philadelphiamarriottdowntown.idaypass.com Open in urlscan Pro
54.172.5.148 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://philadelphiamarriottdowntown.idaypass.com/
Effective URL:
https://philadelphiamarriottdowntown.idaypass.com/
Submission: On March 09 via api (March 9th 2023, 12:30:28 pm UTC) from US — Scanned from US

Summary HTTP 177 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 53 IPs in 3 countries across 51 domains to perform 177 HTTP transactions. The main IP is 54.172.5.148, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is philadelphiamarriottdowntown.idaypass.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 1st 2022. Valid for: a year.

This is the only time philadelphiamarriottdowntown.idaypass.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.54.85.170 52.54.85.170	14618 (AMAZON-AES) (AMAZON-AES)
24	54.172.5.148 54.172.5.148	14618 (AMAZON-AES) (AMAZON-AES)
21	2600:141b:900... 2600:141b:9000:499::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2607:f8b0:400... 2607:f8b0:4006:81c::200a	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4006:80e::200e	15169 (GOOGLE) (GOOGLE)
2 19	44.213.4.79 44.213.4.79	14618 (AMAZON-AES) (AMAZON-AES)
1	54.243.116.235 54.243.116.235	14618 (AMAZON-AES) (AMAZON-AES)
1 1	52.204.87.171 52.204.87.171	14618 (AMAZON-AES) (AMAZON-AES)
1	34.120.195.249 34.120.195.249	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
7	173.223.56.96 173.223.56.96	16625 (AKAMAI-AS) (AKAMAI-AS)
2	63.140.38.104 63.140.38.104	14618 (AMAZON-AES) (AMAZON-AES)
5 6	68.67.178.10 68.67.178.10	29990 (ASN-APPNEX) (ASN-APPNEX)
8	2607:f8b0:400... 2607:f8b0:4006:817::2008	15169 (GOOGLE) (GOOGLE)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:9000:24e... 2600:9000:24eb:7c00:1d:bf0a:0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	143.204.138.162 143.204.138.162	16509 (AMAZON-02) (AMAZON-02)
8	107.178.244.119 107.178.244.119	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	205.180.85.201 205.180.85.201	25751 (VALUECLICK) (VALUECLICK)
2 2	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
2	3.209.227.78 3.209.227.78	14618 (AMAZON-AES) (AMAZON-AES)
2	2a04:4e42:46::84 2a04:4e42:46::84	54113 (FASTLY) (FASTLY)
2	108.138.113.246 108.138.113.246	16509 (AMAZON-02) (AMAZON-02)
1	2600:141b:500... 2600:141b:5000::17df:9c20	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	35.244.188.9 35.244.188.9	15169 (GOOGLE) (GOOGLE)
2	2001:4998:1c:... 2001:4998:1c:800::1001	14779 (YAHOO) (YAHOO)
8 9	142.251.40.194 142.251.40.194	15169 (GOOGLE) (GOOGLE)
9 10	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::6812:2b9e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	52.216.138.139 52.216.138.139	16509 (AMAZON-02) (AMAZON-02)
6 6	142.250.80.38 142.250.80.38	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:80d::2002	15169 (GOOGLE) (GOOGLE)
2	68.67.179.113 68.67.179.113	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	2607:f8b0:400... 2607:f8b0:4006:824::200e	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:816::200e	15169 (GOOGLE) (GOOGLE)
1 6	35.190.43.134 35.190.43.134	15169 (GOOGLE) (GOOGLE)
1	198.148.27.139 198.148.27.139	19189 (PULSEPOINT) (PULSEPOINT)
1	173.223.57.84 173.223.57.84	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	3.232.64.79 3.232.64.79	14618 (AMAZON-AES) (AMAZON-AES)
2	3.232.140.34 3.232.140.34	14618 (AMAZON-AES) (AMAZON-AES)
3	2606:ae80:145... 2606:ae80:1451:21::500	25751 (VALUECLICK) (VALUECLICK)
2 2	3.218.90.66 3.218.90.66	14618 (AMAZON-AES) (AMAZON-AES)
2 4	8.43.72.98 8.43.72.98	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	2606:ae80:145... 2606:ae80:1451:24::760	25751 (VALUECLICK) (VALUECLICK)
2	44.209.164.40 44.209.164.40	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:224... 2600:9000:2245:4a00:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	173.223.56.237 173.223.56.237	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	96.6.31.207 96.6.31.207	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	18.211.176.57 18.211.176.57	14618 (AMAZON-AES) (AMAZON-AES)
2	76.13.32.146 76.13.32.146	26101 (YAHOO-BF1) (YAHOO-BF1)
3	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2607:f8b0:400... 2607:f8b0:4006:81d::2002	15169 (GOOGLE) (GOOGLE)
2 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	2606:4700::68... 2606:4700::6812:18ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 6	35.190.52.204 35.190.52.204	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:81e::2004	15169 (GOOGLE) (GOOGLE)
2 2	2620:100:a001::c 2620:100:a001::c	19750 (AS-CRITEO) (AS-CRITEO)
1 1	76.13.32.147 76.13.32.147	26101 (YAHOO-BF1) (YAHOO-BF1)
1 1	35.190.90.30 35.190.90.30	15169 (GOOGLE) (GOOGLE)
1 1	2600:1f16:b8a... 2600:1f16:b8a:8e01:beb1:fd3b:512c:30a3	16509 (AMAZON-02) (AMAZON-02)
8 8	151.101.2.49 151.101.2.49	54113 (FASTLY) (FASTLY)
1 2	192.40.39.223 192.40.39.223	27381 (CASALE-MEDIA) (CASALE-MEDIA)
1 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	8.28.7.83 8.28.7.83	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	192.35.249.138 192.35.249.138	11742 (SPOTX-IAD) (SPOTX-IAD)
1 2	152.136.187.208 152.136.187.208	45090 (TENCENT-N...) (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited)
177	53

1 52.54.85.170 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-85-170.compute-1.amazonaws.com

philadelphiamarriottdowntown.idaypass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 54.172.5.148 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-172-5-148.compute-1.amazonaws.com

philadelphiamarriottdowntown.idaypass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2600:141b:9000:499::1e80 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::200a (Nutley, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:80e::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 44.213.4.79 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-213-4-79.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.243.116.235 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-243-116-235.compute-1.amazonaws.com

marriottinternationa.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.204.87.171 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-87-171.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.195.249 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 249.195.120.34.bc.googleusercontent.com

o436887.ingest.sentry.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 173.223.56.96 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a173-223-56-96.deploy.static.akamaitechnologies.com

cache.marriott.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.38.104 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-104.data.adobedc.net

smetrics.marriott.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 68.67.178.10 (North Bergen, United States) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2607:f8b0:4006:817::2008 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:24eb:7c00:1d:bf0a:0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.138.162 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-138-162.ewr52.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 107.178.244.119 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 119.244.178.107.bc.googleusercontent.com

beacon.sojern.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.sojern.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.180.85.201 (United States)

ASN25751 (VALUECLICK, US)
PTR: iad06-nessy-float1.dotomi.com

login.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.60.146 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.209.227.78 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-209-227-78.compute-1.amazonaws.com

pxl.jivox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:46::84 (United States)

ASN54113 (FASTLY, US)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.138.113.246 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-113-246.jfk50.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:5000::17df:9c20 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.188.9 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 9.188.244.35.bc.googleusercontent.com

static.sojern.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4998:1c:800::1001 (United States)

ASN14779 (YAHOO, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.251.40.194 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s38-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 15.197.193.217 (United States) 9 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2b9e (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.216.138.139 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

ipoolside-media.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.80.38 (Glen Cove, United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80d::2002 (Nutley, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.179.113 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:824::200e (Nutley, United States) 2 redirects

ASN15169 (GOOGLE, US)

fcmatch.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:816::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

fcmatch.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.190.43.134 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 134.43.190.35.bc.googleusercontent.com

tr.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.139 (New York, United States)

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.223.57.84 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a173-223-57-84.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.232.64.79 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-64-79.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.232.140.34 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-140-34.compute-1.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:ae80:1451:21::500 (United States)

ASN25751 (VALUECLICK, US)

match.sync.ad.cpe.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.218.90.66 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-218-90-66.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 8.43.72.98 (United States) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:ae80:1451:24::760 (United States) 1 redirects

ASN25751 (VALUECLICK, US)

login-ds.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adobe-sync.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.209.164.40 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-209-164-40.compute-1.amazonaws.com

p.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2245:4a00:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 173.223.56.237 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a173-223-56-237.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.6.31.207 (Secaucus, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a96-6-31-207.deploy.static.akamaitechnologies.com

servedby.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.211.176.57 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-176-57.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.13.32.146 (Lockport, United States)

ASN26101 (YAHOO-BF1, US)
PTR: spdc.pbp.vip.bf1.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81d::2002 (Nutley, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:18ad (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.190.52.204 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 204.52.190.35.bc.googleusercontent.com

tag.yieldoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::2004 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:100:a001::c (United States) 2 redirects

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.13.32.147 (Lockport, United States) 1 redirects

ASN26101 (YAHOO-BF1, US)
PTR: spcms.pbp.vip.bf1.yahoo.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.90.30 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 30.90.190.35.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f16:b8a:8e01:beb1:fd3b:512c:30a3 (Columbus, United States) 1 redirects

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.2.49 (United States) 8 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.40.39.223 (Canada) 1 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.35.249.138 (Ashburn, United States) 1 redirects

ASN11742 (SPOTX-IAD, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 152.136.187.208 (China) 1 redirects

ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN)

cm.ipinyou.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	idaypass.com 1 redirects philadelphiamarriottdowntown.idaypass.com	3 MB
21	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 457	150 KB
20	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 200 marriottinternationa.demdex.net — Cisco Umbrella Rank: 40950	22 KB
16	doubleclick.net 14 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 210 ad.doubleclick.net — Cisco Umbrella Rank: 170 googleads.g.doubleclick.net — Cisco Umbrella Rank: 28	6 KB
12	adsrvr.org 9 redirects js.adsrvr.org — Cisco Umbrella Rank: 1389 insight.adsrvr.org — Cisco Umbrella Rank: 555 match.adsrvr.org — Cisco Umbrella Rank: 296	9 KB
9	sojern.com beacon.sojern.com — Cisco Umbrella Rank: 4589 static.sojern.com — Cisco Umbrella Rank: 14271 pixel.sojern.com — Cisco Umbrella Rank: 7050	13 KB
9	marriott.com cache.marriott.com — Cisco Umbrella Rank: 14890 smetrics.marriott.com — Cisco Umbrella Rank: 20394	330 KB
9	everesttech.net 9 redirects cm.everesttech.net — Cisco Umbrella Rank: 1019 sync-tm.everesttech.net — Cisco Umbrella Rank: 585	2 KB
8	amazonaws.com ipoolside-media.s3.amazonaws.com — Cisco Umbrella Rank: 901135	1 MB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 41	446 KB
8	adnxs.com 5 redirects ib.adnxs.com — Cisco Umbrella Rank: 208 secure.adnxs.com — Cisco Umbrella Rank: 380	8 KB
7	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 768	5 KB
6	yieldoptimizer.com 3 redirects tag.yieldoptimizer.com — Cisco Umbrella Rank: 3909	4 KB
6	snapchat.com 1 redirects tr.snapchat.com — Cisco Umbrella Rank: 836	3 KB
6	google.com 2 redirects adservice.google.com — Cisco Umbrella Rank: 65 fcmatch.google.com — Cisco Umbrella Rank: 2790 www.google.com — Cisco Umbrella Rank: 2	2 KB
6	dotomi.com 1 redirects login.dotomi.com — Cisco Umbrella Rank: 1735 match.sync.ad.cpe.dotomi.com — Cisco Umbrella Rank: 1928 login-ds.dotomi.com — Cisco Umbrella Rank: 5432 adobe-sync.dotomi.com — Cisco Umbrella Rank: 81653	4 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 317 www.linkedin.com — Cisco Umbrella Rank: 556 px4.ads.linkedin.com — Cisco Umbrella Rank: 6245	4 KB
5	yahoo.com 3 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 271 sp.analytics.yahoo.com — Cisco Umbrella Rank: 1109 cms.analytics.yahoo.com — Cisco Umbrella Rank: 870	2 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 24	40 KB
4	rubiconproject.com 2 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 316	3 KB
4	krxd.net 2 redirects beacon.krxd.net — Cisco Umbrella Rank: 570 usermatch.krxd.net — Cisco Umbrella Rank: 1391	756 B
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 343 c.bing.com — Cisco Umbrella Rank: 239	13 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 108	313 B
3	tvpixel.com c.tvpixel.com — Cisco Umbrella Rank: 8871 p.tvpixel.com — Cisco Umbrella Rank: 1420	32 KB
2	ipinyou.com 1 redirects cm.ipinyou.com — Cisco Umbrella Rank: 71707	1 KB
2	spotxchange.com 1 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 710	901 B
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 415	499 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 519	1 KB
2	criteo.com 2 redirects gum.criteo.com — Cisco Umbrella Rank: 387	758 B
2	tribalfusion.com 2 redirects a.tribalfusion.com — Cisco Umbrella Rank: 734 s.tribalfusion.com — Cisco Umbrella Rank: 1808	966 B
2	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 409	1 KB
2	eyeota.net 1 redirects ps.eyeota.net — Cisco Umbrella Rank: 1036	1 KB
2	youtube.com fcmatch.youtube.com — Cisco Umbrella Rank: 2793	665 B
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 438	7 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 145	136 KB
2	sc-static.net sc-static.net — Cisco Umbrella Rank: 896	27 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 693	18 KB
2	jivox.com pxl.jivox.com — Cisco Umbrella Rank: 5140	453 B
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 344	837 B
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 856	451 B
1	innovid.com 1 redirects ag.innovid.com — Cisco Umbrella Rank: 1729	248 B
1	mookie1.com 1 redirects odr.mookie1.com — Cisco Umbrella Rank: 1131	611 B
1	flashtalking.com 1 redirects servedby.flashtalking.com — Cisco Umbrella Rank: 790	552 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 809	370 B
1	bluekai.com tags.bluekai.com — Cisco Umbrella Rank: 533	462 B
1	contextweb.com bh.contextweb.com — Cisco Umbrella Rank: 537	869 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 586	315 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 686	5 KB
1	sentry.io o436887.ingest.sentry.io — Cisco Umbrella Rank: 778940	295 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1 KB
0	rundsp.com Failed match.rundsp.com Failed
177	51

	Domain	Requested by
25	philadelphiamarriottdowntown.idaypass.com	1 redirects philadelphiamarriottdowntown.idaypass.com
21	assets.adobedtm.com	philadelphiamarriottdowntown.idaypass.com assets.adobedtm.com
19	dpm.demdex.net	2 redirects assets.adobedtm.com philadelphiamarriottdowntown.idaypass.com login.dotomi.com js.adsrvr.org
9	match.adsrvr.org	8 redirects js.adsrvr.org
9	cm.g.doubleclick.net	8 redirects
8	sync-tm.everesttech.net	8 redirects
8	ipoolside-media.s3.amazonaws.com
8	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com beacon.sojern.com
7	ct.pinterest.com	philadelphiamarriottdowntown.idaypass.com s.pinimg.com
7	cache.marriott.com	philadelphiamarriottdowntown.idaypass.com cache.marriott.com
6	tag.yieldoptimizer.com	3 redirects
6	tr.snapchat.com	1 redirects sc-static.net
6	pixel.sojern.com	static.sojern.com
6	ad.doubleclick.net	6 redirects
6	ib.adnxs.com	5 redirects
5	www.google-analytics.com	philadelphiamarriottdowntown.idaypass.com www.google-analytics.com www.googletagmanager.com
4	pixel.rubiconproject.com	2 redirects js.adsrvr.org
3	www.facebook.com
3	px.ads.linkedin.com	3 redirects
3	match.sync.ad.cpe.dotomi.com	login.dotomi.com
3	adservice.google.com
3	bat.bing.com	assets.adobedtm.com bat.bing.com
2	cm.ipinyou.com	1 redirects
2	sync.search.spotxchange.com	1 redirects
2	us-u.openx.net	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	gum.criteo.com	2 redirects
2	pixel.tapad.com	2 redirects
2	sp.analytics.yahoo.com
2	usermatch.krxd.net	2 redirects
2	p.tvpixel.com	philadelphiamarriottdowntown.idaypass.com
2	ups.analytics.yahoo.com	2 redirects
2	beacon.krxd.net	login.dotomi.com js.adsrvr.org
2	ps.eyeota.net	1 redirects login.dotomi.com
2	fcmatch.youtube.com	static.sojern.com
2	fcmatch.google.com	2 redirects
2	secure.adnxs.com
2	s.yimg.com	philadelphiamarriottdowntown.idaypass.com
2	connect.facebook.net	philadelphiamarriottdowntown.idaypass.com connect.facebook.net
2	sc-static.net	philadelphiamarriottdowntown.idaypass.com tr.snapchat.com
2	s.pinimg.com	philadelphiamarriottdowntown.idaypass.com s.pinimg.com
2	pxl.jivox.com
2	idsync.rlcdn.com	2 redirects
2	beacon.sojern.com	philadelphiamarriottdowntown.idaypass.com static.sojern.com
2	js.adsrvr.org	philadelphiamarriottdowntown.idaypass.com match.adsrvr.org
2	smetrics.marriott.com	assets.adobedtm.com
1	image2.pubmatic.com
1	ag.innovid.com	1 redirects
1	odr.mookie1.com	1 redirects
1	cms.analytics.yahoo.com	1 redirects
1	www.google.com	static.sojern.com
1	s.tribalfusion.com	1 redirects
1	a.tribalfusion.com	1 redirects
1	adobe-sync.dotomi.com	1 redirects
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	servedby.flashtalking.com	1 redirects
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	philadelphiamarriottdowntown.idaypass.com
1	c.bing.com	1 redirects
1	login-ds.dotomi.com	login.dotomi.com
1	tags.bluekai.com	login.dotomi.com
1	bh.contextweb.com	login.dotomi.com
1	geolocation.onetrust.com	philadelphiamarriottdowntown.idaypass.com
1	insight.adsrvr.org	1 redirects
1	static.sojern.com	philadelphiamarriottdowntown.idaypass.com
1	snap.licdn.com	philadelphiamarriottdowntown.idaypass.com
1	login.dotomi.com	philadelphiamarriottdowntown.idaypass.com
1	c.tvpixel.com	philadelphiamarriottdowntown.idaypass.com
1	o436887.ingest.sentry.io	philadelphiamarriottdowntown.idaypass.com
1	cm.everesttech.net	1 redirects
1	marriottinternationa.demdex.net	assets.adobedtm.com
1	fonts.googleapis.com	philadelphiamarriottdowntown.idaypass.com
0	match.rundsp.com Failed
177	74

This site contains links to these domains. Also see Links.

Domain
www.google.com
www.marriott.com
www.onetrust.com

Subject Issuer	Validity	Valid
*.idaypass.com Sectigo RSA Domain Validation Secure Server CA	`2022-09-01` - `2023-09-08`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-02-20` - `2023-05-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-02-20` - `2023-05-15`	3 months	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
*.ingest.sentry.io R3	`2023-02-16` - `2023-05-17`	3 months	crt.sh
www.marriott.com Entrust Certification Authority - L1K	`2022-11-30` - `2023-11-10`	a year	crt.sh
smetrics.marriott.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-24` - `2023-04-24`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2023-02-16` - `2023-08-16`	6 months	crt.sh
*.tvpixel.com Amazon RSA 2048 M01	`2023-02-21` - `2024-01-13`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.sojern.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-17` - `2024-02-17`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2022-08-09` - `2023-09-10`	a year	crt.sh
*.jivox.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-13` - `2023-06-13`	a year	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-28` - `2023-08-08`	a year	crt.sh
sc-static.net Amazon RSA 2048 M02	`2023-01-20` - `2024-02-18`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-01-10` - `2023-03-16`	2 months	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-02-27` - `2023-04-19`	2 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-12-13` - `2023-12-13`	a year	crt.sh
*.s3.amazonaws.com Amazon	`2022-09-21` - `2023-08-26`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.snap.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-16` - `2023-08-16`	a year	crt.sh
*.contextweb.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-07` - `2023-05-08`	a year	crt.sh
odc-pixel-prod-01.oracle.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-07` - `2024-02-08`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-27` - `2024-02-26`	a year	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-02-24` - `2023-08-06`	5 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-01-03` - `2023-06-28`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-02-20` - `2023-05-15`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-02-20` - `2023-05-15`	3 months	crt.sh

This page contains 11 frames:

Primary Page: https://philadelphiamarriottdowntown.idaypass.com/
Frame ID: 7FF22090C233A8665611208C9512DBE8
Requests: 121 HTTP requests in this frame

Frame: https://marriottinternationa.demdex.net/dest5.html?d_nsid=0
Frame ID: 8890ED8B43212D175B4FCBA8FB425E9B
Requests: 26 HTTP requests in this frame

Frame: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=
Frame ID: E19CFF9F10903A1FEC20ECDEB18C7811
Requests: 10 HTTP requests in this frame

Frame: https://static.sojern.com/marriott/mhotels.html?p=undefined&hprid=PHLDT&hpr=&hb=undefined&hc1=undefined&hn1=undefined&hs1=undefined&ffl=undefined&hl=&t=undefined&hr=undefined&hd1=&hd2=&hconfno=&hp=undefined&hcu=&hrp=undefined&hdc=undefined&rew=undefined&l=undefined&vid=hot&cid=
Frame ID: 7C4372CA925D8232B1DB7E673B639CC7
Requests: 9 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/upb/?adv=hbq9bjg&ref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&upid=byw7ch4&upv=1.1.0
Frame ID: E3433F6101CC0BE92BBEFA0957862A35
Requests: 2 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=fbf5aa06-3f82-45b5-86ba-4c4fe9c75a96&u_scsid=f3953abd-b8e7-4f3c-9b01-43886e4bc19f&u_sclid=e6b44b73-ee5d-4fd3-9701-fafba149f9f3
Frame ID: AD8094C1625EB09E4F9DC9DB26B4569D
Requests: 3 HTTP requests in this frame

Frame: https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719
Frame ID: FFB59BFA81819F7EDD3C66D954D0D4F9
Requests: 1 HTTP requests in this frame

Frame: https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=1f6f2df4-ea79-431d-9432-37f5fe6d0719
Frame ID: E99240607AE769B07E27CEFC6B3507E2
Requests: 1 HTTP requests in this frame

Frame: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&expires=30
Frame ID: 00F54A5CFFB0E989FE38F87B3302F8DC
Requests: 1 HTTP requests in this frame

Frame: https://ct.pinterest.com/ct.html
Frame ID: 272999694F18EA6C138851DF13261339
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/p?rand=1678275092222&pnid=140&pcid=93243148-d45e-4538-a136-0a1d6f9ef8b2
Frame ID: A68D2452C630BD6BFF63C441B7BFA3BC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Philadelphia Marriott DowntownBack ButtonFilter Button

Page URL History Show full URLs

http://philadelphiamarriottdowntown.idaypass.com/ HTTP 301
https://philadelphiamarriottdowntown.idaypass.com/ Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

177
Requests

75 %
HTTPS

35 %
IPv6

51
Domains

74
Subdomains

53
IPs

3
Countries

6250 kB
Transfer

17507 kB
Size

92
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.google.com/maps/place/Philadelphia+Marriott+Downtown/@39.9528638,-75.1609902,18.75z/data=!4m16!1m7!3m6!1s0x0:0xf958a155c61c80ba!2zMznCsDU3JzEwLjMiTiA3NcKwMDknMzYuNSJX!3b1!8m2!3d39.952873!4d-75.160139!3m7!1s0x89c6c62ecc221f3b:0x7b450177b196f33e!5m2!4m1!1i2!8m2!3d39.9526035!4d-75.1606246
Title: 1201 Market Street, (guest entrance at 1200 Filbert Street)., Philadelphia, PA, 19107, USA

Search URL Search Domain Scan URL

URL: https://www.marriott.com/en-us/hotels/phldt-philadelphia-marriott-downtown/overview/
Title: Visit hotel website >

Search URL Search Domain Scan URL

URL: https://www.marriott.com/default.mi

Search URL Search Domain Scan URL

URL: https://www.marriott.com/about/terms-of-use.mi
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.marriott.com/about/your-privacy-rights.mi
Title: Your Privacy Rights

Search URL Search Domain Scan URL

URL: https://www.marriott.com/about/privacy.mi
Title: Privacy and Cookie Statement

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://philadelphiamarriottdowntown.idaypass.com/ HTTP 301
https://philadelphiamarriottdowntown.idaypass.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15

https://cm.everesttech.net/cm/dd?d_uuid=53472836386418391462706228391764105139 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZAnRWgAAACEeJwN-

Request Chain 29

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP 302
https://dpm.demdex.net/ibs:dpid=358&dpuuid=4612952643267094414

Request Chain 52

https://idsync.rlcdn.com/365868.gif?partner_uid=53472836386418391462706228391764105139 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomNTM0NzI4MzYzODY0MTgzOTE0NjI3MDYyMjgzOTE3NjQxMDUxMzkQABoNCNuip6AGEgUI6AcQAEIASgA HTTP 307
https://dpm.demdex.net/ibs:dpid=477&dpuuid=2c3ee8ed3f8c13abf05879d831fe335a85aedc3840de73f17af3adf78ba75dc5b0da87c991749652

Request Chain 64

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NTM0NzI4MzYzODY0MTgzOTE0NjI3MDYyMjgzOTE3NjQxMDUxMzk= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NTM0NzI4MzYzODY0MTgzOTE0NjI3MDYyMjgzOTE3NjQxMDUxMzk=&google_tc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDYYU6maIHPgBH_e42rbB7s&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 65

https://insight.adsrvr.org/track/up?adv=hbq9bjg&ref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&upid=byw7ch4&upv=1.1.0 HTTP 302
https://match.adsrvr.org/track/upb/?adv=hbq9bjg&ref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&upid=byw7ch4&upv=1.1.0

Request Chain 74

https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=&ttd_tpi=1 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719

Request Chain 76

https://ad.doubleclick.net/ddm/activity/src=4810757;type=sales;cat=5myqls5f;qty=1;cost=0;u1=;u16=https%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;ord=[OrderID] HTTP 302
https://ad.doubleclick.net/ddm/activity/src=4810757;dc_pre=CL_Uv_bszv0CFZWHywEduygNjQ;type=sales;cat=5myqls5f;qty=1;cost=0;u1=;u16=https%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;ord=[OrderID] HTTP 302
https://adservice.google.com/ddm/fls/z/src=4810757;dc_pre=CL_Uv_bszv0CFZWHywEduygNjQ;type=sales;cat=5myqls5f;qty=1;cost=0;u1=;u16=https%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;ord=[OrderID]

Request Chain 79

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&sjrn_ula=673976618 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&sjrn_ula=673976618&google_tc= HTTP 302
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&sjrn_ula=673976618&google_gid=CAESEJQ4CgkMAU2oWPCkHuvlI3U&google_cver=1

Request Chain 80

https://cm.g.doubleclick.net/pixel?google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern_adh HTTP 302
https://cm.g.doubleclick.net/pixel?google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern_adh&google_tc= HTTP 302
https://fcmatch.google.com/pixel?google_gm=AMnCDoqTJjNXlvK3MRDcA1mJqPNklKMsk3YilA5m95WxE_aey0l5oQ7RQo0g6eTBlruRSYlneXf-rEVU1oSx1WEXHeAP6NlEghGBYXg8Ky599Tq8AP438ZM HTTP 302
https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqTJjNXlvK3MRDcA1mJqPNklKMsk3YilA5m95WxE_aey0l5oQ7RQo0g6eTBlruRSYlneXf-rEVU1oSx1WEXHeAP6NlEghGBYXg8Ky599Tq8AP438ZM

Request Chain 81

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl HTTP 302
https://pixel.sojern.com/idsync/apn?id=4612952643267094414&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl

Request Chain 82

https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=ombl9hp&ttd_puid=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&ttd_tpi=1 HTTP 302
https://pixel.sojern.com/idsync/ttd?id=1f6f2df4-ea79-431d-9432-37f5fe6d0719&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl

Request Chain 95

https://ps.eyeota.net/match?bid=r8d1b20&uid=AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent= HTTP 302
https://ps.eyeota.net/match/bounce/?bid=r8d1b20&uid=AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=

Request Chain 98

https://ib.adnxs.com/getuid?https%3A%2F%2Fmatch.sync.ad.cpe.dotomi.com%2Fw%2Fuser.sync%3Fptrid%3D6%26userid%3D%24UID&gdpr_consent= HTTP 302
https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=6&userid=4612952643267094414&gdpr_consent=

Request Chain 99

https://ups.analytics.yahoo.com/ups/58272/sync?redir=true&https%3A%2F%2Fmatch.sync.ad.cpe.dotomi.com%2Fw%2Fuser.sync%3Fptrid%3D12%26userid%3D%24UID&gdpr_consent= HTTP 302
https://ups.analytics.yahoo.com/ups/58272/sync?redir=true&https%3A%2F%2Fmatch.sync.ad.cpe.dotomi.com%2Fw%2Fuser.sync%3Fptrid%3D12%26userid%3D%24UID&gdpr_consent=&verify=true HTTP 302
https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=12&userid=y-rvZPJNhE2umjEfeJ_EuglWZkBVsogA--~A

Request Chain 100

https://pixel.rubiconproject.com/exchange/sync.php?p=epsilon&gdpr=false&gdpr_consent= HTTP 302
https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LF1375N4-1R-433P

Request Chain 108

https://c.bing.com/c.gif?uid=53472836386418391462706228391764105139&Red3=MSAdobe_pd&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=3EB710122B1364581B9602DD2A7F65FE

Request Chain 111

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D360572%26time%3D1678365019800%26url%3Dhttps%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cookiesTest=true&liSync=true&e_ipv6=AQITw1xUxiPuewAAAYbGWdC7HHU1seAbYPy1U1CEjT8NDlsNwtPjGQupSvp7joZBdlfDiWs

Request Chain 113

https://cm.g.doubleclick.net/pixel?google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern_adh HTTP 302
https://fcmatch.google.com/pixel?google_gm=AMnCDoplUw5ahxuKfRYl6qF-8yh9Fj-jxHmwYTtBT2alMo1HEbhn8iZeFW_eZn6dgYUe96BbhND5GWS5gaZamYMQV9ao7ugIexdP0TCxlYctBwkyP1uIOC0 HTTP 302
https://fcmatch.youtube.com/pixel?google_gm=AMnCDoplUw5ahxuKfRYl6qF-8yh9Fj-jxHmwYTtBT2alMo1HEbhn8iZeFW_eZn6dgYUe96BbhND5GWS5gaZamYMQV9ao7ugIexdP0TCxlYctBwkyP1uIOC0

Request Chain 114

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl HTTP 302
https://pixel.sojern.com/idsync/apn?id=4612952643267094414&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl

Request Chain 115

https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&ttd_tpi=1 HTTP 302
https://pixel.sojern.com/idsync/ttd?id=089b7f68-6875-4ed6-bb28-867f03c98929&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl

Request Chain 116

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl HTTP 302
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&google_gid=CAESEDVasFnV8HKJ1ywEFRN4ww8&google_cver=1

Request Chain 122

https://ad.doubleclick.net/activity;src=1359549;type=marri003;cat=m1m_m0;ord=8463860055572;gtm=45fe3360;npa=1;auiddc=700103119.1678365020;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CJiHxvbszv0CFaUqwQodwNwErg;src=1359549;type=marri003;cat=m1m_m0;ord=8463860055572;gtm=45fe3360;npa=1;auiddc=700103119.1678365020;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CJiHxvbszv0CFaUqwQodwNwErg;src=1359549;type=marri003;cat=m1m_m0;ord=8463860055572;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F

Request Chain 123

https://ad.doubleclick.net/activity;src=1359549;type=marri001;cat=m1m_g0;ord=1;num=2071111093150;gtm=45fe3360;npa=1;auiddc=700103119.1678365020;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CKONxvbszv0CFUF8wQodiyIJzQ;src=1359549;type=marri001;cat=m1m_g0;ord=1;num=2071111093150;gtm=45fe3360;npa=1;auiddc=700103119.1678365020;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CKONxvbszv0CFUF8wQodiyIJzQ;src=1359549;type=marri001;cat=m1m_g0;ord=1;num=2071111093150;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F

Request Chain 124

https://servedby.flashtalking.com/map/?key=a74thHgsfK627J6Ftt8sj5ks52bKe&gdpr=0&gdpr_consent=&url=https://dpm.demdex.net/ibs:dpid=3047&dpuuid=[%FT_GUID%]&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=3047&dpuuid=5546EF1A4279E2&gdpr=0&gdpr_consent=

Request Chain 125

https://dpm.demdex.net/ibs:dpid=903&dpuuid=089b7f68-6875-4ed6-bb28-867f03c98929&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719

Request Chain 126

https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=089b7f68-6875-4ed6-bb28-867f03c98929 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=PbJqmrhr&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=089b7f68-6875-4ed6-bb28-867f03c98929 HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=1f6f2df4-ea79-431d-9432-37f5fe6d0719

Request Chain 127

https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=089b7f68-6875-4ed6-bb28-867f03c98929&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&expires=30

Request Chain 147

https://adobe-sync.dotomi.com/match/bounce/current?networkId=85983&version=1&nuid=53472836386418391462706228391764105139&rurl=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D19360%26dpuuid%3D HTTP 302
https://dpm.demdex.net/ibs:dpid=19360&dpuuid=53472836386418391462706228391764105139&expiration=1678451420&nuid=53472836386418391462706228391764105139&rurl=https://dpm.demdex.net/ibs:dpid=19360&dpuuid=

Request Chain 148

https://tr.snapchat.com/cm/s?bt=7f8130e5&pnid=140&cb=1678365020323&u_scsid=f3cbe5b1-63ed-4695-9205-e7e220b076ec&u_sclid=ae8c0aea-48a7-427c-a232-dcfcfbffc212 HTTP 302
https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1678275092222%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1678275092222%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://tr.snapchat.com/cm/p?rand=1678275092222&pnid=140&pcid=93243148-d45e-4538-a136-0a1d6f9ef8b2

Request Chain 149

https://a.tribalfusion.com/i.match?p=b13&u=53472836386418391462706228391764105139&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP 302
https://s.tribalfusion.com/z/i.match?p=b13&u=53472836386418391462706228391764105139&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP 302
https://dpm.demdex.net/ibs:dpid=22054

Request Chain 150

https://tag.yieldoptimizer.com/ps/ps?t=i&p=2233 HTTP 302
https://tag.yieldoptimizer.com/ps/ps?tc=346868833&t=i&p=2233

Request Chain 154

https://tag.yieldoptimizer.com/ps/ps?t=s&p=1057&si=US&ln=EN&hbc=HRS&pg=hm HTTP 302
https://tag.yieldoptimizer.com/ps/ps?tc=825420459&t=s&p=1057&si=US&ln=EN&hbc=HRS&pg=hm

Request Chain 156

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://gum.criteo.com/sync?s=1&c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=xo2PwyMHQqg9y_uOzmdbhSw3MsI3AgJe&gdpr=0&gdpr_consent=

Request Chain 157

https://tag.yieldoptimizer.com/ps/ps?t=s&p=1057&mhcy=&mhcr=&mhcd=PHLDT&mhst=&mhnm= HTTP 302
https://tag.yieldoptimizer.com/ps/ps?tc=278929640&t=s&p=1057&mhcy=&mhcr=&mhcd=PHLDT&mhst=&mhnm=

Request Chain 158

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=53472836386418391462706228391764105139&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-mnHnY0NE2pFzzI2lcdV_bmSCNMXuAI0.Okc-~A

Request Chain 159

https://odr.mookie1.com/t/v2?tagid=V2_676804&src.visitorId=53472836386418391462706228391764105139&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=30862&dpuuid=10594155177346297703

Request Chain 160

https://ag.innovid.com/dv/sync?tid=6 HTTP 302
https://dpm.demdex.net/ibs:dpid=80742&dpuuid=08dd91e4-fd29-49da-b35e-20ab11825d8d

Request Chain 163

https://usermatch.krxd.net/um/v2?partner=adobe&id=53472836386418391462706228391764105139 HTTP 302
https://dpm.demdex.net/ibs:dpid=66757?id=53472836386418391462706228391764105139&dpuuid=PbJqmrhr

Request Chain 164

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkFuUldnQUFBQ0VlSndOLQ==

Request Chain 165

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZAnRWgAAACEeJwN-&expires=90

Request Chain 166

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZAnRWgAAACEeJwN- HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZAnRWgAAACEeJwN-&C=1

Request Chain 167

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=ZAnRWgAAACEeJwN-

Request Chain 168

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZAnRWgAAACEeJwN- HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=ZAnRWgAAACEeJwN-

Request Chain 170

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZAnRWgAAACEeJwN-

Request Chain 171

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZAnRWgAAACEeJwN-&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZAnRWgAAACEeJwN-&img=1&__user_check__=1&sync_id=28e9d15c-be76-11ed-9274-1b36d7c70503

Request Chain 172

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZAnRWgAAACEeJwN-&t=2592000&o=0

Request Chain 173

https://cm.ipinyou.com/xcmr/aam/r.gif HTTP 302
https://dpm.demdex.net/ibs:dpid=134084&dpuuid=N39KUN6Kcrif&redir=http%3A%2F%2Fcm.ipinyou.com%2Fxcms%2Faam%2Fs.gif%3Ftid%3D$%7BDD_UUID%7D HTTP 302
https://cm.ipinyou.com/xcms/aam/s.gif?tid=53472836386418391462706228391764105139

Request Chain 175

https://insight.adsrvr.org/track/pxl/?adv=hbq9bjg&ct=0:uti0uav&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=MWY2ZjJkZjQtZWE3OS00MzFkLTk0MzItMzdmNWZlNmQwNzE5&gdpr=0&gdpr_consent=&ttd_tdid=1f6f2df4-ea79-431d-9432-37f5fe6d0719 HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=1f6f2df4-ea79-431d-9432-37f5fe6d0719&google_gid=CAESEOiSk-YaFovV7z5W7yi6zWA&google_cver=1 HTTP 302
https://ups.analytics.yahoo.com/ups/55953/sync?uid=1f6f2df4-ea79-431d-9432-37f5fe6d0719&_origin=1&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-tBJDbe9E2uLGjEh7lyjjj4C4SWwK_8w-~A&gdpr=0 HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=1f6f2df4-ea79-431d-9432-37f5fe6d0719 HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=4612952643267094414&ttd_tdid=1f6f2df4-ea79-431d-9432-37f5fe6d0719 HTTP 302
https://tags.bluekai.com/site/5386?id=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai

177 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
philadelphiamarriottdowntown.idaypass.com/
Redirect Chain

http://philadelphiamarriottdowntown.idaypass.com/
https://philadelphiamarriottdowntown.idaypass.com/

3 KB
2 KB

224ms
99ms

Document
text/html

54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

43a6f8680a97c5b388e41deced4040381f47ce6c6aead5fbf794a51aa4b9667c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
content-language: en
content-type: text/html; charset=utf-8
date: Thu, 09 Mar 2023 12:30:16 GMT
expires: Thu, 09 Mar 2023 12:10:16 GMT
pragma: no-cache
referrer-policy: same-origin
server: nginx/1.20.2
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: Accept-Language, Cookie
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-version: 1678101019
x-xss-protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 134
Content-Type: text/html
Date: Thu, 09 Mar 2023 12:30:16 GMT
Location: https://philadelphiamarriottdowntown.idaypass.com:443/
Server: awselb/2.0

GET
H2 200 vendor.css
philadelphiamarriottdowntown.idaypass.com/css/ 387 KB
114 KB 64ms
62ms Stylesheet
text/css 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

0dada255807bb7d6ebfec844efcd2042b776e3f5d7d630f9bf492f2e8009a384

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
last-modified: Thu, 02 Mar 2023 09:18:52 GMT
server: nginx/1.20.2
etag: W/"640069fc-60def"
x-frame-options: SAMEORIGIN
content-type: text/css
x-xss-protection: 1; mode=block

GET
H2 200 theming.css
philadelphiamarriottdowntown.idaypass.com/css/ 449 KB
110 KB 183ms
180ms Stylesheet
text/css 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/theming.css?v=1678101019

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

5a37144cebb7b5f6fa8863c98da5159c7a98db8ef952b674f6ab0efc573b007c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
last-modified: Mon, 06 Mar 2023 11:23:12 GMT
server: nginx/1.20.2
etag: W/"6405cd20-70426"
x-frame-options: SAMEORIGIN
content-type: text/css
x-xss-protection: 1; mode=block

GET
H2 200 theme.css
philadelphiamarriottdowntown.idaypass.com/api/css/ 2 KB
1007 B 185ms
183ms Stylesheet
text/css 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/css/theme.css

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

729ac38bbf9f4e865981f3fceb90171d07280cd6063a7cfec08055ed0cc8acb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Accept-Language, Cookie
x-frame-options: SAMEORIGIN
content-type: text/css
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:16 GMT

GET
H2 200 marriott-general.css
philadelphiamarriottdowntown.idaypass.com/css/custom/ 7 KB
3 KB 184ms
182ms Stylesheet
text/css 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/custom/marriott-general.css?v=1678101019

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

bf6f60cb20eacd62c8ef02cb958db7e3b893244e61e247f157650dcaf2caa2ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
last-modified: Mon, 05 Dec 2022 10:28:36 GMT
server: nginx/1.20.2
etag: W/"638dc7d4-1d88"
x-frame-options: SAMEORIGIN
content-type: text/css
x-xss-protection: 1; mode=block

GET
H2 200 vendor.js Show response
philadelphiamarriottdowntown.idaypass.com/js/ 3 MB
1 MB 184ms
182ms Script
application/javascript 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/js/vendor.js?v=1678101019

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

8fa7604a52665b737eb5022c6187c754a2b7a6168e2aeb4d157bcfad5d523289

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
last-modified: Thu, 02 Mar 2023 09:18:52 GMT
server: nginx/1.20.2
etag: W/"640069fc-2f5730"
x-frame-options: SAMEORIGIN
content-type: application/javascript
x-xss-protection: 1; mode=block

GET
H2 200 launch-EN3963523be4674e5591a9c4d516697352.min.js Show response
assets.adobedtm.com/ 445 KB
114 KB 285ms
81ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0cd179e1ff5d71bebf6e3780452d73e8dfea61b79fcc091d0160fe0a8088ee3c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:17 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:50 GMT
server: AkamaiNetStorage
etag: "0dd4c582dd883a8e2f73c65743355d30:1677854630.929803"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 115839
expires: Thu, 09 Mar 2023 13:30:17 GMT

GET
H2 200 main.js Show response
philadelphiamarriottdowntown.idaypass.com/js/ 7 MB
1 MB 182ms
181ms Script
application/javascript 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

7ddcb13ac912f5f75a48aa45fef3fc5a13109543a6fbb4a0470907066f93145b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
last-modified: Mon, 06 Mar 2023 11:23:12 GMT
server: nginx/1.20.2
etag: W/"6405cd20-74322f"
x-frame-options: SAMEORIGIN
content-type: application/javascript
x-xss-protection: 1; mode=block

GET
H2 200 hotel_info.css
philadelphiamarriottdowntown.idaypass.com/css/custom/ 22 KB
6 KB 126ms
123ms Stylesheet
text/css 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/custom/hotel_info.css

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/css/custom/marriott-general.css?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

ca4da43174b9ed2d7011876053ac0a648b05a3632267f5f4fa808dde6ad8c332

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/css/custom/marriott-general.css?v=1678101019
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:17 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
last-modified: Mon, 30 Jan 2023 10:01:48 GMT
server: nginx/1.20.2
etag: W/"63d7958c-5755"
x-frame-options: SAMEORIGIN
content-type: text/css
x-xss-protection: 1; mode=block

GET
H2 200 css
fonts.googleapis.com/ 4 KB
1 KB 223ms
81ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500,600

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

46d1791d45e9e6840842ef90f192c2c6f1f4247baa7c1f32f2da75d3a05c0de2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 09 Mar 2023 12:30:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 09 Mar 2023 12:15:44 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 09 Mar 2023 12:30:17 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 210ms
69ms Script
text/javascript 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 09 Mar 2023 10:47:24 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 6173
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Thu, 09 Mar 2023 12:47:24 GMT

GET
H2 200 3cd4c80ccba0a4fb3e5d.png
philadelphiamarriottdowntown.idaypass.com/css/assets/ 22 KB
22 KB 62ms
61ms Image
image/png 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/assets/3cd4c80ccba0a4fb3e5d.png

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

e392b7a34034b4389cb95c6a572e85e577e633b92e737ffb03cd03880bb3c97c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:17 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Wed, 23 Feb 2022 08:04:50 GMT
server: nginx/1.20.2
etag: "6215eaa2-5848"
x-frame-options: SAMEORIGIN
content-type: image/png
accept-ranges: bytes
content-length: 22600
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 5 KB
2 KB 468ms
63ms XHR
application/json 44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=4.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=664516D751E565010A490D4C%40AdobeOrg&d_nsid=0&ts=1678365017943

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

7869001c5b36a1174f5660b6c86589ed410008905e199fad9783d883faeaf6fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-va6-1-v045-06bad60d6.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: Tg0B4xEgQYc=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://philadelphiamarriottdowntown.idaypass.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1700
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/ 34 KB
13 KB 285ms
285ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 089030d8bec22aa48ae59e27516a4e8a1fcec666e9d783c7a1df47220b750dc1

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 09 Mar 2023 12:30:18 GMT
content-encoding: gzip
last-modified: Mon, 03 Jun 2019 23:03:32 GMT
server: AkamaiNetStorage
etag: "72404253c27255247028f0ba11022cf8:1559603012"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12916
expires: Thu, 09 Mar 2023 13:30:18 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
226 B 79ms
79ms XHR
text/plain 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1990161646&t=pageview&_s=1&dl=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&ul=en-us&de=UTF-8&dt=Philadelphia%20Marriott%20Downtown&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=448421020&gjid=676827785&cid=774386379.1678365019&tid=UA-162569320-1&_gid=789964234.1678365019&_r=1&_slc=1&z=987767493

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dest5.html Show response
marriottinternationa.demdex.net/ Frame 8890 7 KB
3 KB 287ms
62ms Document
text/html 54.243.116.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://marriottinternationa.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.243.116.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-243-116-235.compute-1.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-va6-1-v045-08d28e78b.edge-va6.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: Qr1H+SExSVU=
content-encoding: gzip
date: Thu, 9 Mar 2023 12:30:18 GMT
last-modified: Fri, 10 Feb 2023 12:29:50 GMT
vary: accept-encoding

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=ZAnRWgAAACEeJwN-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=53472836386418391462706228391764105139
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZAnRWgAAACEeJwN-

42 B
940 B

63ms
63ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZAnRWgAAACEeJwN-

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v045-0ec043962.edge-va6.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: De33oIb0S58=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZAnRWgAAACEeJwN-
Date: Thu, 09 Mar 2023 12:30:18 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 RC998a74cdbfb34e4eb70533b7acc285a2-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 573 B
580 B 66ms
65ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC998a74cdbfb34e4eb70533b7acc285a2-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 70faee076da4a1c8b3b8f0efc5b05d157c376d2e4a7c7ca56ffd7a5006ab1a2f

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:18 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 334
expires: Thu, 09 Mar 2023 13:30:18 GMT

GET
H2 200 RCbbd572812c1d4d6381764b660217f8cb-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 2 KB
1 KB 67ms
66ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RCbbd572812c1d4d6381764b660217f8cb-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ad66679335de3477ee70943792ccc5610a51eb9db06014d7a4a15dd984e932e6

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:18 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 875
expires: Thu, 09 Mar 2023 13:30:18 GMT

POST
H2 200 / Show response
o436887.ingest.sentry.io/api/5398649/envelope/ 2 B
295 B 181ms
71ms Fetch
application/json 34.120.195.249
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://o436887.ingest.sentry.io/api/5398649/envelope/?sentry_key=6ececa1dc2674f34a9478fb7271f037f&sentry_version=7

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.195.249 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

249.195.120.34.bc.googleusercontent.com

Software

nginx /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 09 Mar 2023 12:30:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
server: nginx
vary: Origin
content-type: application/json
access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
access-control-expose-headers: retry-after, x-sentry-rate-limits, x-sentry-error
x-envoy-upstream-service-time: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

GET
H2 200 translations Show response
philadelphiamarriottdowntown.idaypass.com/api/translations/ 351 KB
104 KB 176ms
175ms XHR
application/json 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/translations/translations?language=en&return_as=dict

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

0b04ebb1dd4ee4bfd9424205b8792f5fcc30708f50d76486aee3585d638ce2d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
Language: en
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:18 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Cookie, Accept-Language
x-frame-options: SAMEORIGIN
content-type: application/json
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:18 GMT

GET
H2 200 7bc9ce404c297c24f210.otf
philadelphiamarriottdowntown.idaypass.com/css/assets/ 61 KB
62 KB 63ms
62ms Font
application/octet-stream 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/assets/7bc9ce404c297c24f210.otf

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019
Origin: https://philadelphiamarriottdowntown.idaypass.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:18 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Wed, 23 Feb 2022 08:04:50 GMT
server: nginx/1.20.2
etag: "6215eaa2-f5ac"
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
accept-ranges: bytes
content-length: 62892
x-xss-protection: 1; mode=block

GET
H2 200 6768c1976c2ad78da163.png
philadelphiamarriottdowntown.idaypass.com/css/assets/ 538 B
788 B 86ms
85ms Image
image/png 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/assets/6768c1976c2ad78da163.png

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

8aa69ee6b2376505578d758bfbbc52aec88fa5e591f1a7cabd8adfa80a7b613a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:18 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Wed, 23 Feb 2022 08:04:50 GMT
server: nginx/1.20.2
etag: "6215eaa2-21a"
x-frame-options: SAMEORIGIN
content-type: image/png
accept-ranges: bytes
content-length: 538
x-xss-protection: 1; mode=block

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/ 25 KB
9 KB 64ms
64ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: 32bc033e13e02d8809b2c8c97ac5a5110c5f375a830ed6cace5ce1202ab5b480

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 09 Mar 2023 12:30:18 GMT
content-encoding: gzip
last-modified: Mon, 03 Jun 2019 23:03:35 GMT
server: Apache
etag: "e539ea6425ae55fa9f68995bc5a68886:1559603018"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8640
expires: Thu, 09 Mar 2023 13:30:18 GMT

GET
H2 200 otSDKStub.js Show response
cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/ 20 KB
7 KB 499ms
162ms Script
application/x-javascript 173.223.56.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/otSDKStub.js?5335937150589924
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.96 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-96.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1a6622bbfd2f4017f391cae1040e22f99a923116427a0ccb25543581f5d92257

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Mon, 06 Jun 2022 19:38:47 GMT
server: AkamaiNetStorage
etag: "67b989d4e95276950bf7da56f7c0598d:1654544327.296254"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=1828507
accept-ranges: bytes
content-length: 6886
expires: Thu, 30 Mar 2023 16:25:26 GMT

GET
H2 200 sites-session Show response
philadelphiamarriottdowntown.idaypass.com/api/auth/ 40 KB
10 KB 367ms
367ms XHR
application/json 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/auth/sites-session

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

25339e7f19b8d6c31bc082d646d1914964c99b6b39cd2c6c6cfc6a23dd27332d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
Language: en
accept-language: en-US,en;q=0.9
X-CSRFToken: KyWP1jjJFRpfrm6qOTClK9iAAJ5INLyv02BnZXTUcBSscQVcIRw3PYCWs0lqiuB8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Cookie, Accept-Language
x-frame-options: SAMEORIGIN
content-type: application/json
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:19 GMT

GET
H2 200 9c33516aab48c61e3081.woff2
philadelphiamarriottdowntown.idaypass.com/css/assets/ 525 KB
526 KB 62ms
61ms Font
font/woff2 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/assets/9c33516aab48c61e3081.woff2

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

242e542871bd77c8ff6375418e349ef6b3a32a208e15ca1441166641d212a6a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019
Origin: https://philadelphiamarriottdowntown.idaypass.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:18 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Wed, 23 Feb 2022 08:04:50 GMT
server: nginx/1.20.2
etag: "6215eaa2-8350c"
x-frame-options: SAMEORIGIN
content-type: font/woff2
accept-ranges: bytes
content-length: 537868
x-xss-protection: 1; mode=block

GET
H2 200 s45036560716549 Show response
smetrics.marriott.com/b/ss/marriottglobal/10/JS-2.14.0-LDQM/ 5 KB
6 KB 228ms
80ms Script
application/x-javascript 63.140.38.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.marriott.com/b/ss/marriottglobal/10/JS-2.14.0-LDQM/s45036560716549?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=9%2F2%2F2023%2012%3A30%3A18%204%200&d.&nsid=0&jsonv=1&.d&mid=53558387220982011552731689024369351130&aamlh=7&ce=UTF-8&pageName=philadelphiamarriottdowntown.idaypass.com%2F&g=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c5=Real%20Time%20Reservation&c8=D%3Dv15&v15=Weekday%20%3A%20Thursday%20%3A%208%3A00AM&c26=Launch&v41=Real%20Time%20Reservation&c71=Off-Platform%20Basic&v101=Default%20Cookie%20Opt-in&v192=philadelphiamarriottdowntown.idaypass.com%2F&v237=en&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=664516D751E565010A490D4C%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.104 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-104.data.adobedc.net

Software

jag /

Resource Hash

27e8d8dab8a9edc47508543617d495b0e3e75071d407e96da2b009b6f0ff648e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-aam-tid: SdquFTr6Spw=
date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 5414
x-xss-protection: 1; mode=block
dcs: dcs-prod-va6-1-v045-055393a29.edge-va6.demdex.com 8 ms
pragma: no-cache
last-modified: Fri, 10 Mar 2023 12:30:18 GMT
server: jag
etag: 3604261431898931200-4619594212464159980
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 08 Mar 2023 12:30:18 GMT

GET
H2 200 login-session Show response
philadelphiamarriottdowntown.idaypass.com/api/auth/ 82 B
582 B 85ms
84ms XHR
application/json 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/auth/login-session

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

5d0f7d343e9cc9ca519acd511dba49eb03216600f4b5e55e1f31de45039d1c2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
Language: en
accept-language: en-US,en;q=0.9
X-CSRFToken: KyWP1jjJFRpfrm6qOTClK9iAAJ5INLyv02BnZXTUcBSscQVcIRw3PYCWs0lqiuB8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Accept-Language, Cookie
x-frame-options: SAMEORIGIN
content-type: application/json
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:19 GMT

GET
H2 200 b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test.json Show response
cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/consent/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test/ 4 KB
5 KB 308ms
89ms XHR
application/json 173.223.56.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/consent/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test.json
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.96 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-96.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7316c1dfbc9f061b2280befce5285d9576624d84376031f96583df11d82ea916

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
last-modified: Mon, 06 Jun 2022 19:54:53 GMT
server: AkamaiNetStorage
etag: "2f1c841426300bd3781a1752ab891f7c:1654545293.924385"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=50637
accept-ranges: bytes
content-length: 4006
expires: Fri, 10 Mar 2023 02:34:16 GMT

GET
H/1.1

200
OK

ibs:dpid=358&dpuuid=4612952643267094414
dpm.demdex.net/ Frame 8890
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID
https://dpm.demdex.net/ibs:dpid=358&dpuuid=4612952643267094414

42 B
940 B

68ms
65ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=358&dpuuid=4612952643267094414

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v045-0337ed64f.edge-va6.demdex.com 6 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: pm5sHXbPTVw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Date: Thu, 09 Mar 2023 12:30:19 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.68; 38.132.118.68; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 40dd1aaf-2e93-4574-a848-fc73380ee803
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dpm.demdex.net/ibs:dpid=358&dpuuid=4612952643267094414
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 RC584249ee51a64972a4f05f2f9422664a-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 1 KB
787 B 65ms
64ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC584249ee51a64972a4f05f2f9422664a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c3af24a70c1ed70449acb08f574afbd3711ad5bf7b0a321b2e8296b411169911

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 541
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RCb500618f5ce84b22ac56f249cbc4d22d-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 422 B
515 B 65ms
65ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RCb500618f5ce84b22ac56f249cbc4d22d-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cb15459ac1a24de773a7a4ec6e128f408b3a4ce931a9e67e71b7f9234de20e25

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 270
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 241 KB
82 KB 222ms
81ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-1LXTBF5X2V&l=dataLayerB

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

aa740a73eb321a796bb474af34c7b703d600edf816ba1dabf14e0a6d9902798b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 83670
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 09 Mar 2023 12:30:19 GMT

GET
H2 200 RC9cb1ec8ecf2a461187113443b47b5896-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 1 KB
963 B 65ms
64ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC9cb1ec8ecf2a461187113443b47b5896-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5073d5020c808f28513826ae7a079d2bb2874edca7305920b61befdd4bd5e9c6

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 717
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RC62a22fd426a0470dad9c40c7f2f4b2fb-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 648 B
655 B 65ms
65ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC62a22fd426a0470dad9c40c7f2f4b2fb-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: fa4f52d76e694e9bd170da82b334b47bef5ed500a0d32318d7896351bae5e64f

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 410
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RC5144740cc710431e95a7dd7c05b8b386-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 1 KB
925 B 65ms
64ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC5144740cc710431e95a7dd7c05b8b386-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 121337c33e44d79fbd44805f80a6c823c0ecc247dd088608b96c6e8c1c0fca11

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 679
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RC9f906a1934ae46f6b85351f19bfa52f0-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 2 KB
1 KB 64ms
64ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC9f906a1934ae46f6b85351f19bfa52f0-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 964c519c1bbb0a37524e1c2b8439e16a592ff7b880cd44ded77691733bb4890e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 904
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RC69b12fc347724763b4d1d6b2bbb7bc67-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 1 KB
863 B 67ms
67ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC69b12fc347724763b4d1d6b2bbb7bc67-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a44f8a269790ba17c206c6cce4094e67fffb19296d2b144cb85dee4083e90177

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 617
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RCb6c3578477864b5583591694fb0c7548-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 4 KB
1 KB 69ms
68ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RCb6c3578477864b5583591694fb0c7548-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 6ac72468d920cc2c0ffd5187900a42d4afe566bb14820de290730bb6695bfb6f

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 1130
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RCb70d7bef713543b09b57afbc6f9e056a-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 3 KB
1 KB 65ms
65ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RCb70d7bef713543b09b57afbc6f9e056a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8718908246fd54e39921ae475a1e21fd330d64bf21ef6418455186452c37a9ba

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 1096
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RC1b12bbad598c4c1380765438bb0467a9-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 718 B
701 B 65ms
65ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC1b12bbad598c4c1380765438bb0467a9-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4b39c3dfd768eb1864c32afab9ad52361e77bef7c721950ab965acdf74ccc2da

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 455
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RCc37891c0d65e4f2581d609fc16498257-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 548 B
543 B 100ms
99ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RCc37891c0d65e4f2581d609fc16498257-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d27e1d21c0f87974367746a59289cada444ac82222c124d9b86ba5616b5151ed

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 297
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RCb12bd1abf26341f99678f8b654526b0f-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 2 KB
862 B 99ms
99ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RCb12bd1abf26341f99678f8b654526b0f-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e8464907f5656041e11aa03afa4c79462f95b96a21f2fa23eaebcc0a86f48806

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 616
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 40 KB
12 KB 134ms
61ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a2137ebfe2b9ff55e1f280dbb1eef301290c50db609c5d6a0494ae8f3c98c253

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Thu, 09 Mar 2023 12:30:19 GMT
last-modified: Thu, 16 Feb 2023 18:31:53 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4AEB5C5238AB4DDAB3DDE53E6013615B Ref B: MIAEDGE2820 Ref C: 2023-03-09T12:30:19Z
etag: "8072cff03442d91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 11894

GET
H2 200 RC28f29f2c23a143e0acc4cd8133230ddf-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 2 KB
973 B 98ms
98ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC28f29f2c23a143e0acc4cd8133230ddf-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b25a4cdffba3f45591d0c33e8045739067c8973c70124f0fe44a2f045ba4e1b6

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 727
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RC7397178f0a1540d798c3f1a3d2c85c1b-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 1 KB
889 B 94ms
92ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC7397178f0a1540d798c3f1a3d2c85c1b-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f0a0b741a25177ac5a1b85ec81f9c2827f3193ed2e42fe90286b089531c53855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 643
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 RCe7ed036bb4cb4dc89bdf084029e843a5-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 776 B
743 B 89ms
89ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RCe7ed036bb4cb4dc89bdf084029e843a5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cf45cd7eedc285f819f5206d02b549e95c4877393daa02be0e94bfe0addc7907

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 497
expires: Thu, 09 Mar 2023 13:30:19 GMT

GET
H2 200 1 Show response
philadelphiamarriottdowntown.idaypass.com/api/hotel/get-hotel/ 25 KB
7 KB 119ms
118ms XHR
application/json 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/hotel/get-hotel/1

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

bc538c392f267ea879c0bce8170f68cbfac1276b11b249e863fd16c46b55e49b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
Language: en
accept-language: en-US,en;q=0.9
X-CSRFToken: KyWP1jjJFRpfrm6qOTClK9iAAJ5INLyv02BnZXTUcBSscQVcIRw3PYCWs0lqiuB8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Accept-Language, Cookie
x-frame-options: SAMEORIGIN
content-type: application/json
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:19 GMT

GET
H2 200 dpm_pixel_min.js Show response
c.tvpixel.com/js/current/ 103 KB
32 KB 309ms
83ms Script
application/javascript 2600:9000:24eb:7c00:1d:bf0a:0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tvpixel.com/js/current/dpm_pixel_min.js?aid=marriott-0af76d19-dfba-4407-860e-54c7ed29bed4
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24eb:7c00:1d:bf0a:0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-amz-version-id: oMk5SFqHXboEDRm2.vDWImtx_4ARYxEl
content-encoding: gzip
via: 1.1 e88ba146e70cb232a8169a449cfa5954.cloudfront.net (CloudFront)
date: Wed, 08 Mar 2023 13:16:39 GMT
last-modified: Thu, 16 Sep 2021 18:14:59 GMT
server: AmazonS3
x-amz-cf-pop: BOS50-P1
age: 86109
etag: W/"08e770c8a17bf087d50cec01af0892c2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: n2Qvjq5ktZu6D6Wd_zfssvXyC3VI8cq5DLivVvXuX-yulqFdAbwqUA==

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 205ms
61ms Script
application/x-javascript 143.204.138.162
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.138.162 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-138-162.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 08 Mar 2023 14:39:23 GMT
Content-Encoding: gzip
Via: 1.1 4c4a56815dfe3e256aedb11d486092f0.cloudfront.net (CloudFront)
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
X-Amz-Cf-Pop: EWR52-C2
Age: 78657
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: 9T_YBZx0j5fS25Oj6iaF-22CBcZM0KQ5jxODeXDQkSEgcScR3WbjYA==

GET
H2 200 140436 Show response
beacon.sojern.com/pixel/p/ 4 KB
1 KB 246ms
78ms Script
application/javascript 107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.sojern.com/pixel/p/140436?f_v=v6_js&p_v=1&vid=hot&pc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cid=
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: de3333a338591946528a5894f071ffff8f89e8f738e72eaf746aa8e6e6a5a244

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
via: 1.1 google
vary: Accept-Encoding
content-type: application/javascript
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 834

GET
H2 200 UCMController Show response
login.dotomi.com/ucm/ Frame E19C 7 KB
3 KB 278ms
111ms Document
text/html 205.180.85.201
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 205.180.85.201 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS: iad06-nessy-float1.dotomi.com
Software: nginx /
Resource Hash: 00522809658c0112e5694c29446eb56567d665df9bd80a927c7986caf75448e0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, private, max-age=0, no-store
content-encoding: gzip
content-length: 2248
content-type: text/html
date: Thu, 09 Mar 2023 12:30:19 GMT
expires: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
pragma: no-cache
server: nginx

GET
H/1.1

200
OK

ibs:dpid=477&dpuuid=2c3ee8ed3f8c13abf05879d831fe335a85aedc3840de73f17af3adf78ba75dc5b0da87c991749652
dpm.demdex.net/ Frame 8890
Redirect Chain

https://idsync.rlcdn.com/365868.gif?partner_uid=53472836386418391462706228391764105139
https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomNTM0NzI4MzYzODY0MTgzOTE0NjI3MDYyMjgzOTE3NjQxMDUxMzkQABoNCNuip6AGEgUI6AcQAEIASgA
https://dpm.demdex.net/ibs:dpid=477&dpuuid=2c3ee8ed3f8c13abf05879d831fe335a85aedc3840de73f17af3adf78ba75dc5b0da87c991749652

42 B
940 B

64ms
62ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=477&dpuuid=2c3ee8ed3f8c13abf05879d831fe335a85aedc3840de73f17af3adf78ba75dc5b0da87c991749652

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v045-07a6a3e93.edge-va6.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Hib3PDpeQbE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Thu, 09 Mar 2023 12:30:19 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://dpm.demdex.net/ibs:dpid=477&dpuuid=2c3ee8ed3f8c13abf05879d831fe335a85aedc3840de73f17af3adf78ba75dc5b0da87c991749652
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 pxrc.php
pxl.jivox.com/tags/re/ 43 B
453 B 232ms
71ms Image
image/gif 3.209.227.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pxl.jivox.com/tags/re/pxrc.php?px=958deafa6b01b7&ret=img&cData=PHLDT&px_558deaefe29b99=N/A&px_45c37cd1a3ffb5=%27%27&px_75c37cd56820dd=N/A%20&px_65c37cdd1171be=1&px_95c37ce084b3e1=1&px_15b33b35ba04d9=N/A&px_65b33b372611c8=philadelphiamarriottdowntown.idaypass.com/&px_45b33b3b62bcfa=N/A&px_25b33b3e68bd91=N/A&px_05b33b3f8d42f0=N/A&px_25d820700bc474=%27%27&px_25b33b410cb604=N/A&px_25d8208f4381f8=N/A
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.227.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-227-78.compute-1.amazonaws.com
Software: Jetty(9.4.39.v20210325) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
server: Jetty(9.4.39.v20210325)
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'
access-control-allow-origin: *
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0
access-control-allow-headers: content-type
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ 1 KB
753 B 251ms
67ms Script
application/javascript 2a04:4e42:46::84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:46::84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8fd0e79fe04e510f99d7693dd7ee10ddd58a662c42732a03626f6c1447b09154

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
x-cdn: fastly
etag: "6e628a3f3eb4614d91617bfc9d4267a9"
x-amz-server-side-encryption: AES256
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: X-CDN
vary: Accept-Encoding, Origin
cache-control: max-age=7200
alt-svc: h3=":443";ma=600
content-length: 484

GET
H2 200 scevent.min.js Show response
sc-static.net/ 30 KB
13 KB 256ms
95ms Script
application/javascript 108.138.113.246
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.113.246 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-113-246.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 47f33d5a14c3605b73594a767736041df110457fcf1bb09322620fb8e537e8c6

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
via: 1.1 ed8dbde89917eaa6ca93ba7fad809c48.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: JFK50-P3
x-cache: LambdaGeneratedResponse from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 13297
x-amz-cf-id: ata0A0HBzCZbhgwgptFEhmht8CwON89BNf8QvxzdKs-Ynyxe2iSQlg==

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 283ms
67ms Script
application/x-javascript 2600:141b:5000::17df:9c20
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:5000::17df:9c20 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Jan 2023 17:22:56 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=18349
accept-ranges: bytes
content-length: 4777

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 107 KB
28 KB 213ms
66ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0fca0294cfaf24a4db0852415eee7bcdea7b9766d59e443fb2d5f0c77eb23363

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 09 Mar 2023 12:30:19 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27907
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: +MAlKu6nepKAtFEhtUY14aRPoN8fOuLMs9HnTytpxUAdKfgB+/8sW4aRGb2qPjtn6Hze7XSe+VEf+M4ZekcjVg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 2050670934
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 mhotels.html Show response
static.sojern.com/marriott/ Frame 7C43 9 KB
10 KB 194ms
37ms Document
text/html 35.244.188.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sojern.com/marriott/mhotels.html?p=undefined&hprid=PHLDT&hpr=&hb=undefined&hc1=undefined&hn1=undefined&hs1=undefined&ffl=undefined&hl=&t=undefined&hr=undefined&hd1=&hd2=&hconfno=&hp=undefined&hcu=&hrp=undefined&hdc=undefined&rew=undefined&l=undefined&vid=hot&cid=
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.188.9 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 9.188.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 2cac89100642acb92e8c705a639a012b32de7eb32db954a31890da8a091610c3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 364
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-length: 9706
content-type: text/html
date: Thu, 09 Mar 2023 12:24:15 GMT
etag: "61166aab6d850b40153da0ce87a22993"
expires: Thu, 09 Mar 2023 13:24:15 GMT
last-modified: Fri, 03 Feb 2023 17:26:13 GMT
server: UploadServer
x-goog-generation: 1675445173923779
x-goog-hash: crc32c=9DJkug== md5=YRZqq22FC0AVPaDOh6Ipkw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 9706
x-guploader-uploadid: ADPycds8LhFWKUeO4bRTPxIq3g1y1ilUcFZh1krnaPeYyv4QZ3T_SkVL1ztezztQRF9gylxj4V59iD3We4RYWkk5SoETyfbBufOm

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 16 KB
6 KB 229ms
70ms Script
application/javascript 2001:4998:1c:800::1001
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1001 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
x-amz-version-id: .QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: KQJN8W86A4TQVSYS
age: 1
x-amz-server-side-encryption: AES256
x-amz-id-2: CkkyVp2XHxK3ggJpsUcjvZfVd70TvD9boGuJ0WThk0ZPkV0UBCrFhhjqQsl+cGRy7LLKtkqcUSM=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Jun 2022 12:21:31 GMT
server: ATS
etag: "6a624022b5d271dcefb070b0b6670abc-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H2 204 5140893.js Show response
bat.bing.com/p/action/ 0
116 B 59ms
59ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5140893.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Thu, 09 Mar 2023 12:30:19 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E48DAE66010C4E1BA25215EEB0999C66 Ref B: MIAEDGE2820 Ref C: 2023-03-09T12:30:19Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
359 B 130ms
130ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5140893&tm=al001&Ver=2&mid=46005214-e708-4662-9727-88abfad6ba3c&sid=2763b8d0be7611ed8792ff69560aeabd&vid=276403e0be7611eda05739aa069a7199&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Philadelphia%20Marriott%20Downtown&p=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&r=&lt=3063&pt=1678365016265,,,,,286,287,287,287,410,346,411,510,511,514,2275,2275,2317,3019,3019,3063&pn=0,0&evt=pageLoad&sv=1&rn=920280

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 09 Mar 2023 12:30:19 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CA2B09B73E5B484FBBB301E0E774E687 Ref B: MIAEDGE2820 Ref C: 2023-03-09T12:30:19Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 disablefood.css
philadelphiamarriottdowntown.idaypass.com/css/ 881 B
662 B 59ms
59ms Stylesheet
text/css 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/disablefood.css?v=2_1

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/vendor.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

78791edc61c96a5ec8159e033473108958108c66296abe6a5b6896040dff9645

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-encoding: gzip
last-modified: Wed, 23 Feb 2022 08:04:50 GMT
server: nginx/1.20.2
etag: W/"6215eaa2-371"
x-frame-options: SAMEORIGIN
content-type: text/css
x-xss-protection: 1; mode=block

GET
H2 200 1 Show response
philadelphiamarriottdowntown.idaypass.com/api/palapa/booking/get-booking-values/ 9 KB
3 KB 125ms
124ms XHR
application/json 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/palapa/booking/get-booking-values/1

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

b04f28c1709965fb934d97b10886d857b2919ab8c71121baddb3d913264a2926

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
Language: en
accept-language: en-US,en;q=0.9
X-CSRFToken: KyWP1jjJFRpfrm6qOTClK9iAAJ5INLyv02BnZXTUcBSscQVcIRw3PYCWs0lqiuB8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Accept-Language, Cookie
x-frame-options: SAMEORIGIN
content-type: application/json
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:19 GMT

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEDYYU6maIHPgBH_e42rbB7s&google_cver=1
dpm.demdex.net/ Frame 8890
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NTM0NzI4MzYzODY0MTgzOTE0NjI3MDYyMjgzOTE3NjQxMDUxMzk=
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NTM0NzI4MzYzODY0MTgzOTE0NjI3MDYyMjgzOTE3NjQxMDUxMzk=&google_tc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDYYU6maIHPgBH_e42rbB7s&google_cver=1?gdpr=0&gdpr_consent=

42 B
940 B

74ms
66ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDYYU6maIHPgBH_e42rbB7s&google_cver=1?gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v045-01dedc350.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: BD/B11w8TRA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDYYU6maIHPgBH_e42rbB7s&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/ Show response
match.adsrvr.org/track/upb/ Frame E343
Redirect Chain

https://insight.adsrvr.org/track/up?adv=hbq9bjg&ref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&upid=byw7ch4&upv=1.1.0
https://match.adsrvr.org/track/upb/?adv=hbq9bjg&ref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&upid=byw7ch4&upv=1.1.0

898 B
1 KB

62ms
60ms

Document
text/html

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/upb/?adv=hbq9bjg&ref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&upid=byw7ch4&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: fd72410c77efa3d892140e9e1bff6c2005d2a74ff1124c73b7d48a0538f150aa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html; charset=utf-8
date: Thu, 09 Mar 2023 12:30:19 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

Redirect headers

cache-control: private,no-cache, must-revalidate
content-type: text/html; charset=utf-8
date: Thu, 09 Mar 2023 12:30:19 GMT
location: https://match.adsrvr.org/track/upb/?adv=hbq9bjg&ref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&upid=byw7ch4&upv=1.1.0
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
315 B 136ms
49ms XHR
application/json 2606:4700:4400::6812:2b9e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2b9e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 7a53541d2e8631f2-MIA
access-control-allow-headers: Content-Type

POST
H2 200 user-cart Show response
philadelphiamarriottdowntown.idaypass.com/api/cart/ 202 B
507 B 230ms
226ms XHR
application/json 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/cart/user-cart

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

8054f4e3fe5af937cdc5d795f555dae2c1489ce993935b2c0da1ddb9bb8ce183

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
Language: en
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
X-CSRFToken: KyWP1jjJFRpfrm6qOTClK9iAAJ5INLyv02BnZXTUcBSscQVcIRw3PYCWs0lqiuB8
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Accept-Language, Cookie
x-frame-options: SAMEORIGIN
content-type: application/json
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:19 GMT

GET
H2 200 get-services Show response
philadelphiamarriottdowntown.idaypass.com/api/service/ 115 KB
11 KB 308ms
305ms XHR
application/json 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/service/get-services?serviceparent_id=&active=1&include_service_type=true&for_home=true&simple_menu=true

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

70d6443cf7ca99dcf7bcf1cbb47e3dca1a185cfa6a64bfaedef97d84174b9a65

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
Language: en
accept-language: en-US,en;q=0.9
X-CSRFToken: KyWP1jjJFRpfrm6qOTClK9iAAJ5INLyv02BnZXTUcBSscQVcIRw3PYCWs0lqiuB8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Accept-Language, Cookie
x-frame-options: SAMEORIGIN
content-type: application/json
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:19 GMT

GET
H/1.1 200
OK mc_logo_L.webp
ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/dashboard_logo/ 4 KB
4 KB 281ms
131ms Image
application/octet-stream 52.216.138.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/dashboard_logo/mc_logo_L.webp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.138.139 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: d107f91b2ead9f59eb51436c7edfaf3436f48591ed9f24fed76c654f9f827c2a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Thu, 09 Mar 2023 12:30:20 GMT
x-amz-version-id: y.HDyJf45LRLHu.CGRElMVAn3dLN1i69
Last-Modified: Thu, 21 Jul 2022 12:20:07 GMT
Server: AmazonS3
x-amz-request-id: X4R6WZ78F2XS77EP
ETag: "19a20fe499874afe83b833aac67e7b9c"
Content-Type: application/octet-stream
Accept-Ranges: bytes
Content-Length: 4174
x-amz-id-2: pXKCXWm1+vEvXHGdgeylYM7y5wyHnn8R7t21VlPd54HGw+kmzfryxJhO6bYAEbHNfbZXO0+TCfg=

GET
H/1.1 200
OK bonvoy-dark.jpg
ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/dashboard_right_logo/ 75 KB
75 KB 301ms
151ms Image
image/jpeg 52.216.138.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/dashboard_right_logo/bonvoy-dark.jpg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.138.139 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 228b1d6634abc2d6314f0591e07c5cd246a7fc071e4c9a592a2bf0e11fe6cd27

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Thu, 09 Mar 2023 12:30:20 GMT
x-amz-version-id: zoYavj_fdpDhNh_D0EnLxvRftkkQ60fB
Last-Modified: Thu, 21 Jul 2022 12:21:13 GMT
Server: AmazonS3
x-amz-request-id: X4RAF4NF1CVFCA8R
ETag: "f1eb4e69941bc7d8fca19b56707d3e49"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 76498
x-amz-id-2: eIHunOZGGk1tG6wWqq3g/7hp/C8XGTuUjhMlQObLUvFU8XnZiK9baEwJVNK0eX1u0hxGu6/zjFk=

GET
H2 200 reserve Show response
philadelphiamarriottdowntown.idaypass.com/api/palapa/booking/ 52 B
439 B 329ms
328ms XHR
application/json 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/palapa/booking/reserve?booking_id=0&keep_price=1

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

4dbae8b3d2a71b182f3aab701a08fc3c5f2bf734f9e09605c650b1c6506e9097

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
Language: en
accept-language: en-US,en;q=0.9
X-CSRFToken: KyWP1jjJFRpfrm6qOTClK9iAAJ5INLyv02BnZXTUcBSscQVcIRw3PYCWs0lqiuB8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Accept-Language, Cookie
x-frame-options: SAMEORIGIN
content-type: application/json
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:19 GMT

GET
H2 200 get-services Show response
philadelphiamarriottdowntown.idaypass.com/api/service/ 115 KB
11 KB 492ms
491ms XHR
application/json 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/api/service/get-services?serviceparent_id=&active=1&include_service_type=true&for_home=true&simple_menu=true

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

70d6443cf7ca99dcf7bcf1cbb47e3dca1a185cfa6a64bfaedef97d84174b9a65

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/
Language: en
accept-language: en-US,en;q=0.9
X-CSRFToken: KyWP1jjJFRpfrm6qOTClK9iAAJ5INLyv02BnZXTUcBSscQVcIRw3PYCWs0lqiuB8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
referrer-policy: same-origin
content-encoding: gzip
server: nginx/1.20.2
x-version: 1678101019
vary: Accept-Language, Cookie
x-frame-options: SAMEORIGIN
content-type: application/json
content-language: en
cache-control: no-cache, no-store
x-xss-protection: 1; mode=block
expires: Thu, 09 Mar 2023 12:10:20 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 68ms
67ms Image
image/gif 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1990161646&t=pageview&_s=2&dl=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&dp=%2F&ul=en-us&de=UTF-8&dt=Philadelphia%20Marriott%20Downtown&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABAAAAACAAI~&jid=&gjid=&cid=774386379.1678365019&tid=UA-162569320-1&_gid=789964234.1678365019&cd1=&cd2=Philadelphia%20Marriott%20Downtown&z=710293693

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 06:47:00 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 20599
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719
dpm.demdex.net/ Frame 8890
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=&ttd_tpi=1
https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719

42 B
940 B

93ms
92ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v045-0ff074195.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: DN2VY/7vSao=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 189

GET
H2 200 1144 Show response
beacon.sojern.com/pixel/p/ Frame 7C43 3 KB
960 B 52ms
51ms Script
application/javascript 107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.sojern.com/pixel/p/1144?cid=MGP_201904%7Cundefined%7C%7CERR%3ACannot%20read%20properties%20of%20undefined%20(reading%20%27split%27)&p=undefined&hprid=PHLDT&hb=undefined&hc1=undefined&hn1=undefined&hs1=undefined&ffl=undefined&t=undefined&hr=undefined&hp=undefined&hrp=undefined&hdc=undefined&rew=undefined&l=undefined&vid=hot&hpid=PHLDT&
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/marriott/mhotels.html?p=undefined&hprid=PHLDT&hpr=&hb=undefined&hc1=undefined&hn1=undefined&hs1=undefined&ffl=undefined&hl=&t=undefined&hr=undefined&hd1=&hd2=&hconfno=&hp=undefined&hcu=&hrp=undefined&hdc=undefined&rew=undefined&l=undefined&vid=hot&cid=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: a6d3c646c75d19fae473ba506e692f34d9f50abfe77ac1b58c8ef9020d86c7b0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
via: 1.1 google
vary: Accept-Encoding
content-type: application/javascript
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 804

GET
H2

200

src=4810757;dc_pre=CL_Uv_bszv0CFZWHywEduygNjQ;type=sales;cat=5myqls5f;qty=1;cost=0;u1=;u16=https%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F;dc_lat=;dc_rdid=;tag_for_child_directed...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=4810757;type=sales;cat=5myqls5f;qty=1;cost=0;u1=;u16=https%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F;dc_lat=;dc_rdid=;tag_for_child_di...
https://ad.doubleclick.net/ddm/activity/src=4810757;dc_pre=CL_Uv_bszv0CFZWHywEduygNjQ;type=sales;cat=5myqls5f;qty=1;cost=0;u1=;u16=https%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F...
https://adservice.google.com/ddm/fls/z/src=4810757;dc_pre=CL_Uv_bszv0CFZWHywEduygNjQ;type=sales;cat=5myqls5f;qty=1;cost=0;u1=;u16=https%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F;...

42 B
401 B

255ms
87ms

Image
image/gif

2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=4810757;dc_pre=CL_Uv_bszv0CFZWHywEduygNjQ;type=sales;cat=5myqls5f;qty=1;cost=0;u1=;u16=https%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;ord=[OrderID]

Protocol

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/src=4810757;dc_pre=CL_Uv_bszv0CFZWHywEduygNjQ;type=sales;cat=5myqls5f;qty=1;cost=0;u1=;u16=https%253A%252F%252Fphiladelphiamarriottdowntown.idaypass.com%252F;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;ord=[OrderID]
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK px
secure.adnxs.com/ 0
1 KB 238ms
93ms Image
application/javascript 68.67.179.113
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/px?id=1565798&t=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 09 Mar 2023 12:30:19 GMT
AN-X-Request-Uuid: 3dab4a1a-e7b8-4cf2-8c8c-e1c846282bd8
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/javascript; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 38.132.118.68; 38.132.118.68; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK seg
secure.adnxs.com/ 0
1 KB 230ms
80ms Image
application/javascript 68.67.179.113
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/seg?add=29464183&t=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 09 Mar 2023 12:30:19 GMT
AN-X-Request-Uuid: 4513fd86-f2c6-4972-914b-1cbe31d48c3c
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/javascript; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 38.132.118.68; 38.132.118.68; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

AdX
pixel.sojern.com/idSync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Sp...
https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Sp...
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&sjrn_ula=673976618&google_gid=CAESEJQ4CgkMAU2oWPCkHuvlI3U&google_cver=1

42 B
272 B

67ms
64ms

Image
image/gif

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&sjrn_ula=673976618&google_gid=CAESEJQ4CgkMAU2oWPCkHuvlI3U&google_cver=1
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Thu, 09 Mar 2023 12:30:19 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&sjrn_ula=673976618&google_gid=CAESEJQ4CgkMAU2oWPCkHuvlI3U&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 412
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
fcmatch.youtube.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern_adh
https://cm.g.doubleclick.net/pixel?google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern_adh&google_tc=
https://fcmatch.google.com/pixel?google_gm=AMnCDoqTJjNXlvK3MRDcA1mJqPNklKMsk3YilA5m95WxE_aey0l5oQ7RQo0g6eTBlruRSYlneXf-rEVU1oSx1WEXHeAP6NlEghGBYXg8Ky599Tq8AP438ZM
https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqTJjNXlvK3MRDcA1mJqPNklKMsk3YilA5m95WxE_aey0l5oQ7RQo0g6eTBlruRSYlneXf-rEVU1oSx1WEXHeAP6NlEghGBYXg8Ky599Tq8AP438ZM

170 B
432 B

548ms
383ms

Image
image/png

2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqTJjNXlvK3MRDcA1mJqPNklKMsk3YilA5m95WxE_aey0l5oQ7RQo0g6eTBlruRSYlneXf-rEVU1oSx1WEXHeAP6NlEghGBYXg8Ky599Tq8AP438ZM

Protocol

Server

2607:f8b0:4006:816::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqTJjNXlvK3MRDcA1mJqPNklKMsk3YilA5m95WxE_aey0l5oQ7RQo0g6eTBlruRSYlneXf-rEVU1oSx1WEXHeAP6NlEghGBYXg8Ky599Tq8AP438ZM
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 360
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

apn
pixel.sojern.com/idsync/
Redirect Chain

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
https://pixel.sojern.com/idsync/apn?id=4612952643267094414&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl

42 B
264 B

981ms
922ms

Image
image/gif

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/apn?id=4612952643267094414&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Thu, 09 Mar 2023 12:30:20 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

Date: Thu, 09 Mar 2023 12:30:19 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.68; 38.132.118.68; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 3ff24800-7751-4647-9835-1cfe295de95d
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://pixel.sojern.com/idsync/apn?id=4612952643267094414&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

ttd
pixel.sojern.com/idsync/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=ombl9hp&ttd_puid=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&ttd_tpi=1
https://pixel.sojern.com/idsync/ttd?id=1f6f2df4-ea79-431d-9432-37f5fe6d0719&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl

42 B
58 B

100ms
99ms

Image
image/gif

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/ttd?id=1f6f2df4-ea79-431d-9432-37f5fe6d0719&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
Protocol: H3
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Thu, 09 Mar 2023 12:30:20 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.sojern.com/idsync/ttd?id=1f6f2df4-ea79-431d-9432-37f5fe6d0719&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 327

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 82ms
78ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-1359549&l=dataLayerB&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1LXTBF5X2V&l=dataLayerB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1b729ee93eb192bb7dcf12e76d9ce6216d127637b9f33a8e24726805f26ca047

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44979
x-xss-protection: 0
last-modified: Thu, 09 Mar 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 09 Mar 2023 12:30:19 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 131 KB
51 KB 87ms
84ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-924374711&l=dataLayerB&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1LXTBF5X2V&l=dataLayerB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ad3043fe035839f522d0e7011dd96439e77eaf469f9ec9a2c8009c87b8268c0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51783
x-xss-protection: 0
last-modified: Thu, 09 Mar 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 09 Mar 2023 12:30:19 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 186 KB
67 KB 112ms
110ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-950378023&l=dataLayerB&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1LXTBF5X2V&l=dataLayerB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f938c9be0ff7fa5c506a0ddebe43cb01216c1580aae5e31bbb8db68d3952dada

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68027
x-xss-protection: 0
last-modified: Thu, 09 Mar 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 09 Mar 2023 12:30:19 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 100ms
98ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9035495&l=dataLayerB&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1LXTBF5X2V&l=dataLayerB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

431fe74d0096b939afd5ed1684b21c62cf04985059c76481919c03129e3269a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44979
x-xss-protection: 0
last-modified: Thu, 09 Mar 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 09 Mar 2023 12:30:19 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 175 KB
64 KB 125ms
123ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-366134444&l=dataLayerB&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1LXTBF5X2V&l=dataLayerB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a540980818ce61b258b594826865bcd3fa4059ca5661e18dc3d8f3a50111ea71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65749
x-xss-protection: 0
last-modified: Thu, 09 Mar 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 09 Mar 2023 12:30:19 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 112 KB
44 KB 211ms
210ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-203334133-1&l=dataLayerB&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1LXTBF5X2V&l=dataLayerB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f82406302c459c32c810278f5f8668ca38b1dbd59738d758dfe8dbcf0d6533f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44747
x-xss-protection: 0
last-modified: Thu, 09 Mar 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 09 Mar 2023 12:30:19 GMT

GET
H2 200 main.8b1025ba.js Show response
s.pinimg.com/ct/lib/ 56 KB
17 KB 70ms
70ms Script
application/javascript 2a04:4e42:46::84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.8b1025ba.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:46::84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 5c1b133e4da2d3c32efabe11e0aea725cf19372d47fa794ff41df965bf5ebe59

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
x-cdn: fastly
etag: "cdc9076a068e07f5162c7bc891af6405"
x-amz-server-side-encryption: AES256
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: X-CDN
vary: Accept-Encoding, Origin
cache-control: max-age=1209600
alt-svc: h3=":443";ma=600
content-length: 17364

GET
H2 200 i Show response
tr.snapchat.com/cm/ Frame AD80 672 B
597 B 269ms
100ms Document
text/html 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/i?pid=fbf5aa06-3f82-45b5-86ba-4c4fe9c75a96&u_scsid=f3953abd-b8e7-4f3c-9b01-43886e4bc19f&u_sclid=e6b44b73-ee5d-4fd3-9701-fafba149f9f3

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

6501140033c3bb20da4b5ac73c90f687ba8a2053c4ba37c4b6f5275166db7fa6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: gzip
content-type: text/html
date: Thu, 09 Mar 2023 12:30:19 GMT
server: API Gateway
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 google, 1.1 google
x-envoy-upstream-service-time: 10

GET
H2 200 fbf5aa06-3f82-45b5-86ba-4c4fe9c75a96.js Show response
tr.snapchat.com/config/com/ 2 KB
1001 B 264ms
93ms Script
application/javascript 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/config/com/fbf5aa06-3f82-45b5-86ba-4c4fe9c75a96.js

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

df2caab856b62ae80e0cbabb826a13980167fb73d67c2e263184e0b10565ad61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer
Origin: https://philadelphiamarriottdowntown.idaypass.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
content-encoding: gzip
via: 1.1 google, 1.1 google
server: API Gateway
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43", h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 p
tr.snapchat.com/ 68 B
618 B 267ms
98ms Ping
text/html 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

370dbc0a7e85181d81ecf29999a4782fc0fde9621e538b4d17887e2d1af1522d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
content-type: text/html
access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
cache-control: no-cache, no-transform
x-envoy-upstream-service-time: 5
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43", h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68

GET
H2 200 rtset
bh.contextweb.com/bh/ Frame E19C 49 B
869 B 240ms
67ms Image
image/gif 198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=

Requested by

Host: login.dotomi.com
URL: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.50.v20221201) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(9.4.50.v20221201)
content-language: en-US
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-68b8b6bc74-whwb6
expires: -1

GET
H2 200 27205
tags.bluekai.com/site/ Frame E19C 62 B
462 B 341ms
173ms Image
image/gif 173.223.57.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/27205?id=AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=
Requested by: Host: login.dotomi.com
URL: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.57.84 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-57-84.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Thu, 09 Mar 2023 12:30:20 GMT
content-length: 62
content-type: image/gif

GET
H/1.1

200
OK

/
ps.eyeota.net/match/bounce/ Frame E19C
Redirect Chain

https://ps.eyeota.net/match?bid=r8d1b20&uid=AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=
https://ps.eyeota.net/match/bounce/?bid=r8d1b20&uid=AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=

70 B
440 B

61ms
59ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match/bounce/?bid=r8d1b20&uid=AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=
Requested by: Host: login.dotomi.com
URL: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type: image/gif
Date: Thu, 09 Mar 2023 12:30:20 GMT
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /match/bounce/?bid=r8d1b20&uid=AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=
Date: Thu, 09 Mar 2023 12:30:19 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H/1.1 200
OK ibs:dpid=13870&dpuuid=cnvr-AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=
dpm.demdex.net/ Frame E19C 42 B
940 B 72ms
63ms Image
image/gif 44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=13870&dpuuid=cnvr-AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v045-01cd40323.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: OcOQria6Sac=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame E19C 0
338 B 271ms
63ms Image
text/plain 3.232.140.34
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=runads&partner_uid=cnvr-AQEK2fjzVlPkDwEoU6gCAQEL_wE&gdpr_consent=
Requested by: Host: login.dotomi.com
URL: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.232.140.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-140-34.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-served-by: beacon-n021-ash-prod.krxd.net
date: Thu, 09 Mar 2023 12:30:19 GMT
cache-control: private, no-cache, no-store
x-request-time: D=34 t=1678365019
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

user.sync
match.sync.ad.cpe.dotomi.com/w/ Frame E19C
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fmatch.sync.ad.cpe.dotomi.com%2Fw%2Fuser.sync%3Fptrid%3D6%26userid%3D%24UID&gdpr_consent=
https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=6&userid=4612952643267094414&gdpr_consent=

43 B
267 B

604ms
58ms

Image
image/gif

2606:ae80:1451:21::500
VALUECLICK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=6&userid=4612952643267094414&gdpr_consent=
Requested by: Host: login.dotomi.com
URL: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=
Protocol: H2
Server: 2606:ae80:1451:21::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
cache-control: no-cache
server: nginx
content-length: 43
expires: 0

Redirect headers

Date: Thu, 09 Mar 2023 12:30:19 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.68; 38.132.118.68; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: a3882520-43f5-4fbe-9f17-cb3993f5137c
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=6&userid=4612952643267094414&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

user.sync
match.sync.ad.cpe.dotomi.com/w/ Frame E19C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58272/sync?redir=true&https%3A%2F%2Fmatch.sync.ad.cpe.dotomi.com%2Fw%2Fuser.sync%3Fptrid%3D12%26userid%3D%24UID&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58272/sync?redir=true&https%3A%2F%2Fmatch.sync.ad.cpe.dotomi.com%2Fw%2Fuser.sync%3Fptrid%3D12%26userid%3D%24UID&gdpr_consent=&verify=true
https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=12&userid=y-rvZPJNhE2umjEfeJ_EuglWZkBVsogA--~A

43 B
267 B

281ms
59ms

Image
image/gif

2606:ae80:1451:21::500
VALUECLICK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=12&userid=y-rvZPJNhE2umjEfeJ_EuglWZkBVsogA--~A
Requested by: Host: login.dotomi.com
URL: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=
Protocol: H2
Server: 2606:ae80:1451:21::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
cache-control: no-cache
server: nginx
content-length: 43
expires: 0

Redirect headers

location: https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=12&userid=y-rvZPJNhE2umjEfeJ_EuglWZkBVsogA--~A
date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

user.sync
match.sync.ad.cpe.dotomi.com/w/ Frame E19C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=epsilon&gdpr=false&gdpr_consent=
https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LF1375N4-1R-433P

43 B
268 B

285ms
57ms

Image
image/gif

2606:ae80:1451:21::500
VALUECLICK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LF1375N4-1R-433P
Requested by: Host: login.dotomi.com
URL: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=
Protocol: H2
Server: 2606:ae80:1451:21::500 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
cache-control: no-cache
server: nginx
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://match.sync.ad.cpe.dotomi.com/w/user.sync?ptrid=14&userid=LF1375N4-1R-433P
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 7d24643e640b7b50906469aa87bfb2ce
Expires: 0

GET
H2 200 DMCSuccessLogger
login-ds.dotomi.com/ucm/ Frame E19C 43 B
141 B 425ms
118ms Image
image/gif 2606:ae80:1451:24::760
VALUECLICK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login-ds.dotomi.com/ucm/DMCSuccessLogger?dtmid=853706948629161230&sessionid=1678365019588&comId=2814&dtm_command_op_date=1678365019588&uniqueid=853706948662139281
Requested by: Host: login.dotomi.com
URL: https://login.dotomi.com/ucm/UCMController?dtm_com=28&dtm_cid=2814&dtm_cmagic=8e987c&dtm_format=5&dtm_fid=101&cli_promo_id=2&dtmc_marsha_code=PHLDT&canonical_url=&dtm_user_token=&dtmc_ref=&dtmc_loc=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&fpc_status=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2606:ae80:1451:24::760 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://login.dotomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
cache-control: max-age=0, no-store
server: nginx
content-length: 43
content-type: image/gif

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 83ms
83ms Ping
text/plain 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-1LXTBF5X2V&gtm=45je3360&_p=1990161646&cid=774386379.1678365019&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&uid=&sid=1678365019&sct=1&seg=0&dl=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&dt=Philadelphia%20Marriott%20Downtown&en=scroll&_fv=1&_ss=1&ep.optimize_id=&ep.anonymize_ip=false&epn.percent_scrolled=90&up._npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1LXTBF5X2V&l=dataLayerB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80e::200e Nutley, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 s43217931841816 Show response
smetrics.marriott.com/b/ss/marriottglobal/10/JS-2.14.0-LDQM/ 5 KB
5 KB 88ms
87ms Script
application/x-javascript 63.140.38.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.marriott.com/b/ss/marriottglobal/10/JS-2.14.0-LDQM/s43217931841816?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=9%2F2%2F2023%2012%3A30%3A19%204%200&d.&nsid=0&jsonv=1&.d&mid=53558387220982011552731689024369351130&aamlh=7&ce=UTF-8&pageName=philadelphiamarriottdowntown.idaypass.com%2F&g=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cc=USD&events=event1%2CprodView&products=%3BPHLDT%3B%3B&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c5=Real%20Time%20Reservation&c8=D%3Dv15&v15=Weekday%20%3A%20Thursday%20%3A%208%3A00AM&c26=Launch&v41=Real%20Time%20Reservation&c71=Off-Platform%20Basic&v101=Default%20Cookie%20Opt-in&v192=philadelphiamarriottdowntown.idaypass.com%2F&v237=en&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=664516D751E565010A490D4C%40AdobeOrg&lrt=474&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.104 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-104.data.adobedc.net

Software

jag /

Resource Hash

7701a30bb7b714fa7c0cf93a36bc5ee2c601ede0af08e1d4bc4ae43b7fdc4316

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

x-aam-tid: RSessmsUQc0=
date: Thu, 09 Mar 2023 12:30:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 5414
x-xss-protection: 1; mode=block
dcs: dcs-prod-va6-2-v045-0f4eccdd9.edge-va6.demdex.com 8 ms
pragma: no-cache
last-modified: Fri, 10 Mar 2023 12:30:19 GMT
server: jag
etag: 3604261435543322624-4619698265028952382
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 08 Mar 2023 12:30:19 GMT

POST
H2 200 tp2 Show response
p.tvpixel.com/com.snowplowanalytics.snowplow/ 2 B
346 B 213ms
57ms XHR
text/plain 44.209.164.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.209.164.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-209-164-40.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
date: Thu, 09 Mar 2023 12:30:20 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

OPTIONS
H2 200 tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 0
0 213ms
49ms Preflight 44.209.164.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.209.164.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-209-164-40.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://philadelphiamarriottdowntown.idaypass.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
access-control-max-age: 600
content-length: 0
date: Thu, 09 Mar 2023 12:30:19 GMT
server: nginx

GET
H2 200 otBannerSdk.js Show response
cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/6.26.0/ 319 KB
76 KB 110ms
108ms Script
application/x-javascript 173.223.56.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/6.26.0/otBannerSdk.js
Requested by: Host: cache.marriott.com
URL: https://cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/otSDKStub.js?5335937150589924
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.96 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-96.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 972688e6f6c24d2b23019a796b19f90515ba5f4ff744747c072b79fa44de3432

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: gzip
last-modified: Mon, 06 Jun 2022 19:39:17 GMT
server: AkamaiNetStorage
etag: "aa2e3ff705d27b77a2480d446a15e46b:1654544357.83096"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=1893430
accept-ranges: bytes
expires: Fri, 31 Mar 2023 10:27:29 GMT

GET
H2 200 836072006419889 Show response
connect.facebook.net/signals/config/ 379 KB
108 KB 68ms
66ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/836072006419889?v=2.9.98&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5206d191529a42768640a36d1c3d24103df603780b2181ccb1b15f35c97beff8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 09 Mar 2023 12:30:19 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 110630
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: a9/zbFn+FAowfgdNILkuxCz2eDa64NKK2+p2YUnHVaJdFBiYnuBV7utEggNHRwIDH5lol7A5WJhRWWwX83mpOQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 2050670934
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=1957&dpuuid=3EB710122B1364581B9602DD2A7F65FE
dpm.demdex.net/ Frame 8890
Redirect Chain

https://c.bing.com/c.gif?uid=53472836386418391462706228391764105139&Red3=MSAdobe_pd&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=3EB710122B1364581B9602DD2A7F65FE

42 B
940 B

66ms
65ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1957&dpuuid=3EB710122B1364581B9602DD2A7F65FE

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v045-0e4dc08fb.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 5tQKpgErRgQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 19766BE937A849AF937A0A4D450CFC37 Ref B: MIAEDGE2820 Ref C: 2023-03-09T12:30:19Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://dpm.demdex.net/ibs:dpid=1957&dpuuid=3EB710122B1364581B9602DD2A7F65FE
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2 200 405909.json Show response
s.yimg.com/wi/config/ 44 B
675 B 260ms
107ms XHR
application/json 2001:4998:1c:800::1001
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/405909.json

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1001 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

fad2b41a387ad2bff0c05ed1475f79529e13a17163eb6e36f8953822d96ded88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
x-amz-version-id: 50Tr4LaAL2FlcpH6YjQKudKvwqwxbYro
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-request-id: X4R3Q63ZPSEGKNN5
age: 0
x-amz-server-side-encryption: AES256
content-length: 44
x-amz-id-2: pm14nZdW1E+2Pyf2R4kWp4schGXH/lPtoR1ZrCKvGNBJJQ8zbp0GYMmkNWquHUz1DO27qRIoBGs=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 29 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 23 Jun 2022 20:00:54 GMT
server: ATS
etag: "bef1253818c00b6e13b42804c46f2014"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/360572/domain/philadelphiamarriottdowntown.idaypass.com/ 36 B
370 B 830ms
309ms XHR
application/json 2600:9000:2245:4a00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/360572/domain/philadelphiamarriottdowntown.idaypass.com/token
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2245:4a00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
content-encoding: gzip
via: 1.1 ff7cafeac35b91a7af23c56e3b9691e8.cloudfront.net (CloudFront)
x-amz-cf-pop: DUB56-P1
vary: accept-encoding
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: nF5kKG7QI8aueExxIEeH2hyZRIcW-xu_DlxqdNWV7DRCHJwlL1dWTw==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D360572%26time%3D1678365019800%26url%3Dhttps%253A%252F%252Fphiladelphiamarriottdow...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cookiesTest=true&liSync=true&e_ipv6=AQITw1xUxiPuewAAAYbG...

0
701 B

362ms
97ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cookiesTest=true&liSync=true&e_ipv6=AQITw1xUxiPuewAAAYbGWdC7HHU1seAbYPy1U1CEjT8NDlsNwtPjGQupSvp7joZBdlfDiWs
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 156CAB825D8C45AFA4A9C164AD2DDE22 Ref B: MIAEDGE1712 Ref C: 2023-03-09T12:30:20Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: application/javascript
x-li-fabric: prod-lva1
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX2ds7cbX9mSFaA67q58Q==

Redirect headers

date: Thu, 09 Mar 2023 12:30:20 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 42028A48D2134CF59E09BC12C865FFAD Ref B: MIA301000101049 Ref C: 2023-03-09T12:30:20Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=360572&time=1678365019800&url=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&cookiesTest=true&liSync=true&e_ipv6=AQITw1xUxiPuewAAAYbGWdC7HHU1seAbYPy1U1CEjT8NDlsNwtPjGQupSvp7joZBdlfDiWs
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX2ds7XPHR7X7V5s2/1Vw==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 7C43 131 KB
51 KB 130ms
123ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-14242

Requested by

Host: beacon.sojern.com
URL: https://beacon.sojern.com/pixel/p/1144?cid=MGP_201904%7Cundefined%7C%7CERR%3ACannot%20read%20properties%20of%20undefined%20(reading%20%27split%27)&p=undefined&hprid=PHLDT&hb=undefined&hc1=undefined&hn1=undefined&hs1=undefined&ffl=undefined&t=undefined&hr=undefined&hp=undefined&hrp=undefined&hdc=undefined&rew=undefined&l=undefined&vid=hot&hpid=PHLDT&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b69107182f81db02c505aceb90550889a19dfd6dcee8ea8a57b4c39bf34cfd9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51688
x-xss-protection: 0
last-modified: Thu, 09 Mar 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 09 Mar 2023 12:30:19 GMT

GET
H2

200

pixel
fcmatch.youtube.com/ Frame 7C43
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern_adh
https://fcmatch.google.com/pixel?google_gm=AMnCDoplUw5ahxuKfRYl6qF-8yh9Fj-jxHmwYTtBT2alMo1HEbhn8iZeFW_eZn6dgYUe96BbhND5GWS5gaZamYMQV9ao7ugIexdP0TCxlYctBwkyP1uIOC0
https://fcmatch.youtube.com/pixel?google_gm=AMnCDoplUw5ahxuKfRYl6qF-8yh9Fj-jxHmwYTtBT2alMo1HEbhn8iZeFW_eZn6dgYUe96BbhND5GWS5gaZamYMQV9ao7ugIexdP0TCxlYctBwkyP1uIOC0

170 B
233 B

507ms
385ms

Image
image/png

2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fcmatch.youtube.com/pixel?google_gm=AMnCDoplUw5ahxuKfRYl6qF-8yh9Fj-jxHmwYTtBT2alMo1HEbhn8iZeFW_eZn6dgYUe96BbhND5GWS5gaZamYMQV9ao7ugIexdP0TCxlYctBwkyP1uIOC0

Requested by

Host: static.sojern.com
URL: https://static.sojern.com/marriott/mhotels.html?p=undefined&hprid=PHLDT&hpr=&hb=undefined&hc1=undefined&hn1=undefined&hs1=undefined&ffl=undefined&hl=&t=undefined&hr=undefined&hd1=&hd2=&hconfno=&hp=undefined&hcu=&hrp=undefined&hdc=undefined&rew=undefined&l=undefined&vid=hot&cid=

Protocol

Server

2607:f8b0:4006:816::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://fcmatch.youtube.com/pixel?google_gm=AMnCDoplUw5ahxuKfRYl6qF-8yh9Fj-jxHmwYTtBT2alMo1HEbhn8iZeFW_eZn6dgYUe96BbhND5GWS5gaZamYMQV9ao7ugIexdP0TCxlYctBwkyP1uIOC0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 360
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

apn
pixel.sojern.com/idsync/ Frame 7C43
Redirect Chain

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
https://pixel.sojern.com/idsync/apn?id=4612952643267094414&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl

42 B
58 B

96ms
95ms

Image
image/gif

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/apn?id=4612952643267094414&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/marriott/mhotels.html?p=undefined&hprid=PHLDT&hpr=&hb=undefined&hc1=undefined&hn1=undefined&hs1=undefined&ffl=undefined&hl=&t=undefined&hr=undefined&hd1=&hd2=&hconfno=&hp=undefined&hcu=&hrp=undefined&hdc=undefined&rew=undefined&l=undefined&vid=hot&cid=
Protocol: H3
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Thu, 09 Mar 2023 12:30:20 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

Date: Thu, 09 Mar 2023 12:30:19 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.68; 38.132.118.68; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: af37e691-e86a-4146-9dc0-f0fe831520fb
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://pixel.sojern.com/idsync/apn?id=4612952643267094414&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ttd
pixel.sojern.com/idsync/ Frame 7C43
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&ttd_tpi=1
https://pixel.sojern.com/idsync/ttd?id=089b7f68-6875-4ed6-bb28-867f03c98929&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl

42 B
287 B

57ms
55ms

Image
image/gif

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/ttd?id=089b7f68-6875-4ed6-bb28-867f03c98929&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/marriott/mhotels.html?p=undefined&hprid=PHLDT&hpr=&hb=undefined&hc1=undefined&hn1=undefined&hs1=undefined&ffl=undefined&hl=&t=undefined&hr=undefined&hd1=&hd2=&hconfno=&hp=undefined&hcu=&hrp=undefined&hdc=undefined&rew=undefined&l=undefined&vid=hot&cid=
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Thu, 09 Mar 2023 12:30:19 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.sojern.com/idsync/ttd?id=089b7f68-6875-4ed6-bb28-867f03c98929&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 327

GET
H2

200

AdX
pixel.sojern.com/idSync/ Frame 7C43
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=nPYez5mfGIEHL8dMf15U4w&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Sp...
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&google_gid=CAESEDVasFnV8HKJ1ywEFRN4ww8&google_cver=1

42 B
272 B

114ms
83ms

Image
image/gif

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&google_gid=CAESEDVasFnV8HKJ1ywEFRN4ww8&google_cver=1
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/marriott/mhotels.html?p=undefined&hprid=PHLDT&hpr=&hb=undefined&hc1=undefined&hn1=undefined&hs1=undefined&ffl=undefined&hl=&t=undefined&hr=undefined&hd1=&hd2=&hconfno=&hp=undefined&hcu=&hrp=undefined&hdc=undefined&rew=undefined&l=undefined&vid=hot&cid=
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Thu, 09 Mar 2023 12:30:19 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=iOmnsLlSN9vlkAQPwpSRUMIS4Nsjz0C9cgA0BuhLpTXEsW3F6Spzo7bNd4Fbtehl&google_gid=CAESEDVasFnV8HKJ1ywEFRN4ww8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 389
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ 539 B
881 B 330ms
89ms XHR
application/json 173.223.56.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2613977086519&pd=%7B%7D&cb=1678365019808&dep=2%2CPAGE_LOAD

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

173.223.56.237 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a173-223-56-237.deploy.static.akamaitechnologies.com

Software

Resource Hash

67063360c0d4766b19f6ff3b535a4143101bc9af186db76e676a38d8d3bd03e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.9c912f17.1678365020.3d7ba5bd
x-envoy-upstream-service-time: 2
content-length: 380
x-pinterest-rid: 2948110240867096
pin-unauth: dWlkPVpXUTBabUptTWpZdE1USTVOUzAwWXpFMUxXRXpPR0l0T0RRM1ltTTBNelkyWWpObA
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ 539 B
881 B 326ms
87ms XHR
application/json 173.223.56.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?event=pagevisit&tid=2613977086519&cb=1678365019809&dep=5%2CEVENT_TAGS_ABSENT

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

173.223.56.237 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a173-223-56-237.deploy.static.akamaitechnologies.com

Software

Resource Hash

67063360c0d4766b19f6ff3b535a4143101bc9af186db76e676a38d8d3bd03e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.9c912f17.1678365020.3d7ba5be
x-envoy-upstream-service-time: 2
content-length: 380
x-pinterest-rid: 4918300972142024
pin-unauth: dWlkPVpHTTRaREpqWTJNdE1XUmlZeTAwTURVMExXRTNaV010WW1JeU9HSXdZVFUzWkRKbA
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ 539 B
881 B 326ms
87ms XHR
application/json 173.223.56.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?event=custom&ed=%7B%22value%22%3A334%2C%22currency%22%3A%22USD%22%7D&tid=2613977086519&cb=1678365019810&dep=5%2CEVENT_TAGS_ABSENT

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

173.223.56.237 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a173-223-56-237.deploy.static.akamaitechnologies.com

Software

Resource Hash

67063360c0d4766b19f6ff3b535a4143101bc9af186db76e676a38d8d3bd03e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.9c912f17.1678365020.3d7ba5bf
x-envoy-upstream-service-time: 2
content-length: 380
x-pinterest-rid: 1740930083398636
pin-unauth: dWlkPU9HVTBNbUUzTVRJdE5EUXhOUzAwTURRNUxXRmlaR1l0WW1VMk5qUm1OemM1TWpRNQ
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://philadelphiamarriottdowntown.idaypass.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
333 B 327ms
90ms Image
image/gif 173.223.56.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?tid=2613977086519&pd=%7B%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%228b1025ba%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1678365019811

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

173.223.56.237 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a173-223-56-237.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.9c912f17.1678365020.3d7ba5c0
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 2
content-length: 35
x-pinterest-rid: 7125673963409544
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK universal_pixel.1.1.0.js Show response
js.adsrvr.org/ Frame E343 487 B
987 B 65ms
62ms Script
application/x-javascript 143.204.138.162
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Requested by: Host: match.adsrvr.org
URL: https://match.adsrvr.org/track/upb/?adv=hbq9bjg&ref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&upid=byw7ch4&upv=1.1.0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.138.162 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-138-162.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f6d7e9dafd1ec463ecd0c6b20f170400dd15afe81c71dea50771550df2f83ffc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.adsrvr.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Wed, 08 Mar 2023 14:36:22 GMT
Via: 1.1 4c4a56815dfe3e256aedb11d486092f0.cloudfront.net (CloudFront)
Last-Modified: Thu, 24 Sep 2020 15:15:32 GMT
Server: AmazonS3
X-Amz-Cf-Pop: EWR52-C2
Age: 78838
ETag: "f0a7a3296da7382ce6bc1a3b6769e927"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 487
X-Amz-Cf-Id: DA1B-bDg8gEo7K6oP9x38Gfwt8r9P9_CEnEKZd7N8RTusenYpXgAlA==

GET
H2

200

dc_pre=CJiHxvbszv0CFaUqwQodwNwErg;src=1359549;type=marri003;cat=m1m_m0;ord=8463860055572;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=1359549;type=marri003;cat=m1m_m0;ord=8463860055572;gtm=45fe3360;npa=1;auiddc=700103119.1678365020;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.ida...
https://ad.doubleclick.net/activity;dc_pre=CJiHxvbszv0CFaUqwQodwNwErg;src=1359549;type=marri003;cat=m1m_m0;ord=8463860055572;gtm=45fe3360;npa=1;auiddc=700103119.1678365020;u7=%2F;~oref=https%3A%2F%...
https://adservice.google.com/ddm/fls/z/dc_pre=CJiHxvbszv0CFaUqwQodwNwErg;src=1359549;type=marri003;cat=m1m_m0;ord=8463860055572;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladelphiama...

42 B
107 B

136ms
88ms

Image
image/gif

2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJiHxvbszv0CFaUqwQodwNwErg;src=1359549;type=marri003;cat=m1m_m0;ord=8463860055572;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F

Protocol

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CJiHxvbszv0CFaUqwQodwNwErg;src=1359549;type=marri003;cat=m1m_m0;ord=8463860055572;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

dc_pre=CKONxvbszv0CFUF8wQodiyIJzQ;src=1359549;type=marri001;cat=m1m_g0;ord=1;num=2071111093150;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=1359549;type=marri001;cat=m1m_g0;ord=1;num=2071111093150;gtm=45fe3360;npa=1;auiddc=700103119.1678365020;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdownto...
https://ad.doubleclick.net/activity;dc_pre=CKONxvbszv0CFUF8wQodiyIJzQ;src=1359549;type=marri001;cat=m1m_g0;ord=1;num=2071111093150;gtm=45fe3360;npa=1;auiddc=700103119.1678365020;u7=%2F;~oref=https%...
https://adservice.google.com/ddm/fls/z/dc_pre=CKONxvbszv0CFUF8wQodiyIJzQ;src=1359549;type=marri001;cat=m1m_g0;ord=1;num=2071111093150;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladel...

42 B
107 B

135ms
88ms

Image
image/gif

2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKONxvbszv0CFUF8wQodiyIJzQ;src=1359549;type=marri001;cat=m1m_g0;ord=1;num=2071111093150;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F

Protocol

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CKONxvbszv0CFUF8wQodiyIJzQ;src=1359549;type=marri001;cat=m1m_g0;ord=1;num=2071111093150;gtm=45fe3360;npa=1;auiddc=*;u7=%2F;~oref=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=3047&dpuuid=5546EF1A4279E2&gdpr=0&gdpr_consent=
dpm.demdex.net/ Frame 8890
Redirect Chain

https://servedby.flashtalking.com/map/?key=a74thHgsfK627J6Ftt8sj5ks52bKe&gdpr=0&gdpr_consent=&url=https://dpm.demdex.net/ibs:dpid=3047&dpuuid=[%FT_GUID%]&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=3047&dpuuid=5546EF1A4279E2&gdpr=0&gdpr_consent=

42 B
940 B

69ms
61ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=3047&dpuuid=5546EF1A4279E2&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v045-0387e234d.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: NLKaoIJtSwU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
Date: Thu, 09 Mar 2023 12:30:20 GMT
Strict-Transport-Security: max-age=86400
Server: prod-xre-app32.ash11
Location: https://dpm.demdex.net/ibs:dpid=3047&dpuuid=5546EF1A4279E2&gdpr=0&gdpr_consent=
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Expires: Thu, 09 Mar 2023 12:30:20 GMT

GET
H/1.1

200
OK

ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719 Show response
dpm.demdex.net/ Frame FFB5
Redirect Chain

https://dpm.demdex.net/ibs:dpid=903&dpuuid=089b7f68-6875-4ed6-bb28-867f03c98929&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719

42 B
940 B

68ms
62ms

Document
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719

Requested by

Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://match.adsrvr.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Content-Type: image/gif
DCS: dcs-prod-va6-2-v045-0acaa16aa.edge-va6.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: A0uV/w+dSIg=
content-encoding: gzip

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 189
content-type: text/html
date: Thu, 09 Mar 2023 12:30:20 GMT
location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame E992
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=089b7f68-6875-4ed6-bb28-867f03c98929
https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=PbJqmrhr&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=089b7f68-6875-4ed6-bb28-867f03c98929
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=1f6f2df4-ea79-431d-9432-37f5fe6d0719

0
0

58ms
58ms

Document
text/plain

3.232.140.34
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=1f6f2df4-ea79-431d-9432-37f5fe6d0719
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.232.140.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-140-34.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Referer: https://match.adsrvr.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, no-cache, no-store
date: Thu, 09 Mar 2023 12:30:20 GMT
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-request-time: D=20 t=1678365020
x-served-by: beacon-n018-ash-prod.krxd.net

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 227
content-type: text/html
date: Thu, 09 Mar 2023 12:30:20 GMT
location: https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=1f6f2df4-ea79-431d-9432-37f5fe6d0719
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200
OK

tap.php Show response
pixel.rubiconproject.com/ Frame 00F5
Redirect Chain

https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=089b7f68-6875-4ed6-bb28-867f03c98929&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&expires=30

42 B
753 B

64ms
62ms

Document
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://match.adsrvr.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Content-Type: image/gif
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache
X-RPHost: 7d24643e640b7b50906469aa87bfb2ce
content-length: 42

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 289
content-type: text/html
date: Thu, 09 Mar 2023 12:30:20 GMT
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&expires=30
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
78 B 269ms
88ms Image
image/gif 76.13.32.146
YAHOO-BF1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2009%20Mar%202023%2012%3A30%3A20%20GMT&n=0&b=Philadelphia%20Marriott%20Downtown&.yp=405909&f=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&enc=UTF-8&yv=1.13.0&hsr=&et=custom&ea=ViewProduct&cc=&cio=%7C&cid=&tagmgr=gtm%2Cadobe

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.13.32.146 Lockport, United States, ASN26101 (YAHOO-BF1, US),

Reverse DNS

spdc.pbp.vip.bf1.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Thu, 09 Mar 2023 12:30:20 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
633 B 267ms
87ms Image
image/gif 76.13.32.146
YAHOO-BF1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&b=Philadelphia%20Marriott%20Downtown&.yp=405909&f=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&enc=UTF-8&yv=1.13.0&tagmgr=gtm%2Cadobe

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.13.32.146 Lockport, United States, ASN26101 (YAHOO-BF1, US),

Reverse DNS

spdc.pbp.vip.bf1.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Thu, 09 Mar 2023 12:30:20 GMT

GET match.gif
match.rundsp.com/ Frame 8890 0
0

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 209ms
64ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=836072006419889&ev=PageView&dl=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&rl=&if=false&ts=1678365020185&cd[brand]=brand&cd[level]=&cd[signin]=&cd[language]=&sw=1600&sh=1200&v=2.9.98&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1678365020181.631412972&it=1678365019789&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 09 Mar 2023 12:30:20 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H/1.1 200
OK mc-phldt-ballroom-balcony-78469-13200_Classi.jpg
ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/dashboard_hotel/ 365 KB
366 KB 117ms
116ms Image
image/jpeg 52.216.138.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/dashboard_hotel/mc-phldt-ballroom-balcony-78469-13200_Classi.jpg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.138.139 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: bb3df861d6798d717f419b53bef75022292a2f43e9bcc840f2259c78d4814334

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Thu, 09 Mar 2023 12:30:21 GMT
x-amz-version-id: 6HJITu1DgMRgnXs3F8jm84x8ixpuG7F1
Last-Modified: Fri, 09 Sep 2022 17:44:18 GMT
Server: AmazonS3
x-amz-request-id: 61FA8PB3TYAZ0Y44
ETag: "aa4077dba13a536fefa156c2c04938f9"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 373890
x-amz-id-2: O4o+7li7CsVR4kMm+xBDelQoU9HShz8UxofXRkKhRQF3lbdk8eTNH9ll36O7ayrjMVoaVHi+L10=

GET
H/1.1 200
OK A_La_Carte.jpg
ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/ 675 KB
675 KB 147ms
145ms Image
image/jpeg 52.216.138.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/A_La_Carte.jpg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.138.139 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: a42111e2579acfa0b5baa4bd866747ebb90ba18a41cee2000985acdbc1364fbb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Thu, 09 Mar 2023 12:30:21 GMT
x-amz-version-id: 1LGcG7RFrv_JnWam1EkX3JxZzsLTaw0K
Last-Modified: Thu, 02 Mar 2023 22:18:50 GMT
Server: AmazonS3
x-amz-request-id: 61F9XP177M2QTJTA
ETag: "c37568a7e8f25451dc84d10bb3d1ef74"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 691179
x-amz-id-2: 6BdYLIkXl4v76jmwzB9Y4QNghKuU9wj57UyVg3ERoib3YDc6QCjdJsk/7Mk9ykyjzzLGwfZIjZo=

GET
H/1.1 200
OK 3164017f-fcd1-4cdd-baac-60b2f8d617c6.png
ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/service_image/ 83 KB
84 KB 262ms
140ms Image
image/png 52.216.138.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/service_image/3164017f-fcd1-4cdd-baac-60b2f8d617c6.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.138.139 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 308eaa6c612a8d6657217de21428f19ce407d47406bb6764dec990fc42f20f27

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Thu, 09 Mar 2023 12:30:21 GMT
x-amz-version-id: TvG6ZNyGsZxQ0tLauB96MutLBNFsctbE
Last-Modified: Thu, 23 Feb 2023 20:17:00 GMT
Server: AmazonS3
x-amz-request-id: 61FC1JRJGAQK9Y7A
ETag: "51cef24f25ed080200c1313b18e94d2d"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 85115
x-amz-id-2: CE0gY8JIQ7zxC8BIFzV69OWAOAMa6eZLaIumgRm12tfZyDvznlPF/CJcQQiTQ5HbAttLcqS6ErM=

GET
H/1.1 200
OK 13_booth_disco_lights.jpg
ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/ 34 KB
35 KB 225ms
91ms Image
image/jpeg 52.216.138.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/13_booth_disco_lights.jpg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.138.139 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 23caff0a92b86c526d5b2f5b07c9eace7877de3917ac56b31b892c9536db6576

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Thu, 09 Mar 2023 12:30:21 GMT
x-amz-version-id: aalJL7f08cj6wCdD_.WCnuVyFALkvdQe
Last-Modified: Fri, 24 Feb 2023 17:27:37 GMT
Server: AmazonS3
x-amz-request-id: 61F8TKG2SK9PGQ10
ETag: "d62215af9207702142c6338fdb7d6743"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 35270
x-amz-id-2: FPhzBjxzCMKFDwVs9aCJVPLaF4t2fPKJZrGjMrK31peqiny3RtOv2Wh6t+D20TskNVzxgN0w09U=

GET
H/1.1 200
OK Screenshot_2022-08-16_143913.png
ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/menu/ 176 KB
176 KB 246ms
134ms Image
image/png 52.216.138.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/menu/Screenshot_2022-08-16_143913.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.138.139 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: a67795899cdbdffbb966a975963dbbc9413501bfc465d92fa82bf506de430617

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Thu, 09 Mar 2023 12:30:21 GMT
x-amz-version-id: 8dyAuAnlhnlU2PTg.tKtWJuF9_qYZSfP
Last-Modified: Tue, 16 Aug 2022 18:39:53 GMT
Server: AmazonS3
x-amz-request-id: 61F6570WSHG7WK0N
ETag: "f9cdcbef27dcff320dbb4b297839ca50"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 179792
x-amz-id-2: /FjFXpTWJq4sbMjwTp54lNfyQGLqym0DNxH77FrObJev7VD/PhFBPT94nupC/3kpuLO4CEMTP8U=

GET
H/1.1 200
OK a837f409-458e-46b7-80dd-39db5f017edf.png
ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/service_image/ 119 KB
120 KB 249ms
124ms Image
image/png 52.216.138.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ipoolside-media.s3.amazonaws.com/site/philadelphiamarriottdowntown/images/service_image/a837f409-458e-46b7-80dd-39db5f017edf.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.138.139 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 37e61204a0b2fc3ac7da4dd919df8f5bbf99dffa1417aab3a1c175e0e39a0c6a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://philadelphiamarriottdowntown.idaypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Thu, 09 Mar 2023 12:30:21 GMT
x-amz-version-id: Wzy1PExORAghzt1xOA_A3R5nzfcZcBkZ
Last-Modified: Fri, 09 Sep 2022 18:12:28 GMT
Server: AmazonS3
x-amz-request-id: 61FDXSKBJD980D5W
ETag: "42b773f96bbe8456cf1db215f201c192"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 122228
x-amz-id-2: WXOCX/h3TXjxAY1QNFTdkCab6qWA+ZQvWBF2immLi+zIrP543CGjHDukO1Fi9qlO2nPZ1a2eVIc=

GET
H2 200 562987601d52e1b1fe6e.otf
philadelphiamarriottdowntown.idaypass.com/css/assets/ 59 KB
60 KB 62ms
61ms Font
application/octet-stream 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/assets/562987601d52e1b1fe6e.otf

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

f77901460c4fe09d055e1f32a52d72b19b5eac2d387addc04082759d3055aba4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019
Origin: https://philadelphiamarriottdowntown.idaypass.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Wed, 23 Feb 2022 08:04:50 GMT
server: nginx/1.20.2
etag: "6215eaa2-ed74"
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
accept-ranges: bytes
content-length: 60788
x-xss-protection: 1; mode=block

GET
H2 200 b42e29973ef7383df154.otf
philadelphiamarriottdowntown.idaypass.com/css/assets/ 59 KB
59 KB 62ms
62ms Font
application/octet-stream 54.172.5.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://philadelphiamarriottdowntown.idaypass.com/css/assets/b42e29973ef7383df154.otf

Requested by

Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.5.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-5-148.compute-1.amazonaws.com

Software

nginx/1.20.2 /

Resource Hash

fcbc99707e87bf66b6378ee39c89bcaea9dabf4f18472f5816d402b06c3b4865

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://philadelphiamarriottdowntown.idaypass.com/css/vendor.css?v=1678101019
Origin: https://philadelphiamarriottdowntown.idaypass.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
last-modified: Wed, 23 Feb 2022 08:04:50 GMT
server: nginx/1.20.2
etag: "6215eaa2-eadc"
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
accept-ranges: bytes
content-length: 60124
x-xss-protection: 1; mode=block

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 67ms
67ms Script
text/javascript 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-203334133-1&l=dataLayerB&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 09 Mar 2023 10:47:24 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 6176
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Thu, 09 Mar 2023 12:47:24 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame AD80 30 KB
13 KB 74ms
74ms Script
application/javascript 108.138.113.246
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: tr.snapchat.com
URL: https://tr.snapchat.com/cm/i?pid=fbf5aa06-3f82-45b5-86ba-4c4fe9c75a96&u_scsid=f3953abd-b8e7-4f3c-9b01-43886e4bc19f&u_sclid=e6b44b73-ee5d-4fd3-9701-fafba149f9f3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.113.246 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-113-246.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 47f33d5a14c3605b73594a767736041df110457fcf1bb09322620fb8e537e8c6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tr.snapchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 07:13:02 GMT
content-encoding: gzip
via: 1.1 ed8dbde89917eaa6ca93ba7fad809c48.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: JFK50-P3
age: 19038
etag: f4d067c8635448ef8b9c0316e8cd77da
x-cache: Hit from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=86400, max-age=600
access-control-allow-headers: Content-Type
content-length: 13297
x-amz-cf-id: kFtnJ6KRgg0QE7Ymxa2i0ntV1CMbrmWPKAa07Y-CVs_FhViUhj90qQ==

GET
H2 200 ct.html Show response
ct.pinterest.com/ Frame 2729 565 B
591 B 90ms
82ms Document
text/html 173.223.56.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/ct.html

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.8b1025ba.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

173.223.56.237 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a173-223-56-237.deploy.static.akamaitechnologies.com

Software

Resource Hash

f83b1a3ea61ad62e47fad82de5495a2547e2f12e591ad8108050538c566ae1e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

akamai-grn: 0.9c912f17.1678365020.3d7ba75c
cache-control: max-age=86400
content-encoding: gzip
content-length: 323
content-type: text/html; charset=utf-8
date: Thu, 09 Mar 2023 12:30:20 GMT
referrer-policy: origin
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
vary: Accept-Encoding
x-cdn: akamai
x-envoy-upstream-service-time: 1
x-pinterest-rid: 1830648204956695

GET
H2 200 en.json Show response
cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/consent/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test/54b25d98-3111-4bb0-813b-8594b0ad9115/ 165 KB
166 KB 91ms
91ms Fetch
application/json 173.223.56.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/consent/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test/54b25d98-3111-4bb0-813b-8594b0ad9115/en.json
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.96 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-96.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c7a5ac7699a044df2a6cb702caf1616b7fafe5dee0dcfb9448c21b46a6373034

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
last-modified: Thu, 10 Nov 2022 20:04:49 GMT
server: AkamaiNetStorage
etag: "b58b15cb2700bf67606f461bde78e511:1668110689.500815"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=64210
accept-ranges: bytes
content-length: 168616
expires: Fri, 10 Mar 2023 06:20:30 GMT

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
577 B 110ms
105ms Image
image/gif 173.223.56.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?event=custom&ed=%7B%22value%22%3A334%2C%22currency%22%3A%22USD%22%7D&tid=2613977086519&cb=1678365020242&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%228b1025ba%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

173.223.56.237 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a173-223-56-237.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.9c912f17.1678365020.3d7ba6fd
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 3
content-length: 35
x-pinterest-rid: 1084655062234112
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
579 B 95ms
90ms Image
image/gif 173.223.56.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?event=pagevisit&tid=2613977086519&cb=1678365020243&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%228b1025ba%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

173.223.56.237 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a173-223-56-237.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.9c912f17.1678365020.3d7ba6fe
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 6
content-length: 35
x-pinterest-rid: 4706966106015402
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/14242/ Frame 7C43 2 KB
2 KB 295ms
151ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/14242/?random=1678365020247&cv=11&fst=1678365020247&bg=ffffff&guid=ON&async=1&gtm=45be3360&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=2&url=https%3A%2F%2Fstatic.sojern.com%2Fmarriott%2Fmhotels.html%3Fp%3Dundefined%26hprid%3DPHLDT%26hpr%3D%26hb%3Dundefined%26hc1%3Dundefined%26hn1%3Dundefined%26hs1%3Dundefined%26ffl%3Dundefined%26hl%3D%26t%3Dundefined%26hr%3Dundefined%26hd1%3D%26hd2%3D%26hconfno%3D%26hp%3Dundefined%26hcu%3D%26hrp%3Dundefined%26hdc%3Dundefined%26rew%3Dundefined%26l%3Dundefined%26vid%3Dhot%26cid%3D&tiba=Marriott%20Hotels&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-14242

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7c349ff895278bb10cdd216171f50a25c1bb394685aafc08f2ea4a7d0d0754f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1291
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=19360&dpuuid=
dpm.demdex.net/ibs:dpid=19360&dpuuid=53472836386418391462706228391764105139&expiration=1678451420&nuid=53472836386418391462706228391764105139&rurl=https://dpm.demdex.net/ Frame 8890
Redirect Chain

https://adobe-sync.dotomi.com/match/bounce/current?networkId=85983&version=1&nuid=53472836386418391462706228391764105139&rurl=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D19360%26dpuuid%3D
https://dpm.demdex.net/ibs:dpid=19360&dpuuid=53472836386418391462706228391764105139&expiration=1678451420&nuid=53472836386418391462706228391764105139&rurl=https://dpm.demdex.net/ibs:dpid=19360&...

42 B
958 B

114ms
60ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=19360&dpuuid=53472836386418391462706228391764105139&expiration=1678451420&nuid=53472836386418391462706228391764105139&rurl=https://dpm.demdex.net/ibs:dpid=19360&dpuuid=

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v045-0337ed64f.edge-va6.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: cyNTJg5wQuE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
X-Error: 104,300
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://dpm.demdex.net/ibs:dpid=19360&dpuuid=53472836386418391462706228391764105139&expiration=1678451420&nuid=53472836386418391462706228391764105139&rurl=https://dpm.demdex.net/ibs:dpid=19360&dpuuid=
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

p Show response
tr.snapchat.com/cm/ Frame A68D
Redirect Chain

https://tr.snapchat.com/cm/s?bt=7f8130e5&pnid=140&cb=1678365020323&u_scsid=f3cbe5b1-63ed-4695-9205-e7e220b076ec&u_sclid=ae8c0aea-48a7-427c-a232-dcfcfbffc212
https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1678275092222%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1678275092222%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D
https://tr.snapchat.com/cm/p?rand=1678275092222&pnid=140&pcid=93243148-d45e-4538-a136-0a1d6f9ef8b2

0
18 B

106ms
105ms

Document
text/html

35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/p?rand=1678275092222&pnid=140&pcid=93243148-d45e-4538-a136-0a1d6f9ef8b2

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains

Request headers

Referer: https://tr.snapchat.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-transform
content-length: 0
content-type: text/html
date: Thu, 09 Mar 2023 12:30:20 GMT
server: API Gateway
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
x-envoy-upstream-service-time: 13

Redirect headers

accept-ch: Sec-CH-UA Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-WoW64
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 09 Mar 2023 12:30:20 GMT
location: https://tr.snapchat.com/cm/p?rand=1678275092222&pnid=140&pcid=93243148-d45e-4538-a136-0a1d6f9ef8b2
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
strict-transport-security: max-age=31536000
via: 1.1 google

GET
H/1.1

200
OK

ibs:dpid=22054
dpm.demdex.net/ Frame 8890
Redirect Chain

https://a.tribalfusion.com/i.match?p=b13&u=53472836386418391462706228391764105139&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$
https://s.tribalfusion.com/z/i.match?p=b13&u=53472836386418391462706228391764105139&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$
https://dpm.demdex.net/ibs:dpid=22054

42 B
954 B

61ms
60ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22054

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v045-0e8028980.edge-va6.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: /Lq6Rk6sQiw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
X-Error: 300
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 227
content-type: text/html
location: https://dpm.demdex.net/ibs:dpid=22054
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7a535423ebf92260-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ps
tag.yieldoptimizer.com/ps/ Frame 8890
Redirect Chain

https://tag.yieldoptimizer.com/ps/ps?t=i&p=2233
https://tag.yieldoptimizer.com/ps/ps?tc=346868833&t=i&p=2233

43 B
681 B

49ms
47ms

Image
image/gif

35.190.52.204
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tag.yieldoptimizer.com/ps/ps?tc=346868833&t=i&p=2233
Protocol: H2
Server: 35.190.52.204 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 204.52.190.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NON DSP COR TAIo PSAo PSDo HISo OUR BUS UNI INT DEM OTC"
content-type: image/gif
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NON DSP COR TAIo PSAo PSDo HISo OUR BUS UNI INT DEM OTC"
location: https://tag.yieldoptimizer.com/ps/ps?tc=346868833&t=i&p=2233
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 otFloatingRounded.json Show response
cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/6.26.0/assets/ 10 KB
11 KB 87ms
87ms Fetch
application/json 173.223.56.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/6.26.0/assets/otFloatingRounded.json
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.96 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-96.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 777ab0cb5c6ffd6b2d455918b8df70fdb4c74ecb18d62f54be1afdaf3733c10d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
last-modified: Mon, 06 Jun 2022 19:39:39 GMT
server: AkamaiNetStorage
etag: "becf963d0b2b5f4544a5ec243252794c:1654544379.603934"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=143051
accept-ranges: bytes
content-length: 9894
expires: Sat, 11 Mar 2023 04:14:31 GMT

GET
H2 200 otPcTab.json Show response
cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/6.26.0/assets/v2/ 47 KB
48 KB 112ms
112ms Fetch
application/json 173.223.56.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/6.26.0/assets/v2/otPcTab.json
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.96 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-96.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4efca4768dedb757f956b51f3620d1521be4e8f065080515489defc83c2de704

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
last-modified: Mon, 06 Jun 2022 19:40:07 GMT
server: AkamaiNetStorage
etag: "398ef3d808c735374c8e1b4d3984d51a:1654544407.4634"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=124519
accept-ranges: bytes
content-length: 47745
expires: Fri, 10 Mar 2023 23:05:39 GMT

GET
H2 200 otCommonStyles.css Show response
cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/6.26.0/assets/ 20 KB
4 KB 117ms
117ms Fetch
text/css 173.223.56.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/R1.3/oneTrust_test/scripttemplates/6.26.0/assets/otCommonStyles.css
Requested by: Host: philadelphiamarriottdowntown.idaypass.com
URL: https://philadelphiamarriottdowntown.idaypass.com/js/main.js?v=1678101019
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.223.56.96 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a173-223-56-96.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:20 GMT
content-encoding: gzip
last-modified: Mon, 06 Jun 2022 19:39:39 GMT
server: AkamaiNetStorage
etag: "61ee8e79970dcae1685a883b098b34d0:1654544379.290447"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=1084080
accept-ranges: bytes
content-length: 4130
expires: Wed, 22 Mar 2023 01:38:20 GMT

GET
H2

200

ps
tag.yieldoptimizer.com/ps/
Redirect Chain

https://tag.yieldoptimizer.com/ps/ps?t=s&p=1057&si=US&ln=EN&hbc=HRS&pg=hm
https://tag.yieldoptimizer.com/ps/ps?tc=825420459&t=s&p=1057&si=US&ln=EN&hbc=HRS&pg=hm

2 B
657 B

48ms
46ms

Image
text/javascript

35.190.52.204
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tag.yieldoptimizer.com/ps/ps?tc=825420459&t=s&p=1057&si=US&ln=EN&hbc=HRS&pg=hm
Protocol: H2
Server: 35.190.52.204 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 204.52.190.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NON DSP COR TAIo PSAo PSDo HISo OUR BUS UNI INT DEM OTC"
content-type: text/javascript;charset=ISO-8859-1
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NON DSP COR TAIo PSAo PSDo HISo OUR BUS UNI INT DEM OTC"
location: https://tag.yieldoptimizer.com/ps/ps?tc=825420459&t=s&p=1057&si=US&ln=EN&hbc=HRS&pg=hm
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/14242/ Frame 7C43 42 B
455 B 328ms
86ms Image
image/gif 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/14242/?random=1678365020247&cv=11&fst=1678363200000&bg=ffffff&guid=ON&async=1&gtm=45be3360&u_w=1600&u_h=1200&frm=2&url=https%3A%2F%2Fstatic.sojern.com%2Fmarriott%2Fmhotels.html%3Fp%3Dundefined%26hprid%3DPHLDT%26hpr%3D%26hb%3Dundefined%26hc1%3Dundefined%26hn1%3Dundefined%26hs1%3Dundefined%26ffl%3Dundefined%26hl%3D%26t%3Dundefined%26hr%3Dundefined%26hd1%3D%26hd2%3D%26hconfno%3D%26hp%3Dundefined%26hcu%3D%26hrp%3Dundefined%26hdc%3Dundefined%26rew%3Dundefined%26l%3Dundefined%26vid%3Dhot%26cid%3D&tiba=Marriott%20Hotels&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4225902049&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=28645&dpuuid=xo2PwyMHQqg9y_uOzmdbhSw3MsI3AgJe&gdpr=0&gdpr_consent=
dpm.demdex.net/ Frame 8890
Redirect Chain

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://gum.criteo.com/sync?s=1&c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=xo2PwyMHQqg9y_uOzmdbhSw3MsI3AgJe&gdpr=0&gdpr_consent=

42 B
940 B

67ms
62ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=28645&dpuuid=xo2PwyMHQqg9y_uOzmdbhSw3MsI3AgJe&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v045-0e4dc08fb.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 1pbGbrOnTu4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=28645&dpuuid=xo2PwyMHQqg9y_uOzmdbhSw3MsI3AgJe&gdpr=0&gdpr_consent=
date: Thu, 09 Mar 2023 12:30:20 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 2164193
content-length: 0

GET
H2

200

ps
tag.yieldoptimizer.com/ps/
Redirect Chain

https://tag.yieldoptimizer.com/ps/ps?t=s&p=1057&mhcy=&mhcr=&mhcd=PHLDT&mhst=&mhnm=
https://tag.yieldoptimizer.com/ps/ps?tc=278929640&t=s&p=1057&mhcy=&mhcr=&mhcd=PHLDT&mhst=&mhnm=

539 B
539 B

50ms
49ms

Image
text/javascript

35.190.52.204
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tag.yieldoptimizer.com/ps/ps?tc=278929640&t=s&p=1057&mhcy=&mhcr=&mhcd=PHLDT&mhst=&mhnm=
Protocol: H2
Server: 35.190.52.204 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 204.52.190.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NON DSP COR TAIo PSAo PSDo HISo OUR BUS UNI INT DEM OTC"
content-type: text/javascript;charset=ISO-8859-1
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 539
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:19 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NON DSP COR TAIo PSAo PSDo HISo OUR BUS UNI INT DEM OTC"
location: https://tag.yieldoptimizer.com/ps/ps?tc=278929640&t=s&p=1057&mhcy=&mhcr=&mhcd=PHLDT&mhst=&mhnm=
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=30646
dpm.demdex.net/ Frame 8890
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=53472836386418391462706228391764105139&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-mnHnY0NE2pFzzI2lcdV_bmSCNMXuAI0.Okc-~A

42 B
940 B

63ms
62ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-mnHnY0NE2pFzzI2lcdV_bmSCNMXuAI0.Okc-~A

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v045-0a23de457.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: SEHilYlQQO0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Thu, 09 Mar 2023 12:30:20 GMT
strict-transport-security: max-age=31536000
via: http/1.1 spdc0110.pbp.bf1.yahoo.com (ApacheTrafficServer)
server: ATS
age: 0
content-type: text/html;charset=utf-8
location: https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-mnHnY0NE2pFzzI2lcdV_bmSCNMXuAI0.Okc-~A
content-length: 0

GET
H/1.1

200
OK

ibs:dpid=30862&dpuuid=10594155177346297703
dpm.demdex.net/ Frame 8890
Redirect Chain

https://odr.mookie1.com/t/v2?tagid=V2_676804&src.visitorId=53472836386418391462706228391764105139&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=30862&dpuuid=10594155177346297703

42 B
940 B

62ms
61ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30862&dpuuid=10594155177346297703

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v045-0bcecd103.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: pHubSdTATD0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:20 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://dpm.demdex.net/ibs:dpid=30862&dpuuid=10594155177346297703
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=80742&dpuuid=08dd91e4-fd29-49da-b35e-20ab11825d8d
dpm.demdex.net/ Frame 8890
Redirect Chain

https://ag.innovid.com/dv/sync?tid=6
https://dpm.demdex.net/ibs:dpid=80742&dpuuid=08dd91e4-fd29-49da-b35e-20ab11825d8d

42 B
940 B

64ms
61ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=80742&dpuuid=08dd91e4-fd29-49da-b35e-20ab11825d8d

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v045-06bad60d6.edge-va6.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: OPBiM/94Qwc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=80742&dpuuid=08dd91e4-fd29-49da-b35e-20ab11825d8d
date: Thu, 09 Mar 2023 12:30:21 GMT
content-length: 0
request-time: 0

GET
H2 404 usync.php
pxl.jivox.com/tags/sync/ Frame 8890 0
0 59ms
58ms Image
text/html 3.209.227.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pxl.jivox.com/tags/sync/usync.php?px=IkovJ4aN
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.227.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-227-78.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

POST
H3 200 error
tr.snapchat.com/log/ Frame AD80 0
16 B 97ms
95ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/log/error

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://tr.snapchat.com/cm/i?pid=fbf5aa06-3f82-45b5-86ba-4c4fe9c75a96&u_scsid=f3953abd-b8e7-4f3c-9b01-43886e4bc19f&u_sclid=e6b44b73-ee5d-4fd3-9701-fafba149f9f3
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 09 Mar 2023 12:30:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
access-control-allow-origin: https://tr.snapchat.com
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43", h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1

200
OK

ibs:dpid=66757
dpm.demdex.net/ Frame 8890
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=adobe&id=53472836386418391462706228391764105139
https://dpm.demdex.net/ibs:dpid=66757?id=53472836386418391462706228391764105139&dpuuid=PbJqmrhr

42 B
940 B

63ms
61ms

Image
image/gif

44.213.4.79
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=66757?id=53472836386418391462706228391764105139&dpuuid=PbJqmrhr

Protocol

HTTP/1.1

Server

44.213.4.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-213-4-79.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v045-0ccd11707.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: fMxrreczThE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: //dpm.demdex.net/ibs:dpid=66757?id=53472836386418391462706228391764105139&dpuuid=PbJqmrhr
date: Thu, 09 Mar 2023 12:30:21 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a006-ash-prod.krxd.net

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8890
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkFuUldnQUFBQ0VlSndOLQ==

170 B
188 B

86ms
83ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkFuUldnQUFBQ0VlSndOLQ==

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-gnv1820032-GNV
pragma: no-cache
date: Thu, 09 Mar 2023 12:30:21 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1678365021.317021,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkFuUldnQUFBQ0VlSndOLQ==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 8890
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZAnRWgAAACEeJwN-&expires=90

42 B
753 B

64ms
64ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZAnRWgAAACEeJwN-&expires=90
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 7d24643e640b7b50906469aa87bfb2ce
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by: cache-gnv1820032-GNV
pragma: no-cache
date: Thu, 09 Mar 2023 12:30:21 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1678365021.333077,VS0,VE0
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZAnRWgAAACEeJwN-&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8890
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZAnRWgAAACEeJwN-
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZAnRWgAAACEeJwN-&C=1

43 B
766 B

67ms
66ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZAnRWgAAACEeJwN-&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 09 Mar 2023 12:30:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 09 Mar 2023 12:30:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=88&external_user_id=ZAnRWgAAACEeJwN-&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8890
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=ZAnRWgAAACEeJwN-

43 B
1 KB

71ms
71ms

Image
image/gif

68.67.178.10
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=158&code=ZAnRWgAAACEeJwN-

Protocol

HTTP/1.1

Server

68.67.178.10 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 09 Mar 2023 12:30:21 GMT
AN-X-Request-Uuid: da22b4f4-92c9-4a55-8f01-79433ebdf7e6
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 38.132.118.68; 38.132.118.68; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

x-served-by: cache-gnv1820032-GNV
pragma: no-cache
date: Thu, 09 Mar 2023 12:30:21 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1678365022.534832,VS0,VE0
x-cache: HIT
location: https://ib.adnxs.com/setuid?entity=158&code=ZAnRWgAAACEeJwN-
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 8890
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZAnRWgAAACEeJwN-
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=ZAnRWgAAACEeJwN-

43 B
180 B

49ms
47ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=ZAnRWgAAACEeJwN-
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 09 Mar 2023 12:30:21 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=ZAnRWgAAACEeJwN-
date: Thu, 09 Mar 2023 12:30:21 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H2 200 /
www.facebook.com/tr/ 0
54 B 66ms
65ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=836072006419889&ev=Microdata&dl=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&rl=&if=false&ts=1678365021696&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Philadelphia%20Marriott%20Downtown%22%2C%22meta%3Adescription%22%3A%22Real-time%20inventory%20management%20and%20booking%20software%20by%20RealTime%20Reservation%20LLC.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.98&r=stable&ec=1&o=30&fbp=fb.1.1678365020181.631412972&it=1678365019789&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 09 Mar 2023 12:30:21 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 8890
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZAnRWgAAACEeJwN-

1 B
451 B

183ms
58ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZAnRWgAAACEeJwN-
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Thu, 09 Mar 2023 12:30:21 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

x-served-by: cache-gnv1820032-GNV
pragma: no-cache
date: Thu, 09 Mar 2023 12:30:21 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1678365022.737550,VS0,VE0
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZAnRWgAAACEeJwN-
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

partner
sync.search.spotxchange.com/ Frame 8890
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZAnRWgAAACEeJwN-&img=1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZAnRWgAAACEeJwN-&img=1&__user_check__=1&sync_id=28e9d15c-be76-11ed-9274-1b36d7c70503

43 B
419 B

80ms
79ms

Image
image/gif

192.35.249.138
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZAnRWgAAACEeJwN-&img=1&__user_check__=1&sync_id=28e9d15c-be76-11ed-9274-1b36d7c70503
Protocol: H2
Server: 192.35.249.138 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:22 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 331
content-length: 43

Redirect headers

date: Thu, 09 Mar 2023 12:30:22 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
location: /partner?adv_id=6409&uid=ZAnRWgAAACEeJwN-&img=1&__user_check__=1&sync_id=28e9d15c-be76-11ed-9274-1b36d7c70503
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 53
content-length: 0

GET
H3

200

b.php
www.facebook.com/fr/ Frame 8890
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZAnRWgAAACEeJwN-&t=2592000&o=0

43 B
74 B

85ms
84ms

Image
image/gif

2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZAnRWgAAACEeJwN-&t=2592000&o=0

Protocol

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 04:30:22 PST
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
pragma: public
x-fb-debug: 9+I5z43VyL5L2iOmkWH5vN+tBYJlT7hCajbpl55+Csxh0Jn/Zqrzar4RkKborbEkQ607cwL3+AoOWk36lG916Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: image/gif
origin-agent-cluster: ?0
cache-control: public, max-age=0
priority: u=3,i
expires: Thu, 09 Mar 2023 04:30:22 PST

Redirect headers

x-served-by: cache-gnv1820032-GNV
pragma: no-cache
date: Thu, 09 Mar 2023 12:30:21 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1678365022.947832,VS0,VE0
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZAnRWgAAACEeJwN-&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

s.gif
cm.ipinyou.com/xcms/aam/ Frame 8890
Redirect Chain

https://cm.ipinyou.com/xcmr/aam/r.gif
https://dpm.demdex.net/ibs:dpid=134084&dpuuid=N39KUN6Kcrif&redir=http%3A%2F%2Fcm.ipinyou.com%2Fxcms%2Faam%2Fs.gif%3Ftid%3D$%7BDD_UUID%7D
https://cm.ipinyou.com/xcms/aam/s.gif?tid=53472836386418391462706228391764105139

43 B
485 B

251ms
250ms

Image
image/gif

152.136.187.208
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.ipinyou.com/xcms/aam/s.gif?tid=53472836386418391462706228391764105139
Protocol: HTTP/1.1
Server: 152.136.187.208 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx/1.21.6 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 09 Mar 2023 12:30:23 GMT
Server: nginx/1.21.6
Transfer-Encoding: chunked
Content-Type: image/gif
P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRE LOC"
Cache-Control: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

DCS: dcs-prod-va6-1-v045-0471b3fc1.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: BIGJwWXLQcs=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://cm.ipinyou.com/xcms/aam/s.gif?tid=53472836386418391462706228391764105139
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 RC5f6ce8aca7344b4f8959f212ee5399a8-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/ 390 B
504 B 72ms
71ms Script
application/x-javascript 2600:141b:9000:499::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/354c222a3cc1/RC5f6ce8aca7344b4f8959f212ee5399a8-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000:499::1e80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 10f2ceb0dd2fd66c48c3a6e8101c154df71cb0fb04768c74ccc7b9490b4e1de9

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Thu, 09 Mar 2023 12:30:28 GMT
content-encoding: gzip
last-modified: Fri, 03 Mar 2023 14:43:51 GMT
server: AkamaiNetStorage
etag: "4e3df737380af3e816f9a6611e1421d3:1677854631.747318"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 258
expires: Thu, 09 Mar 2023 13:30:28 GMT

GET

5386
tags.bluekai.com/site/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=hbq9bjg&ct=0:uti0uav&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=MWY2ZjJkZjQtZWE3OS00MzFkLTk0MzItMzdmNWZlNmQwNzE5&gdpr=0&gdpr_consent=&ttd_tdid=1f6f2df4-ea79-431d-9432-37f5f...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=1f6f2df4-ea79-431d-9432-37f5fe6d0719&google_gid=CAESEOiSk-YaFovV7z5W7yi6zWA&google_cver=1
https://ups.analytics.yahoo.com/ups/55953/sync?uid=1f6f2df4-ea79-431d-9432-37f5fe6d0719&_origin=1&redir=true&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-tBJDbe9E2uLGjEh7lyjjj4C4SWwK_8w-~A&gdpr=0
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=1f6f2df4-ea79-431d-9432-37f5fe6d0719
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=4612952643267094414&ttd_tdid=1f6f2df4-ea79-431d-9432-37f5fe6d0719
https://tags.bluekai.com/site/5386?id=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: match.rundsp.com
URL: https://match.rundsp.com/match.gif?id=53472836386418391462706228391764105139&partner=adobe

Domain: tags.bluekai.com
URL: https://tags.bluekai.com/site/5386?id=1f6f2df4-ea79-431d-9432-37f5fe6d0719&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai

Verdicts & Comments Add Verdict or Comment

102 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

92 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 10:14:11	Name: X-AB Value: f4d067c8635448ef8b9c0316e8cd77da
.demdex.net/	1970-01-20 14:31:57	Name: demdex Value: 53472836386418391462706228391764105139
.idaypass.com/	1970-01-20 10:14:11	Name: _gid Value: GA1.2.789964234.1678365019
.idaypass.com/	1970-01-20 10:12:45	Name: _gat Value: 1
.idaypass.com/	1969-12-31 23:59:59	Name: AMCVS_664516D751E565010A490D4C%40AdobeOrg Value: 1
philadelphiamarriottdowntown.idaypass.com/	1970-01-20 18:56:54	Name: csrftoken Value: KyWP1jjJFRpfrm6qOTClK9iAAJ5INLyv02BnZXTUcBSscQVcIRw3PYCWs0lqiuB8
philadelphiamarriottdowntown.idaypass.com/	1970-01-20 10:13:21	Name: sessionid Value: 4daq0o3vho5gs0weebtzdouv9jb9608p
.idaypass.com/	1970-01-20 10:12:46	Name: s_tbm Value: true
.idaypass.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.everesttech.net/	1970-01-20 18:58:21	Name: everest_g_v2 Value: g_surferid~ZAnRWgAAACEeJwN-
.dpm.demdex.net/	1970-01-20 14:31:57	Name: dpm Value: 53472836386418391462706228391764105139
.idaypass.com/	1970-01-20 19:48:45	Name: AMCV_664516D751E565010A490D4C%40AdobeOrg Value: -1712354808%7CMCIDTS%7C19426%7CMCMID%7C53558387220982011552731689024369351130%7CMCAAMLH-1678969818%7C7%7CMCAAMB-1678969818%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1678372218s%7CNONE%7CMCSYNCSOP%7C411-19433%7CvVersion%7C4.3.0
.idaypass.com/	1970-01-20 10:14:11	Name: _uetsid Value: 2763b8d0be7611ed8792ff69560aeabd
.idaypass.com/	1970-01-20 19:34:21	Name: _uetvid Value: 276403e0be7611eda05739aa069a7199
.adnxs.com/	1970-01-20 12:22:21	Name: uuid2 Value: 4612952643267094414
.rlcdn.com/	1970-01-20 18:58:21	Name: rlas3 Value: BFlDTdwKw3Bsp+pZjPNoCJaHJDB7c3v9MwImkfDnEwk=
.bing.com/	1970-01-20 19:34:21	Name: MUID Value: 3EB710122B1364581B9602DD2A7F65FE
.bat.bing.com/	1970-01-20 10:22:49	Name: MR Value: 0
.jivox.com/	1970-01-20 12:22:21	Name: jvxsync Value: ty0EzXL01hV3
.rlcdn.com/	1970-01-20 11:39:09	Name: pxrc Value: CNuip6AGEgUI6AcQABIGCPHrARAA
.dotomi.com/	1969-12-31 23:59:59	Name: DotomiSession_2814 Value: 2_1678365019588$853706948629161230$693283075$1678365019589
.dotomi.com/	1970-01-20 18:59:47	Name: DotomiSync Value: 0$19425$19425$51472-0#30129-0#41026-0#78835-0#75347-0#41703-0#14200-0#59723-0#
.dotomi.com/	1970-01-20 19:38:40	Name: DotomiUser Value: 853706948629161230$0$693283075$$1
.sojern.com/	1970-01-20 18:58:21	Name: cid Value: 9cf61ecf-999f-1881-072f-c74c7f5e54e3#1678320000000
.idaypass.com/	1969-12-31 23:59:59	Name: _schn Value: _dj5cca
.idaypass.com/	1970-01-20 19:42:31	Name: _scid Value: c49be47e-4d76-4eed-a9be-7ac64ec6fcc1
.idaypass.com/	1969-12-31 23:59:59	Name: _ga_1LXTBF5X2V Value: GS1.1.1678365019.1.0.1678365019.0.0.0
.idaypass.com/	1969-12-31 23:59:59	Name: _ga Value: GA1.1.774386379.1678365019
.idaypass.com/	1970-01-20 10:12:46	Name: _dpm_ses.9aaa Value: *
.idaypass.com/	1970-01-20 18:58:21	Name: _dpm_id.9aaa Value: 5d8bf67a-3723-4cfe-9cfc-4b9aadbb75af.1678365020.1.1678365020.1678365020.486eb5cb-2f1e-40aa-bac8-177649e8d916
.c.bing.com/	1970-01-20 10:22:49	Name: MR Value: 0
.doubleclick.net/	1970-01-20 19:48:45	Name: IDE Value: AHWqTUmk1vGvMRHOp1fTR5tlUr3xapKTSUGmgUh_muZR68ZEGHC_oTtRh_vPyZ7yJOs
.idaypass.com/	1970-01-20 12:22:21	Name: _gcl_au Value: 1.1.700103119.1678365020
.adsrvr.org/	1970-01-20 18:59:47	Name: TDID Value: 1f6f2df4-ea79-431d-9432-37f5fe6d0719
.yahoo.com/	1970-01-20 18:58:42	Name: A3 Value: d=AQABBFvRCWQCEHPgGPhZPNrbjZXlVuaXG9cFEgEBAQEiC2QTZAAAAAAA_eMAAA&S=AQAAAtp0aCF5xXQlWYtqO7PsLE4
.linkedin.com/	1970-01-20 12:22:21	Name: li_sugr Value: bb046910-038a-4cf7-a0da-884a6b811103
.linkedin.com/	1970-01-20 18:58:21	Name: bcookie Value: "v=2&3ea2e067-1725-45f3-8836-2af650ffd0ef"
.linkedin.com/	1970-01-20 10:14:11	Name: lidc Value: "b=VGST02:s=V:r=V:a=V:p=V:g=2837:u=1:x=1:i=1678365019:t=1678451419:v=2:sig=AQG9y4x1GbBmxVCFg8xTVOHlwU-MIAKY"
.contextweb.com/	1970-01-20 18:51:09	Name: V Value: ya5MvuM4F2sR
.contextweb.com/	1970-01-20 18:58:21	Name: pb_rtb_ev Value: 3-1jcv\|2N.0.AQEK2fjzVlPkDwEoU6gCAQEL_wE
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: e06094926fb461b2
.krxd.net/	1970-01-20 14:31:57	Name: _kuid_ Value: PbJqmrhr
.eyeota.net/	1970-01-20 18:59:47	Name: mako_uid Value: 186c659cf48-5f480000010a4e94
.eyeota.net/	1970-01-20 10:12:45	Name: SERVERID Value: 20116~DM
.sojern.com/	1970-01-20 18:58:21	Name: gid Value: CAESEDVasFnV8HKJ1ywEFRN4ww8
.rubiconproject.com/	1970-01-20 18:58:21	Name: khaos Value: LF1375N4-1R-433P
.bluekai.com/	1970-01-20 14:37:42	Name: bku Value: HVG99aFHYVEBvlAj
.bluekai.com/	1970-01-20 14:37:42	Name: bkpa Value: KJy9m9ecd02pSUHknp/l1M9NwtkAwDaHHDL0jZobPZhxS6HlHV2PBZ5exPaaEa2lHuj7jcO0UtBFq7Bkq7x29yebJhne
.analytics.yahoo.com/	1970-01-20 18:58:21	Name: IDSYNC Value: 18yo~2af0
.sojern.com/	1970-01-20 10:55:57	Name: ttdid Value: 1f6f2df4-ea79-431d-9432-37f5fe6d0719
.sojern.com/	1970-01-20 12:22:21	Name: apnid Value: 4612952643267094414
.linkedin.com/	1970-01-20 10:55:57	Name: UserMatchHistory Value: AQKKV1O7oyYmUAAAAYbGWc_BIYcUXKcSHF5gaTOpi5J9PyQz3tYzXSH5xGT-B2Z3yvOsksQviKN1cg
.linkedin.com/	1970-01-20 10:55:57	Name: AnalyticsSyncHistory Value: AQLxfiPOf7U31QAAAYbGWc_Bi1bhzFN7dAdDuiBAl_aZ0_WKbc3EM6ykbnpM8SlcYmExe9wcYpH1V0tlH-odQA
.idaypass.com/	1970-01-20 12:22:21	Name: _fbp Value: fb.1.1678365020181.631412972
.tvpixel.com/	1970-01-20 18:58:21	Name: sp Value: c1e0bfe1-fb06-4cd9-87e7-94d8bd09e746
.philadelphiamarriottdowntown.idaypass.com/	1969-12-31 23:59:59	Name: Value: GA1.3.774386379.1678365019
.philadelphiamarriottdowntown.idaypass.com/	1970-01-20 10:14:11	Name: _gid Value: GA1.3.240083403.1678365020
.philadelphiamarriottdowntown.idaypass.com/	1970-01-20 18:58:21	Name: _pin_unauth Value: dWlkPVpXUTBabUptTWpZdE1USTVOUzAwWXpFMUxXRXpPR0l0T0RRM1ltTTBNelkyWWpObA
.www.linkedin.com/	1970-01-20 18:58:21	Name: bscookie Value: "v=1&20230309123020f34f04a0-bef3-492c-8c0b-4c00256c47f5AQEKekuh5HScQaBEex86WXCD0cGTU4bO"
.ct.pinterest.com/	1970-01-20 18:58:21	Name: _pinterest_ct_ua Value: "TWc9PSYyWlQ5WUxLZlVZc3NEaE40a1RlRWQwRTBnLzRjZkFpQ1M2ZSs1NzdnYURuU05nSy9UUEJiRUhPTlBhNHNUclg4R0U3czQ1eGZrZDEwd2FGL05ZeTg0ZFI2YTEvTlBLbWxtVUhlcnlWR2k5dz0mSWRqSU5jMDlhTDdsVmNuSnV4WlBDQTl5aFhVPQ=="
.flashtalking.com/	1970-01-20 19:48:45	Name: flashtalkingad1 Value: "GUID=5546EF1A4279E2"
.snapchat.com/	1970-01-20 19:34:21	Name: sc_at Value: v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOSJwmm4CjFVYfL7ua9OHdXdKpUGMDPlYEN30VYXcU48aXg3OEY4H5yp+BL5jl0AAAAA=
philadelphiamarriottdowntown.idaypass.com/	1970-01-20 10:14:11	Name: ln_or Value: eyIzNjA1NzIiOiJkIn0%3D
.yieldoptimizer.com/	1970-01-20 18:58:21	Name: fbh0 Value: %7B%7D
.yieldoptimizer.com/	1970-01-20 18:58:21	Name: gcma Value: %7B%22t%22%3A0%2C%22o%22%3Afalse%7D
.yieldoptimizer.com/	1970-01-20 18:58:21	Name: rmxc Value: %7B%22t%22%3A0%2C%22e%22%3A%22%22%2C%22i%22%3Afalse%7D
.yieldoptimizer.com/	1970-01-20 18:58:21	Name: cktst Value: 278929640
.tapad.com/	1970-01-20 11:39:09	Name: TapAd_TS Value: 1678365020677
.tapad.com/	1970-01-20 11:39:09	Name: TapAd_DID Value: 93243148-d45e-4538-a136-0a1d6f9ef8b2
philadelphiamarriottdowntown.idaypass.com/	1970-01-20 18:58:21	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Thu+Mar+09+2023+12%3A30%3A20+GMT%2B0000+(GMT)&version=6.26.0&isIABGlobal=false&hosts=&consentId=5414e959-004c-40e9-b073-c86f5dae6eb0&interactionCount=0&landingPath=https%3A%2F%2Fphiladelphiamarriottdowntown.idaypass.com%2F&groups=1%3A1%2C3%3A1%2C4%3A1%2C6%3A1
.yieldoptimizer.com/	1970-01-20 18:58:21	Name: ckid Value: 2028919045900
.yieldoptimizer.com/	1970-01-20 18:58:21	Name: dph Value: %7B%22t%22%3A%5B124332%5D%2C%22dp%22%3A%5B1057%5D%7D
.yieldoptimizer.com/	1970-01-20 18:58:21	Name: ph Value: %7B%22p%22%3A%5B39%2C1032%2C1022%5D%2C%22t%22%3A%5B124332%2C124332%2C124332%5D%7D
.tapad.com/	1970-01-20 11:39:09	Name: TapAd_3WAY_SYNCS Value:
.criteo.com/	1970-01-20 19:34:21	Name: uid Value: 819fdaaa-1d0a-4b4c-b68d-47ff11d9f937
.adsrvr.org/	1970-01-20 18:59:47	Name: TDCPM Value: CAESFgoHcnViaWNvbhILCNjFiceCqdA7EAUSEwoEa3J1eBILCJjZq8qCqdA7EAUYASABKAIyCwiY0a73mKnQOxAFOAFaBGtydXhgAg..
.tribalfusion.com/	1970-01-20 12:22:21	Name: ANON_ID Value: aFnseFrZcAQ9BqEr73ydy5oLEmZcywNE7Aob2cUZaZaTxACXgjjoueYrObrxZcLYDVskXpaPRBeUemKTZcXGeK5yDw
.mookie1.com/	1970-01-20 19:41:33	Name: id Value: 10594155177346297703
.mookie1.com/	1970-01-20 19:41:33	Name: mdata Value: 1\|10594155177346297703\|1678365020929
.mookie1.com/	1970-01-20 19:41:33	Name: ov Value: 1dad4814ed7fae0bc772ab0cac09e324
.innovid.com/	1970-01-20 12:22:21	Name: uuid Value: 08dd91e4-fd29-49da-b35e-20ab11825d8d-20230309 07:30:21
.rubiconproject.com/	1970-01-20 18:58:21	Name: audit Value: 1\|VCdRiJzHXIttgmrXMe3NAS+w/PDGrBpPtFJMEGP2xOqbz16xSA9sXUZU2ZStdEPkGwye9T13YMVCqQ3+tQhlLHMDvubSxZCGhd/seGY0CTTP2GY5oC7cdJ5wvPEQWfVQSbePZj6z0VA78gEF/yHJmvkSvjCs+VRqjvlnmTU9AHQ=
.adnxs.com/	1970-01-20 12:22:21	Name: anj Value: dTM7k!M4.FErk#WF']wIg2GVTpici]!]tcV8i_jAez_UZ18%3#f4W+:JDWmpFDl.iIc-nab<Qy1D%AyD$25A)(rF5kpv7Pm7q1GNs(m%vhLj)fy-*jjgJl
.casalemedia.com/	1970-01-20 18:58:21	Name: CMID Value: ZAnRXW8iCkJg4IgYXfvNRAAA
.casalemedia.com/	1970-01-20 12:22:21	Name: CMPS Value: 1251
.casalemedia.com/	1970-01-20 12:22:21	Name: CMPRO Value: 1251
.openx.net/	1970-01-20 18:58:21	Name: i Value: 71619d19-02d0-4f38-b7fa-ff0ca6f08651\|1678365021
.pubmatic.com/	1970-01-20 12:22:21	Name: KRTBCOOKIE_218 Value: 4056-ZAnRWgAAACEeJwN-&KRTB&22978-ZAnRWgAAACEeJwN-&KRTB&23194-ZAnRWgAAACEeJwN-&KRTB&23209-ZAnRWgAAACEeJwN-
.pubmatic.com/	1970-01-20 10:55:57	Name: PugT Value: 1678365021
.demdex.net/	1970-01-20 14:31:57	Name: dextp Value: 358-1-1678365019283\|477-1-1678365019395\|771-1-1678365019500\|903-1-1678365019655\|1957-1-1678365019793\|3047-1-1678365019920\|13870-1-1678365020156\|19360-1-1678365020280\|22054-1-1678365020382\|22069-1-1678365020483\|28645-1-1678365020590\|30646-1-1678365020698\|30862-1-1678365020802\|80742-1-1678365020907\|96420-1-1678365021008\|66757-1-1678365021109\|144230-1-1678365021210\|144231-1-1678365021311\|144232-1-1678365021412\|144233-1-1678365021513\|144234-1-1678365021615\|144235-1-1678365021716\|144236-1-1678365021817\|144237-1-1678365021918\|134084-1-1678365022019
.spotxchange.com/	1970-01-20 10:53:04	Name: audience Value: 28e9d10c-be76-11ed-9274-1b36d7c70503
.ipinyou.com/	1970-01-20 19:38:40	Name: PYID Value: N39KUN6Kcrif

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://match.rundsp.com/match.gif?id=53472836386418391462706228391764105139&partner=adobe Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://pxl.jivox.com/tags/sync/usync.php?px=IkovJ4aN Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
ad.doubleclick.net
adobe-sync.dotomi.com
adservice.google.com
ag.innovid.com
assets.adobedtm.com
bat.bing.com
beacon.krxd.net
beacon.sojern.com
bh.contextweb.com
c.bing.com
c.tvpixel.com
cache.marriott.com
cdn.linkedin.oribi.io
cm.everesttech.net
cm.g.doubleclick.net
cm.ipinyou.com
cms.analytics.yahoo.com
connect.facebook.net
ct.pinterest.com
dpm.demdex.net
dsum-sec.casalemedia.com
fcmatch.google.com
fcmatch.youtube.com
fonts.googleapis.com
geolocation.onetrust.com
googleads.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
insight.adsrvr.org
ipoolside-media.s3.amazonaws.com
js.adsrvr.org
login-ds.dotomi.com
login.dotomi.com
marriottinternationa.demdex.net
match.adsrvr.org
match.rundsp.com
match.sync.ad.cpe.dotomi.com
o436887.ingest.sentry.io
odr.mookie1.com
p.tvpixel.com
philadelphiamarriottdowntown.idaypass.com
pixel.rubiconproject.com
pixel.sojern.com
pixel.tapad.com
ps.eyeota.net
px.ads.linkedin.com
px4.ads.linkedin.com
pxl.jivox.com
s.pinimg.com
s.tribalfusion.com
s.yimg.com
sc-static.net
secure.adnxs.com
servedby.flashtalking.com
smetrics.marriott.com
snap.licdn.com
sp.analytics.yahoo.com
static.sojern.com
sync-tm.everesttech.net
sync.search.spotxchange.com
tag.yieldoptimizer.com
tags.bluekai.com
tr.snapchat.com
ups.analytics.yahoo.com
us-u.openx.net
usermatch.krxd.net
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.linkedin.com
match.rundsp.com
tags.bluekai.com
107.178.244.119
108.138.113.246
13.107.42.14
142.250.80.38
142.251.40.194
143.204.138.162
15.197.193.217
151.101.2.49
152.136.187.208
173.223.56.237
173.223.56.96
173.223.57.84
18.211.176.57
192.35.249.138
192.40.39.223
198.148.27.139
2001:4998:1c:800::1001
205.180.85.201
2600:141b:5000::17df:9c20
2600:141b:9000:499::1e80
2600:1f16:b8a:8e01:beb1:fd3b:512c:30a3
2600:9000:2245:4a00:2:53b2:240:93a1
2600:9000:24eb:7c00:1d:bf0a:0:93a1
2606:4700:4400::6812:2b9e
2606:4700::6812:18ad
2606:ae80:1451:21::500
2606:ae80:1451:24::760
2607:f8b0:4006:80d::2002
2607:f8b0:4006:80e::200e
2607:f8b0:4006:816::200e
2607:f8b0:4006:817::2008
2607:f8b0:4006:81c::200a
2607:f8b0:4006:81d::2002
2607:f8b0:4006:81e::2004
2607:f8b0:4006:824::200e
2620:100:a001::c
2620:1ec:21::14
2620:1ec:c11::200
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42:46::84
3.209.227.78
3.218.90.66
3.232.140.34
3.232.64.79
34.111.113.62
34.120.195.249
35.190.43.134
35.190.52.204
35.190.60.146
35.190.90.30
35.244.159.8
35.244.188.9
44.209.164.40
44.213.4.79
52.204.87.171
52.216.138.139
52.54.85.170
54.172.5.148
54.243.116.235
63.140.38.104
68.67.178.10
68.67.179.113
76.13.32.146
76.13.32.147
8.28.7.83
8.43.72.98
96.6.31.207
00522809658c0112e5694c29446eb56567d665df9bd80a927c7986caf75448e0
089030d8bec22aa48ae59e27516a4e8a1fcec666e9d783c7a1df47220b750dc1
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b04ebb1dd4ee4bfd9424205b8792f5fcc30708f50d76486aee3585d638ce2d7
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cd179e1ff5d71bebf6e3780452d73e8dfea61b79fcc091d0160fe0a8088ee3c
0dada255807bb7d6ebfec844efcd2042b776e3f5d7d630f9bf492f2e8009a384
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0fca0294cfaf24a4db0852415eee7bcdea7b9766d59e443fb2d5f0c77eb23363
10f2ceb0dd2fd66c48c3a6e8101c154df71cb0fb04768c74ccc7b9490b4e1de9
121337c33e44d79fbd44805f80a6c823c0ecc247dd088608b96c6e8c1c0fca11
1a6622bbfd2f4017f391cae1040e22f99a923116427a0ccb25543581f5d92257
1b729ee93eb192bb7dcf12e76d9ce6216d127637b9f33a8e24726805f26ca047
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
228b1d6634abc2d6314f0591e07c5cd246a7fc071e4c9a592a2bf0e11fe6cd27
23caff0a92b86c526d5b2f5b07c9eace7877de3917ac56b31b892c9536db6576
242e542871bd77c8ff6375418e349ef6b3a32a208e15ca1441166641d212a6a1
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
25339e7f19b8d6c31bc082d646d1914964c99b6b39cd2c6c6cfc6a23dd27332d
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27e8d8dab8a9edc47508543617d495b0e3e75071d407e96da2b009b6f0ff648e
2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9
2cac89100642acb92e8c705a639a012b32de7eb32db954a31890da8a091610c3
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
308eaa6c612a8d6657217de21428f19ce407d47406bb6764dec990fc42f20f27
32bc033e13e02d8809b2c8c97ac5a5110c5f375a830ed6cace5ce1202ab5b480
370dbc0a7e85181d81ecf29999a4782fc0fde9621e538b4d17887e2d1af1522d
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
37e61204a0b2fc3ac7da4dd919df8f5bbf99dffa1417aab3a1c175e0e39a0c6a
431fe74d0096b939afd5ed1684b21c62cf04985059c76481919c03129e3269a9
43a6f8680a97c5b388e41deced4040381f47ce6c6aead5fbf794a51aa4b9667c
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
46d1791d45e9e6840842ef90f192c2c6f1f4247baa7c1f32f2da75d3a05c0de2
47f33d5a14c3605b73594a767736041df110457fcf1bb09322620fb8e537e8c6
4b39c3dfd768eb1864c32afab9ad52361e77bef7c721950ab965acdf74ccc2da
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4dbae8b3d2a71b182f3aab701a08fc3c5f2bf734f9e09605c650b1c6506e9097
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4efca4768dedb757f956b51f3620d1521be4e8f065080515489defc83c2de704
5073d5020c808f28513826ae7a079d2bb2874edca7305920b61befdd4bd5e9c6
5206d191529a42768640a36d1c3d24103df603780b2181ccb1b15f35c97beff8
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a37144cebb7b5f6fa8863c98da5159c7a98db8ef952b674f6ab0efc573b007c
5c1b133e4da2d3c32efabe11e0aea725cf19372d47fa794ff41df965bf5ebe59
5d0f7d343e9cc9ca519acd511dba49eb03216600f4b5e55e1f31de45039d1c2d
61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07
6501140033c3bb20da4b5ac73c90f687ba8a2053c4ba37c4b6f5275166db7fa6
67063360c0d4766b19f6ff3b535a4143101bc9af186db76e676a38d8d3bd03e8
6ac72468d920cc2c0ffd5187900a42d4afe566bb14820de290730bb6695bfb6f
70d6443cf7ca99dcf7bcf1cbb47e3dca1a185cfa6a64bfaedef97d84174b9a65
70faee076da4a1c8b3b8f0efc5b05d157c376d2e4a7c7ca56ffd7a5006ab1a2f
71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef
729ac38bbf9f4e865981f3fceb90171d07280cd6063a7cfec08055ed0cc8acb3
7316c1dfbc9f061b2280befce5285d9576624d84376031f96583df11d82ea916
7701a30bb7b714fa7c0cf93a36bc5ee2c601ede0af08e1d4bc4ae43b7fdc4316
777ab0cb5c6ffd6b2d455918b8df70fdb4c74ecb18d62f54be1afdaf3733c10d
7869001c5b36a1174f5660b6c86589ed410008905e199fad9783d883faeaf6fa
78791edc61c96a5ec8159e033473108958108c66296abe6a5b6896040dff9645
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7ddcb13ac912f5f75a48aa45fef3fc5a13109543a6fbb4a0470907066f93145b
8054f4e3fe5af937cdc5d795f555dae2c1489ce993935b2c0da1ddb9bb8ce183
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8718908246fd54e39921ae475a1e21fd330d64bf21ef6418455186452c37a9ba
8aa69ee6b2376505578d758bfbbc52aec88fa5e591f1a7cabd8adfa80a7b613a
8fa7604a52665b737eb5022c6187c754a2b7a6168e2aeb4d157bcfad5d523289
8fd0e79fe04e510f99d7693dd7ee10ddd58a662c42732a03626f6c1447b09154
964c519c1bbb0a37524e1c2b8439e16a592ff7b880cd44ded77691733bb4890e
972688e6f6c24d2b23019a796b19f90515ba5f4ff744747c072b79fa44de3432
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a2137ebfe2b9ff55e1f280dbb1eef301290c50db609c5d6a0494ae8f3c98c253
a42111e2579acfa0b5baa4bd866747ebb90ba18a41cee2000985acdbc1364fbb
a44f8a269790ba17c206c6cce4094e67fffb19296d2b144cb85dee4083e90177
a540980818ce61b258b594826865bcd3fa4059ca5661e18dc3d8f3a50111ea71
a67795899cdbdffbb966a975963dbbc9413501bfc465d92fa82bf506de430617
a6d3c646c75d19fae473ba506e692f34d9f50abfe77ac1b58c8ef9020d86c7b0
a7c349ff895278bb10cdd216171f50a25c1bb394685aafc08f2ea4a7d0d0754f
aa740a73eb321a796bb474af34c7b703d600edf816ba1dabf14e0a6d9902798b
ad3043fe035839f522d0e7011dd96439e77eaf469f9ec9a2c8009c87b8268c0a
ad66679335de3477ee70943792ccc5610a51eb9db06014d7a4a15dd984e932e6
b04f28c1709965fb934d97b10886d857b2919ab8c71121baddb3d913264a2926
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b25a4cdffba3f45591d0c33e8045739067c8973c70124f0fe44a2f045ba4e1b6
b69107182f81db02c505aceb90550889a19dfd6dcee8ea8a57b4c39bf34cfd9b
bb3df861d6798d717f419b53bef75022292a2f43e9bcc840f2259c78d4814334
bc538c392f267ea879c0bce8170f68cbfac1276b11b249e863fd16c46b55e49b
bf6f60cb20eacd62c8ef02cb958db7e3b893244e61e247f157650dcaf2caa2ed
c3af24a70c1ed70449acb08f574afbd3711ad5bf7b0a321b2e8296b411169911
c7a5ac7699a044df2a6cb702caf1616b7fafe5dee0dcfb9448c21b46a6373034
ca4da43174b9ed2d7011876053ac0a648b05a3632267f5f4fa808dde6ad8c332
cb15459ac1a24de773a7a4ec6e128f408b3a4ce931a9e67e71b7f9234de20e25
cf45cd7eedc285f819f5206d02b549e95c4877393daa02be0e94bfe0addc7907
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d107f91b2ead9f59eb51436c7edfaf3436f48591ed9f24fed76c654f9f827c2a
d27e1d21c0f87974367746a59289cada444ac82222c124d9b86ba5616b5151ed
de3333a338591946528a5894f071ffff8f89e8f738e72eaf746aa8e6e6a5a244
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
df2caab856b62ae80e0cbabb826a13980167fb73d67c2e263184e0b10565ad61
e392b7a34034b4389cb95c6a572e85e577e633b92e737ffb03cd03880bb3c97c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e8464907f5656041e11aa03afa4c79462f95b96a21f2fa23eaebcc0a86f48806
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0a0b741a25177ac5a1b85ec81f9c2827f3193ed2e42fe90286b089531c53855
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f6d7e9dafd1ec463ecd0c6b20f170400dd15afe81c71dea50771550df2f83ffc
f77901460c4fe09d055e1f32a52d72b19b5eac2d387addc04082759d3055aba4
f82406302c459c32c810278f5f8668ca38b1dbd59738d758dfe8dbcf0d6533f1
f83b1a3ea61ad62e47fad82de5495a2547e2f12e591ad8108050538c566ae1e3
f938c9be0ff7fa5c506a0ddebe43cb01216c1580aae5e31bbb8db68d3952dada
fa4f52d76e694e9bd170da82b334b47bef5ed500a0d32318d7896351bae5e64f
fad2b41a387ad2bff0c05ed1475f79529e13a17163eb6e36f8953822d96ded88
fcbc99707e87bf66b6378ee39c89bcaea9dabf4f18472f5816d402b06c3b4865
fd72410c77efa3d892140e9e1bff6c2005d2a74ff1124c73b7d48a0538f150aa

philadelphiamarriottdowntown.idaypass.com Open in urlscan Pro 54.172.5.148 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

177 Requests

75 %HTTPS

35 %IPv6

51 Domains

74 Subdomains

53 IPs

3 Countries

6250 kBTransfer

17507 kBSize

92 Cookies

7 Outgoing links

Page URL History

Redirected requests

177 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

philadelphiamarriottdowntown.idaypass.com Open in urlscan Pro
54.172.5.148 Public Scan

Screenshot
Live screenshot

Full Image

177
Requests

75 %
HTTPS

35 %
IPv6

51
Domains

74
Subdomains

53
IPs

3
Countries

6250 kB
Transfer

17507 kB
Size

92
Cookies

177 HTTP transactions
0 data transactions