog-stored-content-length 87416 cf-ray 7e638debe8033609-FRA expires Thu, 13 Jul 2023 18:20:17 GMT
GET H3	200	storageIframe.html Show response targeted-messages.triptease.io/static/ Frame 80AF	7 KB 4 KB	36ms 21ms	Document text/html	2606:4700:3034::6815:1478
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/storageIframe.html Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash 44967af7d7413422ff93ef8e795f138ffa16e64d705bf2fcdbb164145e7d651f Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type age 409 alt-svc h3=":443"; ma=86400 cache-control public, max-age=600 cf-cache-status HIT cf-ray 7e638dec5a033820-FRA content-encoding br content-type text/html date Thu, 13 Jul 2023 18:22:57 GMT expires Thu, 13 Jul 2023 18:24:15 GMT last-modified Thu, 29 Jun 2023 09:56:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y1EdRKq90Bei2KEWstOSgEkYsCpoq%2F5SvuvurPOD73Cf6vioLcAhHAdzmtF3yJD6EM2cBsmsT2p9zVQRwpaLlqlm%2BB0zebca%2FodgNxv9lAKl%2Ba0bRbkyv98q9B7Vs9JU%2BmUYw6s8lcqKW6Vlxj03LuQF%2BGMGKz%2FqbLRvKus%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1688032590472706 x-goog-hash crc32c=/G3XxQ== md5=98b+KQq4ov4sQNnkjjyKNw== x-goog-meta-goog-reserved-file-mtime 1688032586 x-goog-metageneration 3 x-goog-storage-class STANDARD x-goog-stored-content-encoding identity x-goog-stored-content-length 7485 x-guploader-uploadid ADPycdsRx4G7OCzgAFMwiIRso4BAFlW33guuvmfe8juhaxKb4Ya4pjpu0fFR6x8Kdlyb0xJfErWRBSnk0qiVavR2L0dd3Q
GET H3	200	storageIframe.html Show response targeted-messages.triptease.io/static/ Frame B46E	7 KB 4 KB	36ms 23ms	Document text/html	2606:4700:3034::6815:1478
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/storageIframe.html Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash 44967af7d7413422ff93ef8e795f138ffa16e64d705bf2fcdbb164145e7d651f Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type age 409 alt-svc h3=":443"; ma=86400 cache-control public, max-age=600 cf-cache-status HIT cf-ray 7e638dec5a063820-FRA content-encoding br content-type text/html date Thu, 13 Jul 2023 18:22:57 GMT expires Thu, 13 Jul 2023 18:24:15 GMT last-modified Thu, 29 Jun 2023 09:56:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nx16uCv88zuYsb6yyirgzbiBQlbTae4DJlgVm62OIPt3myL4TzVFczPskYDqCNzRDKHX9bVEyOIazpEQTu%2Fx36o1UXVTbHageJTKL3GlqMwYJ9NNwlJwDJgzS26pdAVNidz%2FGmQwS90JYjpCXoITUvFO1Duz0v31PrH%2BxUY%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1688032590472706 x-goog-hash crc32c=/G3XxQ== md5=98b+KQq4ov4sQNnkjjyKNw== x-goog-meta-goog-reserved-file-mtime 1688032586 x-goog-metageneration 3 x-goog-storage-class STANDARD x-goog-stored-content-encoding identity x-goog-stored-content-length 7485 x-guploader-uploadid ADPycdsRx4G7OCzgAFMwiIRso4BAFlW33guuvmfe8juhaxKb4Ya4pjpu0fFR6x8Kdlyb0xJfErWRBSnk0qiVavR2L0dd3Q
GET H2	200	messages Show response messages.guest-experience.triptease.io/d50e117bb1474b8d9a401cbd68d286a9/	13 KB 13 KB	295ms 223ms	Fetch application/json	151.101.66.133
General Check archive.org Show headers Download Go to Full URL https://messages.guest-experience.triptease.io/d50e117bb1474b8d9a401cbd68d286a9/messages?language=en Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.66.133 -, , ASN (), Reverse DNS Software Google Frontend / Resource Hash 4c0c3192bf2876c5a3747a675aba6ea3b4d05e5cad3ea7e69163d0a4804cb0e5 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:58 GMT via 1.1 varnish age 0 x-cache MISS x-city bocholt content-length 13202 x-served-by cache-fra-eddf8230119-FRA server Google Frontend vary Origin tt_keys campaigns-d50e117bb1474b8d9a401cbd68d286a9 campaigns-client-FIRSTGROUP access-control-allow-origin https://www.firstgroup-sa.co.za x-region-code NW x-cloud-trace-context 651bc77159ae4f9facd16a2a865acf3f cache-control public,stale-if-error=600,stale-while-revalidate=10,max-age=600 access-control-allow-credentials true content-type application/json; charset=utf-8 tt_host messages.guest-experience.triptease.io access-control-expose-headers X-Country-Code, X-Region-Code, X-City accept-ranges bytes x-country-code DE x-cache-hits 0
GET H2	200	messages Show response messages.guest-experience.triptease.io/d50e117bb1474b8d9a401cbd68d286a9/	13 KB 13 KB	287ms 224ms	Fetch application/json	151.101.66.133
General Check archive.org Show headers Download Go to Full URL https://messages.guest-experience.triptease.io/d50e117bb1474b8d9a401cbd68d286a9/messages?language=en Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.66.133 -, , ASN (), Reverse DNS Software Google Frontend / Resource Hash 4c0c3192bf2876c5a3747a675aba6ea3b4d05e5cad3ea7e69163d0a4804cb0e5 Request headers accept-language de-DE,de;q=0.9 Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 18:22:58 GMT via 1.1 varnish age 0 x-cache HIT x-city bocholt content-length 13202 x-served-by cache-fra-eddf8230119-FRA server Google Frontend vary Origin tt_keys campaigns-d50e117bb1474b8d9a401cbd68d286a9 campaigns-client-FIRSTGROUP access-control-allow-origin https://www.firstgroup-sa.co.za x-region-code NW x-cloud-trace-context 651bc77159ae4f9facd16a2a865acf3f cache-control public,stale-if-error=600,stale-while-revalidate=10,max-age=600 access-control-allow-credentials true content-type application/json; charset=utf-8 tt_host messages.guest-experience.triptease.io access-control-expose-headers X-Country-Code, X-Region-Code, X-City accept-ranges bytes x-country-code DE x-cache-hits 1
POST H2	200	event api.triptease.io/zappy/	0 201 B	204ms 116ms	Ping text/plain	35.186.195.233
General Check archive.org Show headers Download Go to Full URL https://api.triptease.io/zappy/event?eventName=propensityToConvert&eventAppName=messageEngine Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.195.233 -, , ASN (), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 13 Jul 2023 18:22:58 GMT via 1.1 google access-control-max-age 86400 access-control-allow-methods GET,PUT,POST,DELETE content-type text/plain; charset=utf-8 access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0
POST H2	200	event api.triptease.io/zappy/	0 42 B	206ms 118ms	Ping text/plain	35.186.195.233
General Check archive.org Show headers Download Go to Full URL https://api.triptease.io/zappy/event?eventName=propensityToConvert&eventAppName=messageEngine Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.195.233 -, , ASN (), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 13 Jul 2023 18:22:58 GMT via 1.1 google access-control-max-age 86400 access-control-allow-methods GET,PUT,POST,DELETE content-type text/plain; charset=utf-8 access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0
POST H2	200	event api.triptease.io/zappy/	0 42 B	203ms 119ms	Ping text/plain	35.186.195.233
General Check archive.org Show headers Download Go to Full URL https://api.triptease.io/zappy/event?eventName=messageAvailable Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.195.233 -, , ASN (), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 13 Jul 2023 18:22:58 GMT via 1.1 google access-control-max-age 86400 access-control-allow-methods GET,PUT,POST,DELETE content-type text/plain; charset=utf-8 access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0
GET H3	200	countdown.html Show response targeted-messages.triptease.io/static/ Frame 26A5	338 KB 109 KB	132ms 131ms	Document text/html	2606:4700:3034::6815:1478
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/countdown.html Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash ebf31d11f17eef4e5c94b780775d9554753850b89c62648bcd3b0c5ef6bb3568 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type alt-svc h3=":443"; ma=86400 cache-control public, max-age=600 cf-cache-status REVALIDATED cf-ray 7e638dee9d143820-FRA content-encoding br content-type text/html date Thu, 13 Jul 2023 18:22:58 GMT expires Thu, 13 Jul 2023 18:32:58 GMT last-modified Thu, 29 Jun 2023 09:56:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uAL4LjRDP8FN7mmOOGvAlcUOgzmjnTQudh4B%2F5i0xJn0%2BhwCTrqUKR1kVf3KsZ6DLAjo1Mu6M3Z8V%2B%2BFBxvKEWh86mmeIjTSYeUUPI1gUoK6zSniiFcvurY1amZibeaAmfCJJAQjSWd06zV298aVs6DhFMMK%2BGfZazLSgfI%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1688032590340897 x-goog-hash crc32c=sXiSxA== md5=WnDz6zlFTptHfQcth/Kxaw== x-goog-meta-goog-reserved-file-mtime 1688032586 x-goog-metageneration 3 x-goog-storage-class STANDARD x-goog-stored-content-encoding identity x-goog-stored-content-length 345878 x-guploader-uploadid ADPycds8ZXM3rhSzX82LIHPGmiCZYA7kDDJiNhjNRT1Mw2IZmon6U4geZtfGn9KIH0otAjHGjn5GyUY9OONIZH9Z44HJXw
GET H3	200	countdown.html Show response targeted-messages.triptease.io/static/ Frame 4A99	338 KB 109 KB	149ms 148ms	Document text/html	2606:4700:3034::6815:1478
General Check archive.org Show headers Download Go to Full URL https://targeted-messages.triptease.io/static/countdown.html Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::6815:1478 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash ebf31d11f17eef4e5c94b780775d9554753850b89c62648bcd3b0c5ef6bb3568 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * access-control-expose-headers Content-Type alt-svc h3=":443"; ma=86400 cache-control public, max-age=600 cf-cache-status REVALIDATED cf-ray 7e638dee9d183820-FRA content-encoding br content-type text/html date Thu, 13 Jul 2023 18:22:58 GMT expires Thu, 13 Jul 2023 18:32:58 GMT last-modified Thu, 29 Jun 2023 09:56:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nDdZvpRUkHqJmygm1tFlhLqF8Id6zHk1gICuOWRXfolp1U5jK9miDzPzSp6hkkbF14szWSiP7UdJ6GR5%2FyASPakM7rxr%2FGz0%2BDdKGkb4bXkVR6T5NdGeNoFdKK4porh2HOTRYXPjJYeddLjyQhoCRL9NCbI4letwOHBCxJQ%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000 vary Accept-Encoding x-goog-generation 1688032590340897 x-goog-hash crc32c=sXiSxA== md5=WnDz6zlFTptHfQcth/Kxaw== x-goog-meta-goog-reserved-file-mtime 1688032586 x-goog-metageneration 3 x-goog-storage-class STANDARD x-goog-stored-content-encoding identity x-goog-stored-content-length 345878 x-guploader-uploadid ADPycds8ZXM3rhSzX82LIHPGmiCZYA7kDDJiNhjNRT1Mw2IZmon6U4geZtfGn9KIH0otAjHGjn5GyUY9OONIZH9Z44HJXw
POST H3	200	videoplayback Show response rr1---sn-5hnekn7k.googlevideo.com/ Frame D2D9	1 MB 1 MB	16ms 16ms	Fetch application/vnd.yt-ump	2a00:1450:400e:2::6 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://rr1---sn-5hnekn7k.googlevideo.com/videoplayback?expire=1689294174&ei=_kCwZIf9IczI1gLC9rboBQ&ip=2a00%3Ac98%3A2050%3Aa007%3A2%3A%3A4&id=o-AKwSyA-7qk_r3sx2hL_2iEa28ZdLuprcUhEsZFTDzSab&itag=248&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=DE&mm=31%2C29&mn=sn-5hnekn7k%2Csn-5hne6nsd&ms=au%2Crdu&mv=m&mvi=1&pl=44&initcwndbps=347500&spc=Ul2SqzcJ1HUOVV6yXgdX-d5Oggiao9qtwkoY94JVpw&vprv=1&svpuc=1&mime=video%2Fwebm&ns=Ak4r2OJ8_VQt9_qW_XbJ750O&gir=yes&clen=7804629&dur=30.000&lmt=1658290312237003&mt=1689272263&fvip=1&keepalive=yes&fexp=24007246%2C24362687%2C51000024&beids=24350018&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=q0Rv63q8oIRukA&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgRcLVR1hi4HhycRwRxk8P0OZZXcPbEbGRklYYANWyQBkCIGDzRylBov5bSstkNTokczApPturMib0LAgeayYTcmUg&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRAIgT90qdHJQ6Jpuu_PsQGKOs3ybRn3mCrj76WmeZ3lw7IICIFzNBTzkvZuHlznqK5MlNUa0XWTtL2zoBELofjyeV2ub&alr=yes&cpn=Kk9qsfS74t8Vk3_0&cver=1.20230709.00.00&range=4011919-5519830&rn=7&rbuf=12215&pot=MmTyeNEUVx-XCvJAJTI5u16AUSdacnu7eXx8cE-7N0LwGIoOuzBKwTW1h90noE847ChfyGDtdvFk91-iirPCqSRC8-zktxfF0SK9OxNfKFqtly_Cnq9qxgJ1MAkRapShnWClnF_G&ump=1&srfvp=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400e:2::6 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software gvs 1.0 / Resource Hash 3e1c4894570ad01ba5bf19ac427fba18b1b5f3cbd09641469528d5a877da11d2 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers expires Thu, 13 Jul 2023 18:22:58 GMT date Thu, 13 Jul 2023 18:22:58 GMT x-restrict-formats-hint None x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46" last-modified Wed, 20 Jul 2022 04:11:52 GMT server gvs 1.0 vary Origin content-type application/vnd.yt-ump access-control-allow-origin https://www.youtube.com access-control-expose-headers Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms cache-control private, max-age=21296 access-control-allow-credentials true timing-allow-origin https://www.youtube.com client-protocol quic
GET H2	200	css fonts.googleapis.com/ Frame 4A99	5 KB 797 B	25ms 24ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:400,700 Requested by Host: targeted-messages.triptease.io URL: https://targeted-messages.triptease.io/static/countdown.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 67eb879fb1645c73ccbaac598e815fd3901eb5114228021d686b8b5e470edbbd Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://targeted-messages.triptease.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 13 Jul 2023 18:22:58 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 13 Jul 2023 18:22:43 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 13 Jul 2023 18:22:58 GMT
GET H3	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v35/ Frame 4A99	47 KB 47 KB	15ms 14ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://targeted-messages.triptease.io accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 00:21:44 GMT x-content-type-options nosniff age 496874 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48412 x-xss-protection 0 last-modified Tue, 02 May 2023 15:08:53 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 00:21:44 GMT
GET H3	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v35/ Frame 4A99	47 KB 47 KB	18ms 18ms	Font font/woff2	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://targeted-messages.triptease.io accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 08 Jul 2023 00:21:44 GMT x-content-type-options nosniff age 496874 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48412 x-xss-protection 0 last-modified Tue, 02 May 2023 15:08:53 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 07 Jul 2024 00:21:44 GMT
POST H2	200	event api.triptease.io/zappy/	0 42 B	112ms 112ms	Ping text/plain	35.186.195.233
General Check archive.org Show headers Download Go to Full URL https://api.triptease.io/zappy/event?eventName=opened&eventAppName=abandonment Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.195.233 -, , ASN (), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 13 Jul 2023 18:22:58 GMT via 1.1 google access-control-max-age 86400 access-control-allow-methods GET,PUT,POST,DELETE content-type text/plain; charset=utf-8 access-control-allow-origin https://www.firstgroup-sa.co.za alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0
POST H3	204	batch onboard.triptease.io/message/	0 476 B	190ms 189ms	Ping text/html	2606:4700:3035::ac43:c0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onboard.triptease.io/message/batch Requested by Host: dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com URL: https://dd1562d995504d8bb9c66c5977d5221d.svc.dynamics.com/t/t/xQR3Fbjt6xWg5oOQ40PCVlqVlGWB7zF63EdXCsqc8zUx/viE8pV1aqGOQVdhyDaabO771bqemXY3yxktZsEEy9Cox Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:c0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers Referer https://www.firstgroup-sa.co.za/midlands-saddle-and-trout accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 13 Jul 2023 18:22:58 GMT strict-transport-security max-age=15552000 cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ggnjOx%2F22Dw%2F443foBHz733IusnvKVBabvKJfgPIRxBwXPFIaREJ42UImDpt372vJ6LUX0FH3XJy3L7sUyOSBqKJ3L8flbLbLsxow0iodI47jqJT%2FfOL2KG4wEfiZIM2R83leMCIHMLTKXEzXpdqcbdwmA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html access-control-allow-origin * x-cloud-trace-context c94eacbb0571446b431c633c378f1799 cf-ray 7e638df0dd2e18e2-FRA alt-svc h3=":443"; ma=86400
GET H3	204	delayplay Show response www.youtube.com/api/stats/ Frame D2D9	0 18 B	22ms 21ms	XHR text/html	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/api/stats/delayplay?ns=yt&el=embedded&cpn=Kk9qsfS74t8Vk3_0&ver=2&cmt=4.004&fmt=248&fs=0&rt=4.592&euri=https%3A%2F%2Fwww.firstgroup-sa.co.za%2Fmidlands-saddle-and-trout&lact=4630&cl=546728719&mos=1&volume=100&cbr=Chrome&cbrver=114.0.5735.198&c=WEB_EMBEDDED_PLAYER&cver=1.20230709.00.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&autoplay=1&epm=1&delay=4&hl=de_DE&cr=DE&len=30&fexp=23983296%2C24004644%2C24007246%2C24080738%2C24135310%2C24208765%2C24362633%2C24362687%2C24364789%2C24366065%2C24366917%2C24368832%2C24370597%2C24380264%2C24383853%2C24415864%2C24416290%2C24439361%2C24559328&afmt=250&size=4800%3A1079&inview=0&muted=1&docid=NIVQmaxs6TE&ei=_kCwZIf9IczI1gLC9rboBQ&plid=AAYAYmu-8vWELtZJ&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FNIVQmaxs6TE%3Fplaylist%3DNIVQmaxs6TE%26rel%3D0%26autoplay%3D1%26controls%3D0%26showinfo%3D0%26loop%3D1%26mute%3D1&list=TLGGSwT3bhDHDdgxMzA3MjAyMw&of=-_xhI4eL4MjOL53E0nwGhA&vm=CAEQABgEOjJBRmtzQzRxbkNKYWs2NlljdzdsMFJSUlR1TkhnejVHRzFvdmdNVnZKTmg5Y1FLYUVpZ2JYQVBta0tESkNiQlFIZmlmVjRPUVk3WHRCZXlVY0E0a0swWWFJOHplZXlDTFA4RW81dmllRGx2Sk5XSDZBWTRlVE82SVlUd2l3b3otbENHSHJPVGNUdHoxWmgB Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Video Stats Server / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1 X-YouTube-Client-Version 1.20230709.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgtxMVlqbF8zUXA2dyj9gcGlBg%3D%3D X-YouTube-Ad-Signals dt=1689272574334&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C4800%2C1079&vis=1&wgl=true&ca_type=image Response headers pragma no-cache date Thu, 13 Jul 2023 18:22:59 GMT x-content-type-options nosniff server Video Stats Server x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.youtube.com

URL

https://www.youtube.com/s/player/f2f137c6/www-player.css

Domain

www.youtube.com

URL

https://www.youtube.com/s/player/f2f137c6/www-embed-player.vflset/www-embed-player.js

Domain

www.youtube.com

URL

https://www.youtube.com/s/player/f2f137c6/player_ias.vflset/de_DE/base.js

Domain

www.youtube.com

URL

https://www.youtube.com/s/player/f2f137c6/fetch-polyfill.vflset/fetch-polyfill.js

Domain

www.youtube.com

URL

https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1

Domain

www.youtube.com

URL

https://www.youtube.com/embed/NIVQmaxs6TE?playlist=NIVQmaxs6TE&rel=0&autoplay=1&controls=0&showinfo=0&loop=1&mute=1