wicked.tours Open in urlscan Pro
161.35.113.156 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://wicked.tours/
Submission Tags: phishingrod
Submission: On April 20 via api (April 20th 2023, 5:07:51 pm UTC) from DE — Scanned from DE

Summary HTTP 117 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 21 IPs in 3 countries across 15 domains to perform 117 HTTP transactions. The main IP is 161.35.113.156, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is wicked.tours.
TLS certificate: Issued by R3 on April 19th 2023. Valid for: 3 months.

This is the only time wicked.tours was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
25	161.35.113.156 161.35.113.156	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
23	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c0c::9d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
1	52.222.206.214 52.222.206.214	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
16	2001:4860:480... 2001:4860:4802:36::36	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	35.80.188.69 35.80.188.69	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1	18.66.97.10 18.66.97.10	16509 (AMAZON-02) (AMAZON-02)
1	52.222.236.43 52.222.236.43	16509 (AMAZON-02) (AMAZON-02)
23	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
117	21

25 161.35.113.156 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: 624165.cloudwaysapps.com

wicked.tours	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

tomis-bot.firebaseapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.206.214 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-206-214.fra56.r.cloudfront.net

cdn.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2001:4860:4802:36::36 (United States)

ASN15169 (GOOGLE, US)

us-central1-tomis-bot.cloudfunctions.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.80.188.69 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-80-188-69.us-west-2.compute.amazonaws.com

api.amplitude.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-10.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-43.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

firestore.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 119 www.googleapis.com — Cisco Umbrella Rank: 58 firestore.googleapis.com — Cisco Umbrella Rank: 1975	15 KB
25	wicked.tours wicked.tours	1 MB
23	firebaseapp.com tomis-bot.firebaseapp.com	439 KB
16	cloudfunctions.net us-central1-tomis-bot.cloudfunctions.net	1 KB
4	amplitude.com cdn.amplitude.com — Cisco Umbrella Rank: 4665 api.amplitude.com — Cisco Umbrella Rank: 2061	19 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 91	20 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 899 script.hotjar.com — Cisco Umbrella Rank: 1171	72 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	255 B
2	google.de www.google.de — Cisco Umbrella Rank: 3425	515 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 166	403 B
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2930 www.google.com — Cisco Umbrella Rank: 16	660 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 189	137 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 114	146 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 344	33 KB
1	gstatic.com fonts.gstatic.com	31 KB
117	15

	Domain	Requested by
25	wicked.tours	wicked.tours cdnjs.cloudflare.com
23	firestore.googleapis.com	tomis-bot.firebaseapp.com
23	tomis-bot.firebaseapp.com	www.googletagmanager.com tomis-bot.firebaseapp.com
16	us-central1-tomis-bot.cloudfunctions.net	tomis-bot.firebaseapp.com
4	www.googleapis.com	tomis-bot.firebaseapp.com
3	api.amplitude.com	cdn.amplitude.com
3	www.google-analytics.com	www.googletagmanager.com wicked.tours
2	www.facebook.com	wicked.tours
2	www.google.de	wicked.tours
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	connect.facebook.net	wicked.tours connect.facebook.net
2	www.googletagmanager.com	wicked.tours www.googletagmanager.com
2	cdnjs.cloudflare.com	wicked.tours
2	fonts.googleapis.com	wicked.tours
1	script.hotjar.com	static.hotjar.com
1	static.hotjar.com	www.googletagmanager.com
1	www.google.com	wicked.tours
1	cdn.amplitude.com	tomis-bot.firebaseapp.com
1	region1.analytics.google.com	www.googletagmanager.com
1	fonts.gstatic.com	fonts.googleapis.com
117	20

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
www.instagram.com
twitter.com
www.linkedin.com
www.youtube.com
wicked-tours.checkfront.com
gondola.travel

Subject Issuer	Validity	Valid
icystraitpointexcursions.com R3	`2023-04-19` - `2023-07-18`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-01-28` - `2023-04-28`	3 months	crt.sh
firebaseapp.com GTS CA 1D4	`2023-03-07` - `2023-06-05`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-03-28` - `2023-06-20`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
cdn.amplitude.com Amazon RSA 2048 M01	`2023-01-12` - `2024-02-11`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
misc.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.amplitude.com COMODO RSA Domain Validation Secure Server CA	`2023-01-23` - `2024-02-14`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
edgecert.googleapis.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://wicked.tours/
Frame ID: 9B27A883F1DA535ACDC7196097B31C4D
Requests: 55 HTTP requests in this frame

Frame: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Frame ID: 08FD9E1F549CFE1BE23096B07C5ADA07
Requests: 4 HTTP requests in this frame

Frame: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Frame ID: 128297C49824E9E70E4472065B4994FC
Requests: 4 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 8FF345EDDAA1FC10A080C7FB19644029
Requests: 1 HTTP requests in this frame

Frame: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Frame ID: B43F728C32258D2A88E297A3F4AC9C2B
Requests: 4 HTTP requests in this frame

Frame: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Frame ID: 48A3D6F3B2D9A6CB516F19821D175C17
Requests: 4 HTTP requests in this frame

Frame: https://tomis-bot.firebaseapp.com/bot/index.html?site=wicked-wine-tours&initialParentWidth=1600&initialParentHeight=1200
Frame ID: F212E915EDF33BECF28A098F8A85937E
Requests: 32 HTTP requests in this frame

Frame: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Frame ID: CAB9CF57FB5C73827B3DB46F6E6ECA96
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Award Winning Kelowna Wine Tours | Wicked Tours

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Amplitude (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.amplitude\.com

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

117
Requests

100 %
HTTPS

75 %
IPv6

15
Domains

20
Subdomains

21
IPs

3
Countries

2194 kB
Transfer

5397 kB
Size

11
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/wickedwinetours

Search URL Search Domain Scan URL

URL: https://www.instagram.com/wickedwinetours

Search URL Search Domain Scan URL

URL: https://twitter.com/wickedwinetours

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/wickedwinetours/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/Wickedwinetours

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve
Title: Book Now

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/
Title: Book Now

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=8,30
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=9,31
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=4,28
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=14,36
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=5,29
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=10,32
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=11,33
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=12,34
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=13,35
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=15
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=16
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?item_id=21
Title: Availability

Search URL Search Domain Scan URL

URL: https://wicked-tours.checkfront.com/reserve/?category_id=10
Title: Buy Now

Search URL Search Domain Scan URL

URL: https://gondola.travel/?utm_source=client&utm_medium=referral&utm_campaign=footer-refer&utm_term=wicked.tours
Title: .footer-text-color-svg{fill:#ffffff;}

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

117 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
wicked.tours/ 498 KB
54 KB 1123ms
912ms Document
text/html 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 42b39185be46ac326521061b9f4e9653e1a38834c4e519f1e7c06c3976b9d2a1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 20 Apr 2023 17:07:43 GMT
expires: Thu, 20 Apr 2023 17:07:43 GMT
link: <https://wicked.tours/wp-json/>; rel="https://api.w.org/", <https://wicked.tours/wp-json/wp/v2/pages/30>; rel="alternate"; type="application/json", <https://wicked.tours/>; rel=shortlink
server: nginx
vary: Accept-Encoding

GET
H2 200 style.basic.css
wicked.tours/wp-content/plugins/ajax-search-lite/css/ 21 KB
4 KB 93ms
92ms Stylesheet
text/css 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/plugins/ajax-search-lite/css/style.basic.css?ver=4.10
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 947e611b2cb75cb862f3802ca9d4f81cce21680d57204dfa300396e6c5526479

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 13:37:29 GMT
server: nginx
etag: W/"62ebcb99-541c"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000

GET
H2 200 style-curvy-black.css
wicked.tours/wp-content/plugins/ajax-search-lite/css/ 6 KB
1 KB 94ms
93ms Stylesheet
text/css 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/plugins/ajax-search-lite/css/style-curvy-black.css?ver=4.10
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 5c80505133c2b387dbe571c9b908be7e815b86ec57d1cb8de7f1b8212cb0d304

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 13:37:29 GMT
server: nginx
etag: W/"62ebcb99-1927"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000

GET
H2 200 home_b4a2d6e8.css
wicked.tours/wp-content/themes/gondola-wp/dist/styles/ 171 KB
28 KB 99ms
98ms Stylesheet
text/css 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/themes/gondola-wp/dist/styles/home_b4a2d6e8.css?ver=5.8.6
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 5ecde8139d54c8f612a3ff111da9989ae1ca04aa6b578522607339b6c57ab921

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 30 Mar 2023 21:07:46 GMT
server: nginx
etag: W/"6425fa22-2ab65"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000

GET
H2 200 gondola-custom-css.css
wicked.tours/wp-content/uploads/sites/459/gondola-custom-css/ 7 KB
1 KB 166ms
166ms Stylesheet
text/css 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/uploads/sites/459/gondola-custom-css/gondola-custom-css.css
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 84b09adb8db75d48aa7dbe054995b67cad4d429bd4c985d73ba949a84ebc0f97

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 20 Apr 2023 14:52:01 GMT
server: nginx
etag: W/"64415191-1aab"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 3 KB
1 KB 36ms
16ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans&display=swap

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfd1078f29da41cd957ea0b0ad52513a4527812d050530b857af5a0d03b333a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 20 Apr 2023 15:26:35 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 20 Apr 2023 17:07:44 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 30ms
12ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js?ver=5.8.6

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3614600
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27938
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "603e8adc-15d9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YYsP40h6h4fXsxpdC3H8kpYWS50SHE3SGYbUi%2FQT6IgYpkJrzxD6xdsxe8AKtzxCT3wQ2u4Rh%2FYQ0m3OKvwxzKWGGxuI4SnHjRD%2BtXNvAeW9Zg95HDBL0dwdvMIDFXQys8wZGWqPw1LSc%2BEpbCfzXA92"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7baefc386b5a9229-FRA
expires: Tue, 09 Apr 2024 17:07:44 GMT

GET
H2 200 jquery-migrate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.4.0/ 13 KB
5 KB 16ms
15ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.4.0/jquery-migrate.min.js?ver=5.8.6

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

16eb18d9c6303cdd50ac58db5b2b116c5dcc4c43c89424f268f6d13fc599fb19

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 7324812
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4305
last-modified: Thu, 24 Mar 2022 20:04:30 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "623ccece-10d1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C4bSq88%2Fnhi3ya8pIcQ%2FSYP5tzd5wFdM0dUf0vne%2FSfzFkDgHujht4K6f4H%2B%2BrKSkWDpvu9Wh93s2CrUBa7imnWBD6x%2BZl0q0wwGxo2bH29RdFIjbwESMmXoz179PSZ8%2F%2FKkb2jN2FoGUGdmKSoOopCp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7baefc391c129229-FRA
expires: Tue, 09 Apr 2024 17:07:44 GMT

GET
H2 200 simplebar.js Show response
wicked.tours/wp-content/plugins/ajax-search-lite/js/min/external/ 36 KB
10 KB 95ms
95ms Script
application/javascript 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/plugins/ajax-search-lite/js/min/external/simplebar.js?ver=4751
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 6f74cd5afbfe6fab11489dfcc70fb996ccd7b3dc935927d7402aa285d9692207

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 13:37:29 GMT
server: nginx
etag: W/"62ebcb99-8e7c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000

GET
H2 200 asl-prereq.js Show response
wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/ 19 KB
6 KB 98ms
97ms Script
application/javascript 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-prereq.js?ver=4751
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 202ee5b585222e2c8660b175f70624ec845320e95ec306ede1e9ad6ca12ec453

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 13:37:29 GMT
server: nginx
etag: W/"62ebcb99-4c8e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000

GET
H2 200 asl-core.js Show response
wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/ 37 KB
10 KB 99ms
99ms Script
application/javascript 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-core.js?ver=4751
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 5d2daebf3aef880f90c88253bcd48338de8886ee772559966c2594fae8e14e3a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 13:37:29 GMT
server: nginx
etag: W/"62ebcb99-93c5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000

GET
H2 200 asl-results-vertical.js Show response
wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/ 1 KB
841 B 101ms
101ms Script
application/javascript 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-results-vertical.js?ver=4751
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: ece88845d2c0a327f6a7957ec596d1014820fbfb62b31a13b8152a28dbd41bb5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 13:37:29 GMT
server: nginx
etag: W/"62ebcb99-594"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000

GET
H2 200 asl-load.js Show response
wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/ 71 B
242 B 103ms
102ms Script
application/javascript 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-load.js?ver=4751
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 1771aad88d0164b8f869d097851c94cc83d1a837f12fe8de39d0f309fe45f33c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 13:37:29 GMT
server: nginx
etag: W/"62ebcb99-47"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000

GET
H2 200 asl-wrapper.js Show response
wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/ 5 KB
2 KB 104ms
103ms Script
application/javascript 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/plugins/ajax-search-lite/js/min/plugin/optimized/asl-wrapper.js?ver=4751
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: c2c2302b5ee2629a243e633d6b69610fd35586ccd25f9402332ee496b51ceb3e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 13:37:29 GMT
server: nginx
etag: W/"62ebcb99-129d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000

GET
H2 200 home_b4a2d6e8.js Show response
wicked.tours/wp-content/themes/gondola-wp/dist/scripts/ 171 KB
53 KB 116ms
115ms Script
application/javascript 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/themes/gondola-wp/dist/scripts/home_b4a2d6e8.js?ver=5.8.6
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 761e4c699f6f3374e0b754376dda71a033e55fdb60860c63c0c1320d0d44bbdd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Thu, 30 Mar 2023 21:07:46 GMT
server: nginx
etag: W/"6425fa22-2aaa6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000

GET
H2 200 lazyload.min.js Show response
wicked.tours/wp-content/plugins/rocket-lazy-load/assets/js/16.1/ 8 KB
3 KB 93ms
92ms Script
application/javascript 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wicked.tours/wp-content/plugins/rocket-lazy-load/assets/js/16.1/lazyload.min.js
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 6e86a52a9858206302e32036d89907e3ac87762055e7f9c6364aec33221b3e41

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
last-modified: Tue, 10 May 2022 11:27:06 GMT
server: nginx
etag: W/"627a4c0a-1ed2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
662 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@200;400;700&display=swap

Requested by

Host: wicked.tours
URL: https://wicked.tours/wp-content/themes/gondola-wp/dist/styles/home_b4a2d6e8.css?ver=5.8.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fcf5dafc9569e422bcc4427c8a68efead79dac1e37a8e1b1237219dc5a17927c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 20 Apr 2023 17:07:44 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 20 Apr 2023 17:07:44 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 190 KB
68 KB 48ms
27ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-54TM3L

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a9790234a136995375cb11bf47d71a34fcc2bda0afbc2491459c6ac095e7cbd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69433
x-xss-protection: 0
last-modified: Thu, 20 Apr 2023 16:11:26 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Apr 2023 17:07:44 GMT

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 Wicked-WIne-Tours-Kelowna-150-1280x778.jpeg.webp
wicked.tours/wp-content/uploads/sites/459/2022/12/ 195 KB
195 KB 93ms
92ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2022/12/Wicked-WIne-Tours-Kelowna-150-1280x778.jpeg.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/wp-content/uploads/sites/459/gondola-custom-css/gondola-custom-css.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: e5e3d6fdd78fb14597e2501ec74b3d5c730d13a2e6718a18a8639e43cdc9d34e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/wp-content/uploads/sites/459/gondola-custom-css/gondola-custom-css.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Wed, 19 Apr 2023 15:15:06 GMT
server: nginx
etag: "6440057a-30a16"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 199190

GET
H2 200 sh4.jpeg.webp
wicked.tours/wp-content/uploads/sites/459/2022/10/ 349 KB
349 KB 184ms
183ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2022/10/sh4.jpeg.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/wp-content/uploads/sites/459/gondola-custom-css/gondola-custom-css.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: bdd6e29b3886816b933e6c994cf33b6f01d7239a484b844c676c473bc53bfc83

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/wp-content/uploads/sites/459/gondola-custom-css/gondola-custom-css.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Wed, 19 Apr 2023 15:15:08 GMT
server: nginx
etag: "6440057c-57298"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 357016

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
31 KB 28ms
7ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@200;400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://wicked.tours
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 05:03:35 GMT
x-content-type-options: nosniff
age: 43449
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 19 Apr 2024 05:03:35 GMT

GET
H2 200 240676828_2327688860713265_4511699592403504691_n-e1666623479388-1439x411.jpeg.webp
wicked.tours/wp-content/uploads/sites/459/2022/10/ 114 KB
114 KB 138ms
138ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2022/10/240676828_2327688860713265_4511699592403504691_n-e1666623479388-1439x411.jpeg.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/wp-content/uploads/sites/459/gondola-custom-css/gondola-custom-css.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 471dd8de454f9557c0acbdca68a708e806cbd376aaa2c151dbd7c33a1fc9ee31

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/wp-content/uploads/sites/459/gondola-custom-css/gondola-custom-css.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Wed, 19 Apr 2023 15:15:08 GMT
server: nginx
etag: "6440057c-1c8b8"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 116920

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 134ms
6ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54TM3L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 20 Apr 2023 16:27:45 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 2399
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Thu, 20 Apr 2023 18:27:45 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 107 KB
28 KB 133ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

091ba5711e7f397eca67fb1da60968a88be608d2f4fb80955ef74f645b6e898b

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 20 Apr 2023 17:07:44 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27967
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: pg6EQ04sjifPEZU189SRWBfIFPjgrB/mzgf4/CalveaRStiPp0bT1l/VK8nFndgLLs8q2y3+ECOanlmumyPdSQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
78 KB 26ms
25ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-G2TMJJ58WS&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54TM3L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

df0dd4a3dece70f531b0671cb663056b246c9e23fd3d1a86eafef5e42e026f92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79332
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 20 Apr 2023 17:07:44 GMT

GET
H2 200 index.js Show response
tomis-bot.firebaseapp.com/ 85 KB
23 KB 129ms
8ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/index.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54TM3L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dd4a241aeeddd5025a307e0f5db1f27409021a3e3b36753b9f9a6f18040356e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230116-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010464.475363,VS0,VE1
etag: "8410e10e7bd51102430fe29b03638635308c1638c062908600730a5508ea6116-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 23483
x-cache-hits: 1

GET
H2 200 categories Show response
wicked.tours/wp-json/wp/v2/ 5 KB
2 KB 252ms
252ms XHR
application/json 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://wicked.tours/wp-json/wp/v2/categories

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js?ver=5.8.6

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

624165.cloudwaysapps.com

Software

nginx /

Resource Hash

90df4f4aefb6c74a0a7ecaca27826bf34ddeb5aeafea63fe05e0843e97e2a172

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Referer: https://wicked.tours/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-length: 1575
x-wp-doingitwrong: register_rest_route (since 5.5.0; The REST API route definition for <code>wp/v2/sites/delete/?(?P<blog_id>\d+)?</code> is missing the required <code>permission_callback</code> argument. For REST API routes that are intended to be public, use <code>__return_true</code> as the permission callback.)
server: nginx
x-wp-totalpages: 1
allow: GET
vary: Origin,Accept-Encoding
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=0
x-wp-total: 3
x-robots-tag: noindex
link: <https://wicked.tours/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
expires: Thu, 20 Apr 2023 17:07:44 GMT

GET
H2 200 WickedTours_Logo_RGB_DarkonLight-4.jpg
wicked.tours/wp-content/uploads/sites/459/2023/03/ 6 KB
6 KB 92ms
92ms Image
image/jpeg 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2023/03/WickedTours_Logo_RGB_DarkonLight-4.jpg
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: e00259d0de8af424931c41b058fe6ec25c0db438656ddca326cb5ac1c6942777

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Fri, 03 Mar 2023 19:27:55 GMT
server: nginx
etag: "64024a3b-1775"
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 6005

GET
H2 200 OWFS-128x40.png.webp
wicked.tours/wp-content/uploads/sites/459/2023/02/ 3 KB
4 KB 93ms
92ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2023/02/OWFS-128x40.png.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 91c88ba09686f1391fe968314a39a50749c546da6bd6cdadd20bcdc2026bef86

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Wed, 08 Feb 2023 19:00:21 GMT
server: nginx
etag: "63e3f145-de8"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3560

GET
H2 200 rsw_363h_200cg_true-128x71.webp
wicked.tours/wp-content/uploads/sites/459/2022/10/ 3 KB
3 KB 93ms
92ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2022/10/rsw_363h_200cg_true-128x71.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 6efab6d334551dc2f787603f093acf40abb37df4219d78aa53c02c71c917e9fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Fri, 21 Oct 2022 14:25:19 GMT
server: nginx
etag: "6352abcf-a4a"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2634

GET
H2 200 rsw_297h_200cg_true-128x86.webp
wicked.tours/wp-content/uploads/sites/459/2022/10/ 3 KB
3 KB 94ms
93ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2022/10/rsw_297h_200cg_true-128x86.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: c212941bd3343394223cad357d82517cf533e8cd0d0ca8f211bfa0d990f38952

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Fri, 21 Oct 2022 14:25:44 GMT
server: nginx
etag: "6352abe8-ab8"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2744

GET
H2 200 TIABC-removebg-preview-e1669838183572-128x31.png.webp
wicked.tours/wp-content/uploads/sites/459/2022/11/ 3 KB
3 KB 94ms
93ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2022/11/TIABC-removebg-preview-e1669838183572-128x31.png.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 5108d0adbc43671f8d004a74b15ae5c567291feb89ff81c0fe4cab24ed7a19f9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Wed, 30 Nov 2022 21:31:17 GMT
server: nginx
etag: "6387cba5-c34"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3124

GET
H2 200 rsw_436h_200cg_true-128x59.webp
wicked.tours/wp-content/uploads/sites/459/2022/10/ 2 KB
3 KB 95ms
94ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2022/10/rsw_436h_200cg_true-128x59.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: 19dc97be99f367c5d9f9af51571bc1f698d1673f754a39f1b14cf268682cb004

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Fri, 21 Oct 2022 14:26:13 GMT
server: nginx
etag: "6352ac05-9ae"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2478

GET
H2 200 rsw_575h_178cg_true-128x40.webp
wicked.tours/wp-content/uploads/sites/459/2022/10/ 3 KB
3 KB 95ms
94ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2022/10/rsw_575h_178cg_true-128x40.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: f4230ced8d4264c7d87c89dd662ed160243569667d5d1fc586b94d65fb771618

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Fri, 21 Oct 2022 14:26:38 GMT
server: nginx
etag: "6352ac1e-c28"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3112

GET
H2 200 sh4-1.jpeg.webp
wicked.tours/wp-content/uploads/sites/459/2022/10/ 422 KB
423 KB 95ms
95ms Image
image/webp 161.35.113.156
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wicked.tours/wp-content/uploads/sites/459/2022/10/sh4-1.jpeg.webp
Requested by: Host: wicked.tours
URL: https://wicked.tours/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.113.156 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 624165.cloudwaysapps.com
Software: nginx /
Resource Hash: f17dd997533ce70ba71e1a22cefc1129190437da5cfc6484b60d5fd6da6fa98c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Tue, 28 Feb 2023 19:45:38 GMT
server: nginx
etag: "63fe59e2-69856"
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 432214

POST
H2 204 collect
region1.analytics.google.com/g/ 0
252 B 42ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-G2TMJJ58WS&gtm=45je34c0&_p=21763102&_gaz=1&cid=608242382.1682010464&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1682010464&sct=1&seg=0&dl=https%3A%2F%2Fwicked.tours%2F&dt=Award%20Winning%20Kelowna%20Wine%20Tours%20%7C%20Wicked%20Tours&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G2TMJJ58WS&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Apr 2023 17:07:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://wicked.tours
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 65ms
21ms Ping
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-G2TMJJ58WS&cid=608242382.1682010464&gtm=45je34c0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G2TMJJ58WS&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Apr 2023 17:07:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://wicked.tours
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 66ms
44ms Image
image/gif 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-G2TMJJ58WS&cid=608242382.1682010464&gtm=45je34c0&aip=1&z=1898683560

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Apr 2023 17:07:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
347 B 51ms
20ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-11247999-2&cid=608242382.1682010464&jid=452433030&gjid=1183056105&_gid=570593579.1682010464&_u=YCDAiEABBAAAAEAAIC~&z=1156194865

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://wicked.tours/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 20 Apr 2023 17:07:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://wicked.tours
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 7ms
6ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=21763102&t=pageview&_s=1&dl=https%3A%2F%2Fwicked.tours%2F&ul=en-us&de=UTF-8&dt=Award%20Winning%20Kelowna%20Wine%20Tours%20%7C%20Wicked%20Tours&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAAAAAIC~&jid=452433030&gjid=1183056105&cid=608242382.1682010464&tid=UA-11247999-2&_gid=570593579.1682010464&gtm=45He34c0n7154TM3L&z=760329361

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Apr 2023 04:35:36 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 45128
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 585564213285457 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 147ms
146ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/585564213285457?v=2.9.102&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

dd793f388b75eaac775499490fb337299e291bb46d8423f44259a01ed84f110e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 20 Apr 2023 17:07:44 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: njHdjZWQ86Vx6/7/UNjSdbsjHoNZAj09EkQ8wBai6epQ13fdpxKN9Vyx82WEVnDICC6j4hYH1ApMXRr9WYL0bw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 amplitude-5.2.2-min.gz.js Show response
cdn.amplitude.com/libs/ 54 KB
18 KB 54ms
10ms Script
application/javascript 52.222.206.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js
Requested by: Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.206.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-206-214.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2173f130ca59dc5554498343432f02f92ecce45c4f9381ea12b203a2978f33d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 08 Jan 2023 09:26:25 GMT
content-encoding: gzip
via: 1.1 68eb499493257a6d0620a0f6abdc78ca.cloudfront.net (CloudFront)
x-amz-version-id: aZB1RIRJqET7nosqRtOBVideRuh0jIV6
x-amz-cf-pop: FRA56-P3
age: 8840480
x-cache: Hit from cloudfront
content-length: 17889
last-modified: Mon, 21 Oct 2019 15:45:34 GMT
server: AmazonS3
etag: "b568e7b3c9d94da6a1d4845b18400f7a"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: re1Ih1Hqn2_o2LJpRs9oDsm7A8n7pq7twzbFQ6KiwUh5cNp0rPUZHg==

GET
H3 200 index.html Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame 08FD 544 B
506 B 9ms
8ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ee8ecd398278dff36bbad5cb9a54e943c80022ac81cff2df1845dc9236462e5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://wicked.tours/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 180
content-type: text/html; charset=utf-8
date: Thu, 20 Apr 2023 17:07:44 GMT
etag: "f4bc0b8d13f7569a7d131ef3d8e13b886e44929b877c19b6f82e95b46487be3b-br"
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 1
x-served-by: cache-fra-eddf8230028-FRA
x-timer: S1682010465.556851,VS0,VE2

GET
H2 200 setupBot.5923e61f.js Show response
tomis-bot.firebaseapp.com/ 12 KB
3 KB 20ms
16ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/setupBot.5923e61f.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

62de08d5f2ca4f8a75442cf21bbde488ac9585d7604cac85d7889c61b8dfa5eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230116-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.527247,VS0,VE9
etag: "dad1973894a88d90c128c384c6cef5c6c67c15aec42ed2f85e751eb6e7d09100-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 3146
x-cache-hits: 1

GET
H2 200 setupBot.f16d9c79.js Show response
tomis-bot.firebaseapp.com/ 7 KB
2 KB 11ms
8ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/setupBot.f16d9c79.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

deac51a86192d922ceac425210427bb85c528055c35230237e306e3dd2d5fa93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230116-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.527560,VS0,VE1
etag: "e6930a622fcb45415a0379b21556de274351dde5c7116fdd26934d3aa83b845b-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2026
x-cache-hits: 1

GET
H2 200 setupBot.ab5754cf.js Show response
tomis-bot.firebaseapp.com/ 5 KB
2 KB 11ms
9ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/setupBot.ab5754cf.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f9d31b51412832f83a0182cc5b19be4d549e86b10eb26b7a0646aed3e369b77d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230116-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.526992,VS0,VE2
etag: "1162e267950058b62ef36919f3c243ad7ae21ecb5481ed8e10fde25c9ae5949a-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2005
x-cache-hits: 1

GET
H3 200 index.html Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame 1282 544 B
506 B 8ms
8ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ee8ecd398278dff36bbad5cb9a54e943c80022ac81cff2df1845dc9236462e5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://wicked.tours/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 180
content-type: text/html; charset=utf-8
date: Thu, 20 Apr 2023 17:07:44 GMT
etag: "f4bc0b8d13f7569a7d131ef3d8e13b886e44929b877c19b6f82e95b46487be3b-br"
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 2
x-served-by: cache-fra-eddf8230028-FRA
x-timer: S1682010465.557728,VS0,VE1

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 66ms
44ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-11247999-2&cid=608242382.1682010464&jid=452433030&_u=YCDAiEABBAAAAEAAIC~&z=1259645330

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Apr 2023 17:07:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 43ms
43ms Image
image/gif 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-11247999-2&cid=608242382.1682010464&jid=452433030&_u=YCDAiEABBAAAAEAAIC~&z=1259645330

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Apr 2023 17:07:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.b2335cb4.js Show response
tomis-bot.firebaseapp.com/bot/ Frame 08FD 17 KB
5 KB 11ms
10ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/bot/index.b2335cb4.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dfef746969cffcc595cb2bb47df8b167a9a31712be357e8665930284006d6160

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.598464,VS0,VE2
etag: "b778ce73910b51b8583747b2fc75027c646dc375651915a53f7fbd4d811fa2e5-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5207
x-cache-hits: 1

GET
H3 200 index.47e44334.js Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame 08FD 1 KB
933 B 12ms
11ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3ed0b83d7241f070432962169fac9dd84bf8e66e07892602288fcbf1e9c85225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.598412,VS0,VE3
etag: "6b543a1921d12ac04e93ea0cbeddff2f1c055162424d343342b428bd2184b6e8-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 583
x-cache-hits: 1

GET
H3 200 index.b2335cb4.js Show response
tomis-bot.firebaseapp.com/bot/ Frame 1282 17 KB
5 KB 8ms
7ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/bot/index.b2335cb4.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dfef746969cffcc595cb2bb47df8b167a9a31712be357e8665930284006d6160

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.601921,VS0,VE0
etag: "b778ce73910b51b8583747b2fc75027c646dc375651915a53f7fbd4d811fa2e5-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5207
x-cache-hits: 2

GET
H3 200 index.47e44334.js Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame 1282 1 KB
933 B 8ms
7ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3ed0b83d7241f070432962169fac9dd84bf8e66e07892602288fcbf1e9c85225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:44 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.602051,VS0,VE0
etag: "6b543a1921d12ac04e93ea0cbeddff2f1c055162424d343342b428bd2184b6e8-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 583
x-cache-hits: 2

GET
H2 200 / Show response
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame 08FD 16 B
200 B 386ms
386ms Fetch
application/json 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Requested by: Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 469ab758cfe6a8ac93cda5872ca28655f6f874a2f6cceafa710fc01f52fc787d

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 20 Apr 2023 17:07:45 GMT
content-encoding: gzip
server: Google Frontend
etag: W/"10-MsjnYJT8tv1YDQIW8xqLq60iHcM"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
x-cloud-trace-context: 1c2c3f0dbcea938cfe7bac2d31c80516
cache-control: private
access-control-allow-credentials: true
function-execution-id: 4moh0ja4bo18
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36

OPTIONS
H2 204 /
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame 0
0 181ms
131ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:44 GMT
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
function-execution-id: 4bic4kllh3tc
server: Google Frontend
x-cloud-trace-context: ea631340d67d617975548c1aab3a0777

OPTIONS
H2 204 /
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame 0
0 210ms
161ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:44 GMT
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
function-execution-id: amffnw4k9kuy
server: Google Frontend
x-cloud-trace-context: 01b044cfe58c6fc16c85fae94ee95131

GET
H3 200 / Show response
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame 1282 16 B
55 B 520ms
520ms Fetch
application/json 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Requested by: Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 469ab758cfe6a8ac93cda5872ca28655f6f874a2f6cceafa710fc01f52fc787d

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 20 Apr 2023 17:07:45 GMT
content-encoding: gzip
server: Google Frontend
etag: W/"10-MsjnYJT8tv1YDQIW8xqLq60iHcM"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
x-cloud-trace-context: 7cb714e7a4a10a5219df7ea81e5924cb
cache-control: private
access-control-allow-credentials: true
function-execution-id: v90in7a2wtvf
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 23ms
7ms Image
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=585564213285457&ev=PageView&dl=https%3A%2F%2Fwicked.tours%2F&rl=&if=false&ts=1682010464677&sw=1600&sh=1200&v=2.9.102&r=stable&a=tmgoogletagmanager&ec=0&o=30&cs_est=true&fbp=fb.1.1682010464676.1254391038&it=1682010464500&coo=false&rqm=GET

Requested by

Host: wicked.tours
URL: https://wicked.tours/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 20 Apr 2023 17:07:44 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 8FF3 0
70 B 17ms
16ms Document
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://wicked.tours
Referer: https://wicked.tours/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://wicked.tours
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Thu, 20 Apr 2023 17:07:45 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 index.html Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame B43F 544 B
506 B 7ms
7ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ee8ecd398278dff36bbad5cb9a54e943c80022ac81cff2df1845dc9236462e5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://wicked.tours/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 180
content-type: text/html; charset=utf-8
date: Thu, 20 Apr 2023 17:07:45 GMT
etag: "f4bc0b8d13f7569a7d131ef3d8e13b886e44929b877c19b6f82e95b46487be3b-br"
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 3
x-served-by: cache-fra-eddf8230028-FRA
x-timer: S1682010465.415827,VS0,VE0

GET
H3 200 index.html Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame 48A3 544 B
506 B 8ms
7ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ee8ecd398278dff36bbad5cb9a54e943c80022ac81cff2df1845dc9236462e5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://wicked.tours/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 180
content-type: text/html; charset=utf-8
date: Thu, 20 Apr 2023 17:07:45 GMT
etag: "f4bc0b8d13f7569a7d131ef3d8e13b886e44929b877c19b6f82e95b46487be3b-br"
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 4
x-served-by: cache-fra-eddf8230028-FRA
x-timer: S1682010465.416990,VS0,VE0

GET
H3 200 index.b2335cb4.js Show response
tomis-bot.firebaseapp.com/bot/ Frame B43F 17 KB
5 KB 7ms
6ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/bot/index.b2335cb4.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dfef746969cffcc595cb2bb47df8b167a9a31712be357e8665930284006d6160

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:45 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.428983,VS0,VE0
etag: "b778ce73910b51b8583747b2fc75027c646dc375651915a53f7fbd4d811fa2e5-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5207
x-cache-hits: 3

GET
H3 200 index.47e44334.js Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame B43F 1 KB
933 B 8ms
7ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3ed0b83d7241f070432962169fac9dd84bf8e66e07892602288fcbf1e9c85225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:45 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.429127,VS0,VE0
etag: "6b543a1921d12ac04e93ea0cbeddff2f1c055162424d343342b428bd2184b6e8-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 583
x-cache-hits: 3

GET
H3 200 index.b2335cb4.js Show response
tomis-bot.firebaseapp.com/bot/ Frame 48A3 17 KB
5 KB 8ms
7ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/bot/index.b2335cb4.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dfef746969cffcc595cb2bb47df8b167a9a31712be357e8665930284006d6160

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:45 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.434699,VS0,VE0
etag: "b778ce73910b51b8583747b2fc75027c646dc375651915a53f7fbd4d811fa2e5-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5207
x-cache-hits: 4

GET
H3 200 index.47e44334.js Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame 48A3 1 KB
933 B 8ms
8ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3ed0b83d7241f070432962169fac9dd84bf8e66e07892602288fcbf1e9c85225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:45 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010465.434908,VS0,VE0
etag: "6b543a1921d12ac04e93ea0cbeddff2f1c055162424d343342b428bd2184b6e8-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 583
x-cache-hits: 4

GET
H3 200 / Show response
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame B43F 16 B
55 B 344ms
344ms Fetch
application/json 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Requested by: Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 469ab758cfe6a8ac93cda5872ca28655f6f874a2f6cceafa710fc01f52fc787d

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 20 Apr 2023 17:07:45 GMT
content-encoding: gzip
server: Google Frontend
etag: W/"10-MsjnYJT8tv1YDQIW8xqLq60iHcM"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
x-cloud-trace-context: 43e2a32599ae0f8ff36029aa097ef703
cache-control: private
access-control-allow-credentials: true
function-execution-id: 4mohcrr8yfkf
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36

OPTIONS
H3 204 /
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame 0
0 132ms
132ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:45 GMT
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
function-execution-id: amff573cl3ou
server: Google Frontend
x-cloud-trace-context: aeabde5d2f0fd5a3eb27f1bbf09c7456;o=1

GET
H3 200 / Show response
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame 48A3 16 B
55 B 317ms
316ms Fetch
application/json 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Requested by: Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 469ab758cfe6a8ac93cda5872ca28655f6f874a2f6cceafa710fc01f52fc787d

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 20 Apr 2023 17:07:45 GMT
content-encoding: gzip
server: Google Frontend
etag: W/"10-MsjnYJT8tv1YDQIW8xqLq60iHcM"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
x-cloud-trace-context: 417e292ccd2cc28ce0c29f977237213f;o=1
cache-control: private
access-control-allow-credentials: true
function-execution-id: ilvyf8v5q3tx
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36

OPTIONS
H3 204 /
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame 0
0 128ms
127ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:45 GMT
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
function-execution-id: wjxjk2w7ze9k
server: Google Frontend
x-cloud-trace-context: 9c795bce5680bc2477b3056c5eec57ed

GET
H3 200 index.html Show response
tomis-bot.firebaseapp.com/bot/ Frame F212 653 B
522 B 9ms
8ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/bot/index.html?site=wicked-wine-tours&initialParentWidth=1600&initialParentHeight=1200

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

62606f97e65450a490bdfcceab927cd9979c854c26ab7235b7c56ba13e31d3a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://wicked.tours/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 196
content-type: text/html; charset=utf-8
date: Thu, 20 Apr 2023 17:07:45 GMT
etag: "75f705cd7c67fa9ede53525e7c40f636294c55f445c19c053d0cdbcebe0cbcab-br"
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 1
x-served-by: cache-fra-eddf8230028-FRA
x-timer: S1682010466.902204,VS0,VE1

GET
H3 200 index.b2335cb4.js Show response
tomis-bot.firebaseapp.com/bot/ Frame F212 17 KB
5 KB 7ms
7ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/bot/index.b2335cb4.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.html?site=wicked-wine-tours&initialParentWidth=1600&initialParentHeight=1200

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dfef746969cffcc595cb2bb47df8b167a9a31712be357e8665930284006d6160

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/bot/index.html?site=wicked-wine-tours&initialParentWidth=1600&initialParentHeight=1200
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:45 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010466.917402,VS0,VE0
etag: "b778ce73910b51b8583747b2fc75027c646dc375651915a53f7fbd4d811fa2e5-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5207
x-cache-hits: 5

GET
H3 200 index.b29f78eb.css
tomis-bot.firebaseapp.com/bot/ Frame F212 60 KB
26 KB 10ms
9ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/bot/index.b29f78eb.css

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.html?site=wicked-wine-tours&initialParentWidth=1600&initialParentHeight=1200

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c5bc50841241c4316ad7fcdf45b53b4e3efd5c50746d74f96751abb36b18e42a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/bot/index.html?site=wicked-wine-tours&initialParentWidth=1600&initialParentHeight=1200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:45 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010466.917680,VS0,VE2
etag: "d056553c8a4cce407328f75012134ece782a3df1467b0f62dabefe633415eb7e-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 25987
x-cache-hits: 1

GET
H3 200 index.efc8cf97.js Show response
tomis-bot.firebaseapp.com/bot/ Frame F212 2 MB
343 KB 12ms
12ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.html?site=wicked-wine-tours&initialParentWidth=1600&initialParentHeight=1200

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3f5d57557ed2fd980dffacc7cc50b0adddf2950a14f20bbf38f6ac00f604f2b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/bot/index.html?site=wicked-wine-tours&initialParentWidth=1600&initialParentHeight=1200
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:45 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010466.917595,VS0,VE4
etag: "93b18e17f9deb1d3e9db7a408a44b2a35a92d8a9e6b370b8fee310e9b61cfdf0-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 350404
x-cache-hits: 1

POST
H2 200 / Show response
api.amplitude.com/ 7 B
206 B 517ms
176ms XHR
text/html 35.80.188.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.80.188.69 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-80-188-69.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://wicked.tours/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 20 Apr 2023 17:07:46 GMT
strict-transport-security: max-age=15768000
trace-id: Root=1-64417162-6f9a1d2d441f437b15d52f59
content-length: 7
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8

GET
H3 200 index.html Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame CAB9 544 B
506 B 8ms
7ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/index.js

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ee8ecd398278dff36bbad5cb9a54e943c80022ac81cff2df1845dc9236462e5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://wicked.tours/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 180
content-type: text/html; charset=utf-8
date: Thu, 20 Apr 2023 17:07:46 GMT
etag: "f4bc0b8d13f7569a7d131ef3d8e13b886e44929b877c19b6f82e95b46487be3b-br"
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 5
x-served-by: cache-fra-eddf8230028-FRA
x-timer: S1682010466.076767,VS0,VE0

GET
H3 200 index.b2335cb4.js Show response
tomis-bot.firebaseapp.com/bot/ Frame CAB9 17 KB
5 KB 11ms
10ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/bot/index.b2335cb4.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dfef746969cffcc595cb2bb47df8b167a9a31712be357e8665930284006d6160

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:46 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010466.110536,VS0,VE0
etag: "b778ce73910b51b8583747b2fc75027c646dc375651915a53f7fbd4d811fa2e5-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5207
x-cache-hits: 6

GET
H3 200 index.47e44334.js Show response
tomis-bot.firebaseapp.com/tomis-device-id/ Frame CAB9 1 KB
933 B 10ms
10ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3ed0b83d7241f070432962169fac9dd84bf8e66e07892602288fcbf1e9c85225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://tomis-bot.firebaseapp.com/tomis-device-id/index.html
Origin: https://tomis-bot.firebaseapp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230028-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Thu, 20 Apr 2023 17:07:46 GMT
last-modified: Thu, 13 Apr 2023 00:26:01 GMT
x-timer: S1682010466.110523,VS0,VE0
etag: "6b543a1921d12ac04e93ea0cbeddff2f1c055162424d343342b428bd2184b6e8-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 583
x-cache-hits: 5

GET
H3 200 / Show response
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame CAB9 16 B
55 B 799ms
798ms Fetch
application/json 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Requested by: Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/tomis-device-id/index.47e44334.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 469ab758cfe6a8ac93cda5872ca28655f6f874a2f6cceafa710fc01f52fc787d

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 20 Apr 2023 17:07:46 GMT
content-encoding: gzip
server: Google Frontend
etag: W/"10-MsjnYJT8tv1YDQIW8xqLq60iHcM"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
x-cloud-trace-context: 6f9fe145f45eeb8953521972512af528
cache-control: private
access-control-allow-credentials: true
function-execution-id: rlihjt7c3cmg
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36

OPTIONS
H3 204 /
us-central1-tomis-bot.cloudfunctions.net/isDomainValid/ Frame 0
0 128ms
127ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/isDomainValid/?domain=wicked.tours
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:46 GMT
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
function-execution-id: rc3xfrbqrrvn
server: Google Frontend
x-cloud-trace-context: 2548978ceb2bfd2188dbcd01f8784a28

POST
H3 201 / Show response
us-central1-tomis-bot.cloudfunctions.net/getTokenFromDeviceId/ Frame F212 806 B
606 B 127ms
127ms Fetch
application/json 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/getTokenFromDeviceId/
Requested by: Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: bfbdee384a1c8e101346fc619a2ccbce9852955a66184b9c2ec8d8ad386b79d9

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 20 Apr 2023 17:07:46 GMT
content-encoding: gzip
server: Google Frontend
etag: W/"326-JZ8N2EwYnrDtMd3903mAMfoSiSA"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
x-cloud-trace-context: f7fc5f47d4da2441502b39c6ef03e12e
cache-control: private
access-control-allow-credentials: true
function-execution-id: xavelojuri5v
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 586

OPTIONS
H3 204 /
us-central1-tomis-bot.cloudfunctions.net/getTokenFromDeviceId/ Frame 0
0 125ms
124ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/getTokenFromDeviceId/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, X-TWILIO-SIGNATURE, Content-Type, x-api-key
access-control-allow-methods: POST, OPTIONS, PUT, GET
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:46 GMT
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
function-execution-id: xavedzaaary1
server: Google Frontend
x-cloud-trace-context: b36456d1af2fc51b3fad61979f658764

POST
H2 200 verifyCustomToken Show response
www.googleapis.com/identitytoolkit/v3/relyingparty/ Frame F212 1 KB
1 KB 486ms
485ms XHR
application/json 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyCustomToken?key=AIzaSyAFvEZdXjVAVV5b2_sa55nd1DgMfGwBq8U

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

402bbe29df3bbfd69fdcb3eb0e7bbd023cdcd0bda9ce1026c27e83c2b46244a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://tomis-bot.firebaseapp.com/
X-Client-Version: Chrome/JsCore/8.10.1/FirebaseCore-web
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Thu, 20 Apr 2023 17:07:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-expose-headers: date,vary,vary,vary,content-encoding,server,content-length
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 839
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
api.amplitude.com/ 7 B
205 B 175ms
175ms XHR
text/html 35.80.188.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.80.188.69 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-80-188-69.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://wicked.tours/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 20 Apr 2023 17:07:46 GMT
strict-transport-security: max-age=15768000
trace-id: Root=1-64417162-555ecd233d8abd2773770562
content-length: 7
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8

OPTIONS
H2 200 verifyCustomToken
www.googleapis.com/identitytoolkit/v3/relyingparty/ Frame 0
0 203ms
105ms Preflight
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyCustomToken?key=AIzaSyAFvEZdXjVAVV5b2_sa55nd1DgMfGwBq8U

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-client-version
Access-Control-Request-Method: POST
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-client-version
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:46 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H2 200 hotjar-3290986.js Show response
static.hotjar.com/c/ 9 KB
4 KB 94ms
38ms Script
application/javascript 18.66.97.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3290986.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54TM3L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-10.fra56.r.cloudfront.net

Software

Resource Hash

36c1342b5955026d6943907cbf776f065e2efbfd8cdd96388b223585e4809284

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:46 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/40d338d53910fb610e9b5a1c1a4e74e8
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=60
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: jS_tVmevdeONJ64bnDrM9Zoo2CgR_dXltJufU0jLaqSFw_gxUt-1PQ==

GET
H2 200 modules.7968d78db5f2fb5dc9cf.js Show response
script.hotjar.com/ 261 KB
68 KB 48ms
7ms Script
application/javascript 52.222.236.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.7968d78db5f2fb5dc9cf.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3290986.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-43.fra56.r.cloudfront.net

Software

Resource Hash

9f8750a4bebff098ffeeb3026200cf8a9c83e5519405b72f4e51b05748751e57

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 15:43:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 5079
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 68742
last-modified: Thu, 20 Apr 2023 15:42:10 GMT
etag: "2211f1197af3e09e95c8146959ac235c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: 1zgBOFc9cXQ-6HDS0kLCcCNo9boBwl92vVwlcqlYTlvLL6gCzkNNdQ==

POST
H3 200 getAccountInfo Show response
www.googleapis.com/identitytoolkit/v3/relyingparty/ Frame F212 326 B
253 B 140ms
140ms XHR
application/json 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleapis.com/identitytoolkit/v3/relyingparty/getAccountInfo?key=AIzaSyAFvEZdXjVAVV5b2_sa55nd1DgMfGwBq8U

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dccb49732b053f8915456229900a1e9f181138e2a6a19e2619233f7a4eefba5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://tomis-bot.firebaseapp.com/
X-Client-Version: Chrome/JsCore/8.10.1/FirebaseCore-web
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Thu, 20 Apr 2023 17:07:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-expose-headers: date,vary,vary,vary,content-encoding,server,content-length
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 228
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

OPTIONS
H3 200 getAccountInfo
www.googleapis.com/identitytoolkit/v3/relyingparty/ Frame 0
0 104ms
104ms Preflight
text/html 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleapis.com/identitytoolkit/v3/relyingparty/getAccountInfo?key=AIzaSyAFvEZdXjVAVV5b2_sa55nd1DgMfGwBq8U

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-client-version
Access-Control-Request-Method: POST
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-client-version
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:47 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H2 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 54 B
458 B 185ms
158ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firestore.googleapis.com/google.firestore.v1.Firestore/Listen/channel?database=projects%2Ftomis-bot%2Fdatabases%2F(default)&VER=8&RID=67336&CVER=22&X-HTTP-Session-Id=gsessionid&%24httpHeaders=X-Goog-Api-Client%3Agl-js%2F%20fire%2F8.10.1%0D%0AContent-Type%3Atext%2Fplain%0D%0AAuthorization%3ABearer%20eyJhbGciOiJSUzI1NiIsImtpZCI6IjE2ZGE4NmU4MWJkNTllMGE4Y2YzNTgwNTJiYjUzYjUzYjE4MzA3NzMiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vdG9taXMtYm90IiwiYXVkIjoidG9taXMtYm90IiwiYXV0aF90aW1lIjoxNjgyMDEwNDY3LCJ1c2VyX2lkIjoiM2M1ZWU1YWMtNGUzZS00OTcyLTg5YWYtOWZiMzNjZmFkY2IyIiwic3ViIjoiM2M1ZWU1YWMtNGUzZS00OTcyLTg5YWYtOWZiMzNjZmFkY2IyIiwiaWF0IjoxNjgyMDEwNDY3LCJleHAiOjE2ODIwMTQwNjcsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnt9LCJzaWduX2luX3Byb3ZpZGVyIjoiY3VzdG9tIn19.IAO8yFViVsGfFfnfnkH1IjN5vW_De4WD_VQ_sQFuCeZL1KjrwPidT6IY-HeqCyLKhWuS8D5REHaEWA3OFEr3wRWTtZGeGjcvjST2YVGWgMs84YObzCJyi7w05iniTFFyHEEU6HGmN9JGORoZ9KlNweeWw-iGx0ACTHuZTfqSNpxfKAmHGZZzMHa_6YxeUghK30SU8N569PxEXW4UK60bJo1EohKz3bpfYG5KA_Yv6boPCNe-qP0fCzFjucT6jUtyvntOtv0dWm9Rx_plIgWXy3jhi27MefWWXHqJQT3IrJ1b_18euSsExDq-OXu9mwuFG_9PptaQ5byo_bCqPR703g%0D%0A&zx=w122eqwp2x0d&t=1

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8c1c3fdddc54aebd2015e9a1b57daf0ad27a895af5fd47539fc19339d4ef41a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 20 Apr 2023 17:07:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-client-wire-protocol: h2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-expose-headers: x-client-wire-protocol,x-http-session-id
cache-control: private
access-control-allow-credentials: true
x-http-session-id: 3jIp3JLpg4OHUlOAmlaQr_Zx2gzNDyD3XRzZiGfjkuc

GET
H2 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 13 KB
2 KB 672ms
671ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firestore.googleapis.com/google.firestore.v1.Firestore/Listen/channel?database=projects%2Ftomis-bot%2Fdatabases%2F(default)&gsessionid=3jIp3JLpg4OHUlOAmlaQr_Zx2gzNDyD3XRzZiGfjkuc&VER=8&RID=rpc&SID=Fe9dEJDYvPMN1FR5DcddoA&CI=1&AID=0&TYPE=xmlhttp&zx=epqso7zgf1a8&t=1

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

954172ac3f18822a576a375671d2f8bc3f160055c0bca89ee26e454b66f63408

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Referer, origin
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 121 B
139 B 671ms
671ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c371378a6d4842d9d443c10fa02e2cd296ada6f016b2336686bb0b8efcee4c92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

POST
H3 201 / Show response
us-central1-tomis-bot.cloudfunctions.net/initiateWebSession/ Frame F212 85 B
124 B 518ms
518ms Fetch
application/json 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/initiateWebSession/
Requested by: Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 4207f4406d256fb39bfeda1b7642d3996c0839c8b66b8b9100f7a04261b7145b

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjE2ZGE4NmU4MWJkNTllMGE4Y2YzNTgwNTJiYjUzYjUzYjE4MzA3NzMiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vdG9taXMtYm90IiwiYXVkIjoidG9taXMtYm90IiwiYXV0aF90aW1lIjoxNjgyMDEwNDY3LCJ1c2VyX2lkIjoiM2M1ZWU1YWMtNGUzZS00OTcyLTg5YWYtOWZiMzNjZmFkY2IyIiwic3ViIjoiM2M1ZWU1YWMtNGUzZS00OTcyLTg5YWYtOWZiMzNjZmFkY2IyIiwiaWF0IjoxNjgyMDEwNDY3LCJleHAiOjE2ODIwMTQwNjcsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnt9LCJzaWduX2luX3Byb3ZpZGVyIjoiY3VzdG9tIn19.IAO8yFViVsGfFfnfnkH1IjN5vW_De4WD_VQ_sQFuCeZL1KjrwPidT6IY-HeqCyLKhWuS8D5REHaEWA3OFEr3wRWTtZGeGjcvjST2YVGWgMs84YObzCJyi7w05iniTFFyHEEU6HGmN9JGORoZ9KlNweeWw-iGx0ACTHuZTfqSNpxfKAmHGZZzMHa_6YxeUghK30SU8N569PxEXW4UK60bJo1EohKz3bpfYG5KA_Yv6boPCNe-qP0fCzFjucT6jUtyvntOtv0dWm9Rx_plIgWXy3jhi27MefWWXHqJQT3IrJ1b_18euSsExDq-OXu9mwuFG_9PptaQ5byo_bCqPR703g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 20 Apr 2023 17:07:48 GMT
content-encoding: gzip
server: Google Frontend
etag: W/"55-Y8Qsvu6OcOue/60FSqIKpiJcWXw"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
x-cloud-trace-context: 07dd6608b559e24b09720791c7af71ea
cache-control: private
access-control-allow-credentials: true
function-execution-id: rvdxvsvp8mai
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104

OPTIONS
H3 204 /
us-central1-tomis-bot.cloudfunctions.net/initiateWebSession/ Frame 0
0 125ms
125ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/initiateWebSession/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, X-TWILIO-SIGNATURE, Content-Type, x-api-key
access-control-allow-methods: POST, OPTIONS, PUT, GET
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:48 GMT
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
function-execution-id: rvdx2w7dg7jk
server: Google Frontend
x-cloud-trace-context: d333ca7b1ae45e23f9954ff1e0ab74b4

POST
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 10 B
50 B 118ms
118ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firestore.googleapis.com/google.firestore.v1.Firestore/Listen/channel?database=projects%2Ftomis-bot%2Fdatabases%2F(default)&VER=8&gsessionid=3jIp3JLpg4OHUlOAmlaQr_Zx2gzNDyD3XRzZiGfjkuc&SID=Fe9dEJDYvPMN1FR5DcddoA&RID=67337&AID=4&zx=5mzhwfiz82sk&t=1

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

59e985a6b4503260116c50d3342d7b5bd34879a05f2a77521710b9caffd1f23d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 20 Apr 2023 17:07:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 9 KB
2 KB 117ms
117ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3018a4ad08d218dbf28a755a5f159f5f036e7790a1a3511b34153068ec467b99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 123 B
140 B 118ms
118ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

937166b39eb18a7e73bf3d5ba54b14f8745e38a9b98be4f21695cfd976a50c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

OPTIONS
H3 204 /
us-central1-tomis-bot.cloudfunctions.net/initiateWelcome/ Frame 0
0 135ms
135ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/initiateWelcome/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://tomis-bot.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, X-TWILIO-SIGNATURE, Content-Type, x-api-key
access-control-allow-methods: POST, OPTIONS, PUT, GET
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Thu, 20 Apr 2023 17:07:49 GMT
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
function-execution-id: 9uzxqkzpz0ki
server: Google Frontend
x-cloud-trace-context: c41498147b0b360103d3df2b5dac51ec;o=1

POST
H3 201 / Show response
us-central1-tomis-bot.cloudfunctions.net/initiateWelcome/ Frame F212 77 B
111 B 631ms
631ms Fetch
application/json 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-tomis-bot.cloudfunctions.net/initiateWelcome/
Requested by: Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: c0a4384dfc29e552cee79f9ccc2456a682c27d84ae52cc446e2e7ad96011639d

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjE2ZGE4NmU4MWJkNTllMGE4Y2YzNTgwNTJiYjUzYjUzYjE4MzA3NzMiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vdG9taXMtYm90IiwiYXVkIjoidG9taXMtYm90IiwiYXV0aF90aW1lIjoxNjgyMDEwNDY3LCJ1c2VyX2lkIjoiM2M1ZWU1YWMtNGUzZS00OTcyLTg5YWYtOWZiMzNjZmFkY2IyIiwic3ViIjoiM2M1ZWU1YWMtNGUzZS00OTcyLTg5YWYtOWZiMzNjZmFkY2IyIiwiaWF0IjoxNjgyMDEwNDY3LCJleHAiOjE2ODIwMTQwNjcsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnt9LCJzaWduX2luX3Byb3ZpZGVyIjoiY3VzdG9tIn19.IAO8yFViVsGfFfnfnkH1IjN5vW_De4WD_VQ_sQFuCeZL1KjrwPidT6IY-HeqCyLKhWuS8D5REHaEWA3OFEr3wRWTtZGeGjcvjST2YVGWgMs84YObzCJyi7w05iniTFFyHEEU6HGmN9JGORoZ9KlNweeWw-iGx0ACTHuZTfqSNpxfKAmHGZZzMHa_6YxeUghK30SU8N569PxEXW4UK60bJo1EohKz3bpfYG5KA_Yv6boPCNe-qP0fCzFjucT6jUtyvntOtv0dWm9Rx_plIgWXy3jhi27MefWWXHqJQT3IrJ1b_18euSsExDq-OXu9mwuFG_9PptaQ5byo_bCqPR703g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
server: Google Frontend
etag: W/"4d-TlWPNIpA4p7pxFHXbw9C8AkLyng"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
x-cloud-trace-context: 504b427ae6dd3ddaeb51a5d4f3565ef8
cache-control: private
access-control-allow-credentials: true
function-execution-id: me0oyyu8vp6o
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 91

POST
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 11 B
51 B 118ms
118ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6d87b337a42db16e2991a37811cd2201385a2b591792bbfc0c055119a9e73ec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31
x-xss-protection: 0

POST
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Write/ Frame F212 54 B
95 B 119ms
118ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firestore.googleapis.com/google.firestore.v1.Firestore/Write/channel?database=projects%2Ftomis-bot%2Fdatabases%2F(default)&VER=8&RID=95890&CVER=22&X-HTTP-Session-Id=gsessionid&%24httpHeaders=X-Goog-Api-Client%3Agl-js%2F%20fire%2F8.10.1%0D%0AContent-Type%3Atext%2Fplain%0D%0AAuthorization%3ABearer%20eyJhbGciOiJSUzI1NiIsImtpZCI6IjE2ZGE4NmU4MWJkNTllMGE4Y2YzNTgwNTJiYjUzYjUzYjE4MzA3NzMiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vdG9taXMtYm90IiwiYXVkIjoidG9taXMtYm90IiwiYXV0aF90aW1lIjoxNjgyMDEwNDY3LCJ1c2VyX2lkIjoiM2M1ZWU1YWMtNGUzZS00OTcyLTg5YWYtOWZiMzNjZmFkY2IyIiwic3ViIjoiM2M1ZWU1YWMtNGUzZS00OTcyLTg5YWYtOWZiMzNjZmFkY2IyIiwiaWF0IjoxNjgyMDEwNDY3LCJleHAiOjE2ODIwMTQwNjcsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnt9LCJzaWduX2luX3Byb3ZpZGVyIjoiY3VzdG9tIn19.IAO8yFViVsGfFfnfnkH1IjN5vW_De4WD_VQ_sQFuCeZL1KjrwPidT6IY-HeqCyLKhWuS8D5REHaEWA3OFEr3wRWTtZGeGjcvjST2YVGWgMs84YObzCJyi7w05iniTFFyHEEU6HGmN9JGORoZ9KlNweeWw-iGx0ACTHuZTfqSNpxfKAmHGZZzMHa_6YxeUghK30SU8N569PxEXW4UK60bJo1EohKz3bpfYG5KA_Yv6boPCNe-qP0fCzFjucT6jUtyvntOtv0dWm9Rx_plIgWXy3jhi27MefWWXHqJQT3IrJ1b_18euSsExDq-OXu9mwuFG_9PptaQ5byo_bCqPR703g%0D%0A&zx=47w3ugrghski&t=1

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a1ef6874b02bec0125d8c166a27f85bf7c3f0e3040e8073e100a0e7c3d888dad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-client-wire-protocol: h3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
access-control-expose-headers: x-client-wire-protocol,x-http-session-id
cache-control: private
access-control-allow-credentials: true
x-http-session-id: SU4TMVp7-ZXus5GRsM1nc-XJx_8AYsbauG0kGGW7heQ

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 316 B
199 B 117ms
117ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1a9a5d784068a3995b169d61e61fe1bcbb827080d9dd80f9e01a9749071e45d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Write/ Frame F212 66 B
105 B 637ms
636ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firestore.googleapis.com/google.firestore.v1.Firestore/Write/channel?database=projects%2Ftomis-bot%2Fdatabases%2F(default)&gsessionid=SU4TMVp7-ZXus5GRsM1nc-XJx_8AYsbauG0kGGW7heQ&VER=8&RID=rpc&SID=AK78KtVYLpBngfFfvPH1jA&CI=1&AID=0&TYPE=xmlhttp&zx=wnxn19k2osk3&t=1

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a96c079a315cfe48681799497cf50d7fd512b9b61886a65f54db3015869da1c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Referer, origin
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 14 KB
2 KB 118ms
117ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2eb18d7546f3e97f8f04260413a0851fec51e6f19e19b1609cb6605b4c1c2e92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

POST
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Write/ Frame F212 10 B
50 B 125ms
123ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firestore.googleapis.com/google.firestore.v1.Firestore/Write/channel?database=projects%2Ftomis-bot%2Fdatabases%2F(default)&VER=8&gsessionid=SU4TMVp7-ZXus5GRsM1nc-XJx_8AYsbauG0kGGW7heQ&SID=AK78KtVYLpBngfFfvPH1jA&RID=95891&AID=1&zx=papaa3riwlek&t=1

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

31629b6e592c9a12b6cf7047fd64324ab717e6f41d93af4bcbac67ca724919d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Write/ Frame F212 203 B
205 B 124ms
122ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f5d5f32810330da37eafbca7911b9b927575fc6cc45bf5324f482e7a91270b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 388 B
215 B 127ms
125ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b42f39bc79acaef71792e6607ec1ad0714689aa9d30371a7f196a17399cf2a81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Write/ Frame F212 186 B
182 B 122ms
122ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3e2f8f7c39235c4f83a2dc8b974161b4324f22cad536ea888f87ecfea500c68d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 15 KB
2 KB 118ms
118ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4e5fb5adaaa2672aac7bc28ea288371eb6d3115580928bcbd5bd6d42d0b4c75e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Write/ Frame F212 271 B
217 B 120ms
117ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e2953df6ab8ca4d4cb76f3faacc168654812d2ca9c59c5f77f3372d44ee67a92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

POST
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Write/ Frame F212 10 B
50 B 119ms
119ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

55d70f8ae93d7fce86697dcb3a57592de4d972a50df34f34ef5f12bdc1c61b9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://tomis-bot.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 20 Apr 2023 17:07:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 5 KB
843 B 118ms
118ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a2f9ae52a8a4ddc19bff71039bcd8a257bb9340ea8fb1d8269e2359360011ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

POST
H2 200 / Show response
api.amplitude.com/ 7 B
205 B 175ms
175ms XHR
text/html 35.80.188.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.amplitude.com/

Requested by

Host: cdn.amplitude.com
URL: https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.80.188.69 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-80-188-69.us-west-2.compute.amazonaws.com

Software

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://wicked.tours/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 20 Apr 2023 17:07:50 GMT
strict-transport-security: max-age=15768000
trace-id: Root=1-64417166-55867ef150f2b6c0304257e5
content-length: 7
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=21763102&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwicked.tours%2F&ul=en-us&de=UTF-8&dt=Award%20Winning%20Kelowna%20Wine%20Tours%20%7C%20Wicked%20Tours&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=TOMIS%20Chatbot&ea=Chatbot%20Message&el=Default%20Welcome%20Intent&_u=aDDAiEABBAAAAEAAIC~&jid=&gjid=&cid=608242382.1682010464&tid=UA-11247999-2&_gid=570593579.1682010464&gtm=45He34c0n7154TM3L&z=153404002

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wicked.tours/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Apr 2023 03:01:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 50786
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Write/ Frame F212 271 B
217 B 118ms
118ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b78e0780c7fa7ee908fada5728eb0ff661f0480c86e71f83b5a1d4d45cabe885

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel Show response
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 15 KB
2 KB 118ms
118ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b7d7f942d09836f42ab9cd912e4d1631e4a11792aa1e9dbed358a9ad4bd2d43d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel
firestore.googleapis.com/google.firestore.v1.Firestore/Write/ Frame F212 17 B
0 118ms
117ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

GET
H3 200 channel
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/ Frame F212 18 B
0 119ms
119ms XHR
text/plain 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: tomis-bot.firebaseapp.com
URL: https://tomis-bot.firebaseapp.com/bot/index.efc8cf97.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tomis-bot.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 17:07:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://tomis-bot.firebaseapp.com
cache-control: private, max-age=0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

53 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.wicked.tours/	1970-01-20 20:49:30	Name: _ga_G2TMJJ58WS Value: GS1.2.1682010464.1.0.1682010464.60.0.0
.wicked.tours/	1970-01-20 20:49:30	Name: _ga Value: GA1.2.608242382.1682010464
.wicked.tours/	1970-01-20 11:14:56	Name: _gid Value: GA1.2.570593579.1682010464
.wicked.tours/	1970-01-20 11:13:30	Name: _dc_gtm_UA-11247999-2 Value: 1
.wicked.tours/	1970-01-20 13:23:06	Name: _fbp Value: fb.1.1682010464676.1254391038
.wicked.tours/	1970-01-20 20:49:30	Name: amplitude_id_86032f1ec343111e3a3634d7af85f343wicked.tours Value: eyJkZXZpY2VJZCI6IjY5ZmIzMTM3LTc1YTMtNGJkZC1iNGFkLTZmZDdhMGIxNjk0YSIsInVzZXJJZCI6bnVsbCwib3B0T3V0IjpmYWxzZSwic2Vzc2lvbklkIjoxNjgyMDEwNDY1ODk2LCJsYXN0RXZlbnRUaW1lIjoxNjgyMDEwNDY1OTI2LCJldmVudElkIjoxLCJpZGVudGlmeUlkIjoxLCJzZXF1ZW5jZU51bWJlciI6Mn0=
.wicked.tours/	1970-01-20 19:59:06	Name: _hjSessionUser_3290986 Value: eyJpZCI6IjZlYTgyNDc2LTI0YzEtNTc1MC1hZmVjLWQ0MzVlOWQzY2ZhNCIsImNyZWF0ZWQiOjE2ODIwMTA0NjY4ODgsImV4aXN0aW5nIjpmYWxzZX0=
.wicked.tours/	1970-01-20 11:13:32	Name: _hjFirstSeen Value: 1
.wicked.tours/	1970-01-20 11:13:30	Name: _hjIncludedInSessionSample_3290986 Value: 0
.wicked.tours/	1970-01-20 11:13:32	Name: _hjSession_3290986 Value: eyJpZCI6IjdhMzRlNDMzLWY5M2UtNGQyYS04ZTEwLTVlOWQ4ZDU3NDRkNCIsImNyZWF0ZWQiOjE2ODIwMTA0NjY4OTYsImluU2FtcGxlIjpmYWxzZX0=
.wicked.tours/	1970-01-20 11:13:32	Name: _hjAbsoluteSessionInProgress Value: 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.amplitude.com
cdn.amplitude.com
cdnjs.cloudflare.com
connect.facebook.net
firestore.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
region1.analytics.google.com
script.hotjar.com
static.hotjar.com
stats.g.doubleclick.net
tomis-bot.firebaseapp.com
us-central1-tomis-bot.cloudfunctions.net
wicked.tours
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleapis.com
www.googletagmanager.com
161.35.113.156
18.66.97.10
2001:4860:4802:32::36
2001:4860:4802:36::36
2606:4700::6811:180e
2620:0:890::100
2a00:1450:4001:802::2003
2a00:1450:4001:80b::2003
2a00:1450:4001:812::200a
2a00:1450:4001:828::200a
2a00:1450:4001:82f::2004
2a00:1450:4001:830::200a
2a00:1450:4001:830::200e
2a00:1450:4001:831::2008
2a00:1450:400c:c0c::9d
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
35.80.188.69
52.222.206.214
52.222.236.43
091ba5711e7f397eca67fb1da60968a88be608d2f4fb80955ef74f645b6e898b
16eb18d9c6303cdd50ac58db5b2b116c5dcc4c43c89424f268f6d13fc599fb19
1771aad88d0164b8f869d097851c94cc83d1a837f12fe8de39d0f309fe45f33c
19dc97be99f367c5d9f9af51571bc1f698d1673f754a39f1b14cf268682cb004
1a9a5d784068a3995b169d61e61fe1bcbb827080d9dd80f9e01a9749071e45d7
202ee5b585222e2c8660b175f70624ec845320e95ec306ede1e9ad6ca12ec453
2173f130ca59dc5554498343432f02f92ecce45c4f9381ea12b203a2978f33d4
2eb18d7546f3e97f8f04260413a0851fec51e6f19e19b1609cb6605b4c1c2e92
3018a4ad08d218dbf28a755a5f159f5f036e7790a1a3511b34153068ec467b99
31629b6e592c9a12b6cf7047fd64324ab717e6f41d93af4bcbac67ca724919d8
36c1342b5955026d6943907cbf776f065e2efbfd8cdd96388b223585e4809284
3e2f8f7c39235c4f83a2dc8b974161b4324f22cad536ea888f87ecfea500c68d
3ed0b83d7241f070432962169fac9dd84bf8e66e07892602288fcbf1e9c85225
3f5d57557ed2fd980dffacc7cc50b0adddf2950a14f20bbf38f6ac00f604f2b4
402bbe29df3bbfd69fdcb3eb0e7bbd023cdcd0bda9ce1026c27e83c2b46244a6
4207f4406d256fb39bfeda1b7642d3996c0839c8b66b8b9100f7a04261b7145b
42b39185be46ac326521061b9f4e9653e1a38834c4e519f1e7c06c3976b9d2a1
469ab758cfe6a8ac93cda5872ca28655f6f874a2f6cceafa710fc01f52fc787d
471dd8de454f9557c0acbdca68a708e806cbd376aaa2c151dbd7c33a1fc9ee31
4e5fb5adaaa2672aac7bc28ea288371eb6d3115580928bcbd5bd6d42d0b4c75e
5108d0adbc43671f8d004a74b15ae5c567291feb89ff81c0fe4cab24ed7a19f9
55d70f8ae93d7fce86697dcb3a57592de4d972a50df34f34ef5f12bdc1c61b9d
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
59e985a6b4503260116c50d3342d7b5bd34879a05f2a77521710b9caffd1f23d
5c80505133c2b387dbe571c9b908be7e815b86ec57d1cb8de7f1b8212cb0d304
5d2daebf3aef880f90c88253bcd48338de8886ee772559966c2594fae8e14e3a
5ecde8139d54c8f612a3ff111da9989ae1ca04aa6b578522607339b6c57ab921
62606f97e65450a490bdfcceab927cd9979c854c26ab7235b7c56ba13e31d3a4
62de08d5f2ca4f8a75442cf21bbde488ac9585d7604cac85d7889c61b8dfa5eb
6d87b337a42db16e2991a37811cd2201385a2b591792bbfc0c055119a9e73ec9
6e86a52a9858206302e32036d89907e3ac87762055e7f9c6364aec33221b3e41
6efab6d334551dc2f787603f093acf40abb37df4219d78aa53c02c71c917e9fa
6f74cd5afbfe6fab11489dfcc70fb996ccd7b3dc935927d7402aa285d9692207
761e4c699f6f3374e0b754376dda71a033e55fdb60860c63c0c1320d0d44bbdd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84b09adb8db75d48aa7dbe054995b67cad4d429bd4c985d73ba949a84ebc0f97
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8c1c3fdddc54aebd2015e9a1b57daf0ad27a895af5fd47539fc19339d4ef41a5
90df4f4aefb6c74a0a7ecaca27826bf34ddeb5aeafea63fe05e0843e97e2a172
91c88ba09686f1391fe968314a39a50749c546da6bd6cdadd20bcdc2026bef86
937166b39eb18a7e73bf3d5ba54b14f8745e38a9b98be4f21695cfd976a50c11
947e611b2cb75cb862f3802ca9d4f81cce21680d57204dfa300396e6c5526479
954172ac3f18822a576a375671d2f8bc3f160055c0bca89ee26e454b66f63408
9a2f9ae52a8a4ddc19bff71039bcd8a257bb9340ea8fb1d8269e2359360011ce
9f8750a4bebff098ffeeb3026200cf8a9c83e5519405b72f4e51b05748751e57
a1ef6874b02bec0125d8c166a27f85bf7c3f0e3040e8073e100a0e7c3d888dad
a96c079a315cfe48681799497cf50d7fd512b9b61886a65f54db3015869da1c1
a9790234a136995375cb11bf47d71a34fcc2bda0afbc2491459c6ac095e7cbd6
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b42f39bc79acaef71792e6607ec1ad0714689aa9d30371a7f196a17399cf2a81
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
b78e0780c7fa7ee908fada5728eb0ff661f0480c86e71f83b5a1d4d45cabe885
b7d7f942d09836f42ab9cd912e4d1631e4a11792aa1e9dbed358a9ad4bd2d43d
bdd6e29b3886816b933e6c994cf33b6f01d7239a484b844c676c473bc53bfc83
bfbdee384a1c8e101346fc619a2ccbce9852955a66184b9c2ec8d8ad386b79d9
c0a4384dfc29e552cee79f9ccc2456a682c27d84ae52cc446e2e7ad96011639d
c212941bd3343394223cad357d82517cf533e8cd0d0ca8f211bfa0d990f38952
c2c2302b5ee2629a243e633d6b69610fd35586ccd25f9402332ee496b51ceb3e
c371378a6d4842d9d443c10fa02e2cd296ada6f016b2336686bb0b8efcee4c92
c5bc50841241c4316ad7fcdf45b53b4e3efd5c50746d74f96751abb36b18e42a
dccb49732b053f8915456229900a1e9f181138e2a6a19e2619233f7a4eefba5f
dd4a241aeeddd5025a307e0f5db1f27409021a3e3b36753b9f9a6f18040356e1
dd793f388b75eaac775499490fb337299e291bb46d8423f44259a01ed84f110e
deac51a86192d922ceac425210427bb85c528055c35230237e306e3dd2d5fa93
df0dd4a3dece70f531b0671cb663056b246c9e23fd3d1a86eafef5e42e026f92
dfd1078f29da41cd957ea0b0ad52513a4527812d050530b857af5a0d03b333a1
dfef746969cffcc595cb2bb47df8b167a9a31712be357e8665930284006d6160
e00259d0de8af424931c41b058fe6ec25c0db438656ddca326cb5ac1c6942777
e2953df6ab8ca4d4cb76f3faacc168654812d2ca9c59c5f77f3372d44ee67a92
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5e3d6fdd78fb14597e2501ec74b3d5c730d13a2e6718a18a8639e43cdc9d34e
ece88845d2c0a327f6a7957ec596d1014820fbfb62b31a13b8152a28dbd41bb5
ee8ecd398278dff36bbad5cb9a54e943c80022ac81cff2df1845dc9236462e5b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f17dd997533ce70ba71e1a22cefc1129190437da5cfc6484b60d5fd6da6fa98c
f4230ced8d4264c7d87c89dd662ed160243569667d5d1fc586b94d65fb771618
f5d5f32810330da37eafbca7911b9b927575fc6cc45bf5324f482e7a91270b81
f9d31b51412832f83a0182cc5b19be4d549e86b10eb26b7a0646aed3e369b77d
fcf5dafc9569e422bcc4427c8a68efead79dac1e37a8e1b1237219dc5a17927c
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

wicked.tours Open in urlscan Pro 161.35.113.156 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

117 Requests

100 %HTTPS

75 %IPv6

15 Domains

20 Subdomains

21 IPs

3 Countries

2194 kBTransfer

5397 kBSize

11 Cookies

21 Outgoing links

Redirected requests

117 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

wicked.tours Open in urlscan Pro
161.35.113.156 Public Scan

Screenshot
Live screenshot

Full Image

117
Requests

100 %
HTTPS

75 %
IPv6

15
Domains

20
Subdomains

21
IPs

3
Countries

2194 kB
Transfer

5397 kB
Size

11
Cookies

117 HTTP transactions
1 data transactions