faresbuddies.com Open in urlscan Pro
2606:4700:3030::ac43:b1b5 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.www.www.www.sitemap.aircamada.ca/
Effective URL:
https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6
Submission: On November 27 via api (November 27th 2024, 2:00:41 pm UTC) from US — Scanned from CA

Summary HTTP 89 Redirects Behaviour Indicators

Summary

This website contacted 10 IPs in 2 countries across 9 domains to perform 89 HTTP transactions. The main IP is 2606:4700:3030::ac43:b1b5, located in United States and belongs to CLOUDFLARENET, US. The main domain is faresbuddies.com.
TLS certificate: Issued by WE1 on October 5th 2024. Valid for: 3 months.

This is the only time faresbuddies.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.233.219.123 172.233.219.123	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
2	72.52.178.23 72.52.178.23	32244 (LIQUIDWEB) (LIQUIDWEB)
1 4	103.224.182.206 103.224.182.206	133618 (TRELLIAN-...) (TRELLIAN-AS-AP Trellian Pty. Limited)
46	2606:4700:303... 2606:4700:3030::ac43:b1b5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:820::2008	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80e::200a	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80c::2003	15169 (GOOGLE) (GOOGLE)
29	2606:4700:10:... 2606:4700:10::ac43:f0e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
89	10

1 172.233.219.123 (Chicago, United States) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: viridian02.parklogic.com

www.www.www.www.sitemap.aircamada.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.52.178.23 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: lb01.parklogic.com

ww99.aircamada.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 103.224.182.206 (Australia) 1 redirects

ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU)
PTR: bidr.trellian.com

biruuq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

46 2606:4700:3030::ac43:b1b5 (United States)

ASN13335 (CLOUDFLARENET, US)

faresbuddies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:820::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80e::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80c::2003 (United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2606:4700:10::ac43:f0e (United States)

ASN13335 (CLOUDFLARENET, US)

embed.tawk.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
va.tawk.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
46	faresbuddies.com faresbuddies.com	656 KB
29	tawk.to embed.tawk.to — Cisco Umbrella Rank: 11098 va.tawk.to — Cisco Umbrella Rank: 10657	286 KB
4	biruuq.com 1 redirects biruuq.com	18 KB
3	aircamada.ca 1 redirects www.www.www.www.sitemap.aircamada.ca ww99.aircamada.ca	4 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 318	42 KB
2	gstatic.com fonts.gstatic.com	15 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	2 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3353
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	132 KB
89	9

	Domain	Requested by
46	faresbuddies.com	biruuq.com faresbuddies.com
24	embed.tawk.to	faresbuddies.com embed.tawk.to
5	va.tawk.to	embed.tawk.to
4	biruuq.com	1 redirects ww99.aircamada.ca biruuq.com
2	cdn.jsdelivr.net	embed.tawk.to
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	faresbuddies.com
2	ww99.aircamada.ca	ww99.aircamada.ca
1	region1.google-analytics.com	www.googletagmanager.com
1	www.googletagmanager.com	faresbuddies.com
1	www.www.www.www.sitemap.aircamada.ca	1 redirects
89	11

This site contains no links.

Subject Issuer	Validity	Valid
*.aircamada.ca R10	`2024-10-24` - `2025-01-22`	3 months	crt.sh
filmtv.au R11	`2024-09-28` - `2024-12-27`	3 months	crt.sh
faresbuddies.com WE1	`2024-10-05` - `2025-01-03`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
tawk.to WE1	`2024-11-19` - `2025-02-17`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6
Frame ID: 0A6933FAB56DAF2A4818D3832D08E1E9
Requests: 78 HTTP requests in this frame

Frame: https://embed.tawk.to/_s/v4/app/67354992019/css/min-widget.css
Frame ID: 019798178A3168AF780FF2667F63932D
Requests: 1 HTTP requests in this frame

Frame: https://embed.tawk.to/_s/v4/app/67354992019/css/bubble-widget.css
Frame ID: 0F26BFC34AF8C1FFFD96F3627A28250C
Requests: 3 HTTP requests in this frame

Frame: https://embed.tawk.to/_s/v4/app/67354992019/css/message-preview.css
Frame ID: 35D9CECF7027D9D868D655FC7ACAF03E
Requests: 4 HTTP requests in this frame

Frame: https://embed.tawk.to/_s/v4/app/67354992019/css/max-widget.css
Frame ID: 257468840ABBC6D5A5F2659FBDD05AD1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

1 new message

Page URL History Show full URLs

https://www.www.www.www.sitemap.aircamada.ca/ HTTP 302
http://ww99.aircamada.ca/ HTTP 307
https://ww99.aircamada.ca/ Page URL
https://ww99.aircamada.ca/page/bouncy.php?&bpae=GbhGczsbwtR5jkvEnJDGSK%2B%2B5rnyMxw29TK35i6Le1VlW0svWf... Page URL
http://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050... HTTP 307
https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050... Page URL
http://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050... HTTP 307
https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050... Page URL
http://biruuq.com/f2.php?e=bRok7L6H1f60O4Waw8g%2FT349fmQ4MC94YnNjakpFUm5KbFhHeWlSOXZJT3JNdS9CZ... HTTP 307
https://biruuq.com/f2.php?e=bRok7L6H1f60O4Waw8g%2FT349fmQ4MC94YnNjakpFUm5KbFhHeWlSOXZJT3JNdS9CZ... HTTP 302
https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Tawk.to (Live Chat) Expand

Overall confidence: 100%
Detected patterns

//embed\.tawk\.to

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css
owl\.carousel.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

89
Requests

96 %
HTTPS

70 %
IPv6

9
Domains

11
Subdomains

10
IPs

2
Countries

1155 kB
Transfer

4059 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.www.www.www.sitemap.aircamada.ca/ HTTP 302
http://ww99.aircamada.ca/ HTTP 307
https://ww99.aircamada.ca/ Page URL
https://ww99.aircamada.ca/page/bouncy.php?&bpae=GbhGczsbwtR5jkvEnJDGSK%2B%2B5rnyMxw29TK35i6Le1VlW0svWfM5bsSKbQGqrr9%2FaNcmHX7Z0YhQF%2FTa%2FJGxR5T9XoLfim%2B%2F%2FneH3SFKKppxpeP54U36a20YkhNV0GTFlwHaauT4N7kwbBNEL68dAF3HKC2VgTtAghFqiqrSIDAgO0vKyhX83tSt5prP2UyWlQa84fOQKulBZQlnxVytx3FRjklYtCNgDHia21qlI8nABL%2B0VCYuRYeR6YSgNv7sp%2F2kbpdbF62Ae9U2oLAqS%2F5lO%2BNSt3MPea4MgenLNpesOUr%2B8GUWKo5S1xvQSxGdHJ2GB8QsxCsdVpqf2e4qya3kzgOZLr%2F79DFa3THlB7kPIWNza%2F8oVAaK6fQMzNfF54SH9EGQ2pXGUN3kFEneMz22xOfUMSA%2BwbYQ4EqqG8vhjT%2BzydFTSp94VPxnHBPCR0wxXE%2FbIzOXWnRikhZZmG0nC0bXcLDuG4ZLQcFaD5gvqXvJOZSGnS5VwXR8c4M8373%2BBs8ZI3mO6%2FHF8rYRK1p5OgMONrnd6Hkp%2FvY04bzRQACjaMcVMa0LsNIm2X%2B43X2HmYVm4bT%2FwEnDHxp%2FsgQLsk7Io%2FwJkxtAhH2c%2FYDWoXRvBG5NBY7ayhnrPkb2Pcb8pt1NKd63Taqv%2BRBXWdb5hsR%2FUcEIoqiTMRkhE2tT4GX3FaYswsDOYGc4ZZ9iTfLt2ZGhN4nW%2BzbPtCRqRazvqjRRLPRTE6cJIBF1AEN6euvYXJnpEtkTtS63g%2Bb%2BT8QuSBatQoReWEUBmYLCXefDe3JfKLn4r3zVo5YE5SYUettH0yUSGb9fIX68qhoRQUyIbyDZXrhc8VJJE1P7TSeiErX5RqeMT%2Fdc76e%2BKHgcIvlfB9o9MtWP%2BURA1SEHhSL6rGUD4qCvidhEvorJPV%2FwxLN7B6Px3d29uCBBL9uCGIKs9VIQ0aQAMA6p7leCe%2BlHjcuAorYW6Uc%2Fr9P9l7C1QFfBYv8usGjqcDp5o8nxtgj6usQx3ktBeZtg2yJ4ReO2Vfi%2Fsqu9tVlhykoJ6bGPWHs1wJh1jBNBaOgRMnx0BHaCNNr5oE5JtC0VVVYY3g0YSSNSdx1pQS4es7%2BLtwhusT7QZsAKPSJDTL4Do8euXowvLSR926yUEZ1zHxlWoQLXDRdR%2BN%2BCMMvJ4Q3JDGOhf4tTaG4FUPQsz%2Bi0eQ4YD3T%2BfhQsTHOFOfzk6zA8Mpl2ovqT9RWVTSXgkah%2FZTwOowD%2Bsx9WryMiUhAx6vg6gf%2BUmaRzkCQ%2FIhrZb4blSTpYCidgHupJHAfYbAXIGd7NEQNMS8%2BBNVPQa0WIvGlP9dOeVqj%2FfRPztZJJ%2B38dpx8wED6vVV2qZT8fjuZ9i8osHNRPb1dQ18elgJW4bjIHHXF%2FVSTCma0bQD23WelDzySFeBmSTW8DA2Z3Nqodcllv1DmipOqZxEalJ16WDPYD%2F0MuxL4hYaf2BmJPupSQ92cMQ9APpNkUVmRnRNkl%2BgqNuNbm%2FXdMJZovn9sZ1yNaUDUKg2fyuEUV78psGZ5PCAld0YuvIIbSxiyy8%2B87UbUfVPmzx%2FBOzpYU%2BskAhbkpHKJrNvZ96p9%2FjpkC1%2FjVbd%2F534FR1lzVnsmAchY33Cm2eS0M1jZVUNzqMqGT5bEBU4StpTHIHDKjDZrnglk3p7vY2ar1d8uXIh3h15D9acTY1E%2BEzLeMwn7L3BRcovwkVhJkQx7Zdfb4jhkyI7aSjvghzEy%2By3jA%2FXWb984pht4LoIkVnGaTi7vC1gxuw11TxsaYaPExitnKtDy8t5QS8ggyt%2F62QUMHFjI8p0LdCr7iHYCNDoluJEc7cQ%3D%3D&redirectType=js&inIframe=false&inPopUp=false Page URL
http://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D HTTP 307
https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D Page URL
http://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D&fp=7fe7f2e16dd7f48c00a4ea8141734fea HTTP 307
https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D&fp=7fe7f2e16dd7f48c00a4ea8141734fea Page URL
http://biruuq.com/f2.php?e=bRok7L6H1f60O4Waw8g%2FT349fmQ4MC94YnNjakpFUm5KbFhHeWlSOXZJT3JNdS9CZHRpVDdLYk1oMkhMRVkva3g3Mm1JOG9qc1oyN21IaTlBckNKQUxvYXMyUlJ6SWtXL25QU3Z4bjhiQXA4Qk56cVRmdDVvM093UWtpMlpRazRaS08vOE80aDRXSm9vU3B0QWFXWlBQZ01tcW5NVlBPNlBxaUdtanBXZlpFZDBSKy8za1c0V0V0ZmlkODVDZTNTWGF5M3hFZjNSNS9xRVBFdGJLbnVjVVVUbXVlZkFuNHdKK3R1MjRXZzU1VTBTeGpWRzQ3Q1U3THN6MVBiV0x4bEY0VWpHT0prSEsxekRENmpEV1g3dWZ6bGN6aEpsZEtEYkJDZmFzSDdRc0tKOFB3R0lOU0pvOTlEV0hXQlN6N1NxTUQzV0tJUDdDQitVcTZzeVRkNUp1UlFkSDZzdjRqVVB3bTN0djFZV1RId2xrS0tZSlprWmlweWNJNE5pdXZlY2xWK0RoS1BjYkVDaHNsbW9FVm1TdEZaZUorUXNBSDV3QlJRN1Q5THBZYm9XY0VNb0tYVEVnczBvSE9tYnJkSitIWUFSTWNpbnA3MGpEb3hHMjNqNmZXZmMrTjZTWVFmQk0rS0ZGT08zTEEwcjc0ck00eGRDTGo3ODM1d0MrbU5ObUc4L1ZEUDRYNWJxdThXb0szeWNCYXlyWGo2ODhXUUJncWtlZVB0NHFTaGdnS2hRTTg4bTdLRnI4ejBvVml6M0V0Wk5CVXhBQ2ZKWVB4NXRxeGRkWmVOU0Q2Mms3dXdpRUZjTm9tV2VQeU9oNTNBV2NkM1dRVy9HSzRFS2FKSWFuL0NSOVdEYkdybjVGT2FhVlBmSDJHK3ZTNVFNWGx5VmNQNHV5cGJ4MElTMUtFSnNVMVc0N1NMdUxFcFU0OEJwYjQ1ajlBTWYvYUpSMXN1ZlRqUHJOeUJ0QnhzT20xU3lHV0FhbjUwbVJ5bkw4VTFqaWhteWE4cU9JR3VKMFRtYVNuS08zbnN4ZmxHbkVxUm9ENlJvTWxMemJjaXJTekNpVDRYSVlQL0s4ZE0yUjVSZEtPbXhXKy9qZUlaSXgzWFNQWEdNTDZZUmJzYXNUandqL0NnNnFkUTNFYlJJQXVXaTZCbzJmaEc4SzFiSEpIOTlzd1VoRzBqVjlYUzFmNlhnNHcxV1pVczlXSGY4Wi9OdDA4YUZMTkg3RGQvOE9TNlNkbFFhRjFDb0V0bGVyWEJQRVl1aUhkUWdEV1NMZERLT3VDcTBtUjNEZzRveTdKMUVaNWtaZ1JEQldrWGJjMmEyVnZyVk81ei9iSDJiUXN2aXhMSXdYcGo1bXFReEJxZHFZTmdyVkwvZ3lua21xRzZxN1VtSW5ISWxoY25IVXhYTmRIV1M3VzFkMEhGTEo5d1QvaXAyYTMrYUxwVm1jMlEvSzdHN0pMZ1AzdWJYeE52MHJNL3QycU5tQU4zYWhyY1NnNjZZczFybURycm9qT2VlamdZUWRiZFk5a01GQT0%3D&vs=1600:1200&ds=1600:1200&sl=50:50&os=f&nos=f HTTP 307
https://biruuq.com/f2.php?e=bRok7L6H1f60O4Waw8g%2FT349fmQ4MC94YnNjakpFUm5KbFhHeWlSOXZJT3JNdS9CZHRpVDdLYk1oMkhMRVkva3g3Mm1JOG9qc1oyN21IaTlBckNKQUxvYXMyUlJ6SWtXL25QU3Z4bjhiQXA4Qk56cVRmdDVvM093UWtpMlpRazRaS08vOE80aDRXSm9vU3B0QWFXWlBQZ01tcW5NVlBPNlBxaUdtanBXZlpFZDBSKy8za1c0V0V0ZmlkODVDZTNTWGF5M3hFZjNSNS9xRVBFdGJLbnVjVVVUbXVlZkFuNHdKK3R1MjRXZzU1VTBTeGpWRzQ3Q1U3THN6MVBiV0x4bEY0VWpHT0prSEsxekRENmpEV1g3dWZ6bGN6aEpsZEtEYkJDZmFzSDdRc0tKOFB3R0lOU0pvOTlEV0hXQlN6N1NxTUQzV0tJUDdDQitVcTZzeVRkNUp1UlFkSDZzdjRqVVB3bTN0djFZV1RId2xrS0tZSlprWmlweWNJNE5pdXZlY2xWK0RoS1BjYkVDaHNsbW9FVm1TdEZaZUorUXNBSDV3QlJRN1Q5THBZYm9XY0VNb0tYVEVnczBvSE9tYnJkSitIWUFSTWNpbnA3MGpEb3hHMjNqNmZXZmMrTjZTWVFmQk0rS0ZGT08zTEEwcjc0ck00eGRDTGo3ODM1d0MrbU5ObUc4L1ZEUDRYNWJxdThXb0szeWNCYXlyWGo2ODhXUUJncWtlZVB0NHFTaGdnS2hRTTg4bTdLRnI4ejBvVml6M0V0Wk5CVXhBQ2ZKWVB4NXRxeGRkWmVOU0Q2Mms3dXdpRUZjTm9tV2VQeU9oNTNBV2NkM1dRVy9HSzRFS2FKSWFuL0NSOVdEYkdybjVGT2FhVlBmSDJHK3ZTNVFNWGx5VmNQNHV5cGJ4MElTMUtFSnNVMVc0N1NMdUxFcFU0OEJwYjQ1ajlBTWYvYUpSMXN1ZlRqUHJOeUJ0QnhzT20xU3lHV0FhbjUwbVJ5bkw4VTFqaWhteWE4cU9JR3VKMFRtYVNuS08zbnN4ZmxHbkVxUm9ENlJvTWxMemJjaXJTekNpVDRYSVlQL0s4ZE0yUjVSZEtPbXhXKy9qZUlaSXgzWFNQWEdNTDZZUmJzYXNUandqL0NnNnFkUTNFYlJJQXVXaTZCbzJmaEc4SzFiSEpIOTlzd1VoRzBqVjlYUzFmNlhnNHcxV1pVczlXSGY4Wi9OdDA4YUZMTkg3RGQvOE9TNlNkbFFhRjFDb0V0bGVyWEJQRVl1aUhkUWdEV1NMZERLT3VDcTBtUjNEZzRveTdKMUVaNWtaZ1JEQldrWGJjMmEyVnZyVk81ei9iSDJiUXN2aXhMSXdYcGo1bXFReEJxZHFZTmdyVkwvZ3lua21xRzZxN1VtSW5ISWxoY25IVXhYTmRIV1M3VzFkMEhGTEo5d1QvaXAyYTMrYUxwVm1jMlEvSzdHN0pMZ1AzdWJYeE52MHJNL3QycU5tQU4zYWhyY1NnNjZZczFybURycm9qT2VlamdZUWRiZFk5a01GQT0%3D&vs=1600:1200&ds=1600:1200&sl=50:50&os=f&nos=f HTTP 302
https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.www.www.www.sitemap.aircamada.ca/ HTTP 302
http://ww99.aircamada.ca/ HTTP 307
https://ww99.aircamada.ca/

Request Chain 2

http://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D HTTP 307
https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D

Request Chain 5

http://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D&fp=7fe7f2e16dd7f48c00a4ea8141734fea HTTP 307
https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D&fp=7fe7f2e16dd7f48c00a4ea8141734fea

89 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/
ww99.aircamada.ca/
Redirect Chain

https://www.www.www.www.sitemap.aircamada.ca/
http://ww99.aircamada.ca/
https://ww99.aircamada.ca/

6 KB
2 KB

1146ms
775ms

Document
text/html

72.52.178.23
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://ww99.aircamada.ca/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 72.52.178.23 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb01.parklogic.com
Software: openresty / PHP/5.4.16
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 27 Nov 2024 14:00:25 GMT
server: openresty
x-powered-by: PHP/5.4.16

Redirect headers

Location: https://ww99.aircamada.ca/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 bouncy.php
ww99.aircamada.ca/page/ 5 KB
1 KB 79ms
78ms Document
text/html 72.52.178.23
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://ww99.aircamada.ca/page/bouncy.php?&bpae=GbhGczsbwtR5jkvEnJDGSK%2B%2B5rnyMxw29TK35i6Le1VlW0svWfM5bsSKbQGqrr9%2FaNcmHX7Z0YhQF%2FTa%2FJGxR5T9XoLfim%2B%2F%2FneH3SFKKppxpeP54U36a20YkhNV0GTFlwHaauT4N7kwbBNEL68dAF3HKC2VgTtAghFqiqrSIDAgO0vKyhX83tSt5prP2UyWlQa84fOQKulBZQlnxVytx3FRjklYtCNgDHia21qlI8nABL%2B0VCYuRYeR6YSgNv7sp%2F2kbpdbF62Ae9U2oLAqS%2F5lO%2BNSt3MPea4MgenLNpesOUr%2B8GUWKo5S1xvQSxGdHJ2GB8QsxCsdVpqf2e4qya3kzgOZLr%2F79DFa3THlB7kPIWNza%2F8oVAaK6fQMzNfF54SH9EGQ2pXGUN3kFEneMz22xOfUMSA%2BwbYQ4EqqG8vhjT%2BzydFTSp94VPxnHBPCR0wxXE%2FbIzOXWnRikhZZmG0nC0bXcLDuG4ZLQcFaD5gvqXvJOZSGnS5VwXR8c4M8373%2BBs8ZI3mO6%2FHF8rYRK1p5OgMONrnd6Hkp%2FvY04bzRQACjaMcVMa0LsNIm2X%2B43X2HmYVm4bT%2FwEnDHxp%2FsgQLsk7Io%2FwJkxtAhH2c%2FYDWoXRvBG5NBY7ayhnrPkb2Pcb8pt1NKd63Taqv%2BRBXWdb5hsR%2FUcEIoqiTMRkhE2tT4GX3FaYswsDOYGc4ZZ9iTfLt2ZGhN4nW%2BzbPtCRqRazvqjRRLPRTE6cJIBF1AEN6euvYXJnpEtkTtS63g%2Bb%2BT8QuSBatQoReWEUBmYLCXefDe3JfKLn4r3zVo5YE5SYUettH0yUSGb9fIX68qhoRQUyIbyDZXrhc8VJJE1P7TSeiErX5RqeMT%2Fdc76e%2BKHgcIvlfB9o9MtWP%2BURA1SEHhSL6rGUD4qCvidhEvorJPV%2FwxLN7B6Px3d29uCBBL9uCGIKs9VIQ0aQAMA6p7leCe%2BlHjcuAorYW6Uc%2Fr9P9l7C1QFfBYv8usGjqcDp5o8nxtgj6usQx3ktBeZtg2yJ4ReO2Vfi%2Fsqu9tVlhykoJ6bGPWHs1wJh1jBNBaOgRMnx0BHaCNNr5oE5JtC0VVVYY3g0YSSNSdx1pQS4es7%2BLtwhusT7QZsAKPSJDTL4Do8euXowvLSR926yUEZ1zHxlWoQLXDRdR%2BN%2BCMMvJ4Q3JDGOhf4tTaG4FUPQsz%2Bi0eQ4YD3T%2BfhQsTHOFOfzk6zA8Mpl2ovqT9RWVTSXgkah%2FZTwOowD%2Bsx9WryMiUhAx6vg6gf%2BUmaRzkCQ%2FIhrZb4blSTpYCidgHupJHAfYbAXIGd7NEQNMS8%2BBNVPQa0WIvGlP9dOeVqj%2FfRPztZJJ%2B38dpx8wED6vVV2qZT8fjuZ9i8osHNRPb1dQ18elgJW4bjIHHXF%2FVSTCma0bQD23WelDzySFeBmSTW8DA2Z3Nqodcllv1DmipOqZxEalJ16WDPYD%2F0MuxL4hYaf2BmJPupSQ92cMQ9APpNkUVmRnRNkl%2BgqNuNbm%2FXdMJZovn9sZ1yNaUDUKg2fyuEUV78psGZ5PCAld0YuvIIbSxiyy8%2B87UbUfVPmzx%2FBOzpYU%2BskAhbkpHKJrNvZ96p9%2FjpkC1%2FjVbd%2F534FR1lzVnsmAchY33Cm2eS0M1jZVUNzqMqGT5bEBU4StpTHIHDKjDZrnglk3p7vY2ar1d8uXIh3h15D9acTY1E%2BEzLeMwn7L3BRcovwkVhJkQx7Zdfb4jhkyI7aSjvghzEy%2By3jA%2FXWb984pht4LoIkVnGaTi7vC1gxuw11TxsaYaPExitnKtDy8t5QS8ggyt%2F62QUMHFjI8p0LdCr7iHYCNDoluJEc7cQ%3D%3D&redirectType=js&inIframe=false&inPopUp=false
Requested by: Host: ww99.aircamada.ca
URL: https://ww99.aircamada.ca/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 72.52.178.23 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb01.parklogic.com
Software: openresty / PHP/5.4.16
Resource Hash

Request headers

Referer: https://ww99.aircamada.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 27 Nov 2024 14:00:25 GMT
server: openresty
x-powered-by: PHP/5.4.16

GET
H/1.1

200
OK

f.php Show response
biruuq.com/
Redirect Chain

http://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc01...
https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc0...

5 KB
2 KB

517ms
97ms

Document
text/html

103.224.182.206
TRELLIAN-AS-AP Tr...

General

Check archive.org

Show headers Download Go to

Full URL: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D
Requested by: Host: ww99.aircamada.ca
URL: https://ww99.aircamada.ca/page/bouncy.php?&bpae=GbhGczsbwtR5jkvEnJDGSK%2B%2B5rnyMxw29TK35i6Le1VlW0svWfM5bsSKbQGqrr9%2FaNcmHX7Z0YhQF%2FTa%2FJGxR5T9XoLfim%2B%2F%2FneH3SFKKppxpeP54U36a20YkhNV0GTFlwHaauT4N7kwbBNEL68dAF3HKC2VgTtAghFqiqrSIDAgO0vKyhX83tSt5prP2UyWlQa84fOQKulBZQlnxVytx3FRjklYtCNgDHia21qlI8nABL%2B0VCYuRYeR6YSgNv7sp%2F2kbpdbF62Ae9U2oLAqS%2F5lO%2BNSt3MPea4MgenLNpesOUr%2B8GUWKo5S1xvQSxGdHJ2GB8QsxCsdVpqf2e4qya3kzgOZLr%2F79DFa3THlB7kPIWNza%2F8oVAaK6fQMzNfF54SH9EGQ2pXGUN3kFEneMz22xOfUMSA%2BwbYQ4EqqG8vhjT%2BzydFTSp94VPxnHBPCR0wxXE%2FbIzOXWnRikhZZmG0nC0bXcLDuG4ZLQcFaD5gvqXvJOZSGnS5VwXR8c4M8373%2BBs8ZI3mO6%2FHF8rYRK1p5OgMONrnd6Hkp%2FvY04bzRQACjaMcVMa0LsNIm2X%2B43X2HmYVm4bT%2FwEnDHxp%2FsgQLsk7Io%2FwJkxtAhH2c%2FYDWoXRvBG5NBY7ayhnrPkb2Pcb8pt1NKd63Taqv%2BRBXWdb5hsR%2FUcEIoqiTMRkhE2tT4GX3FaYswsDOYGc4ZZ9iTfLt2ZGhN4nW%2BzbPtCRqRazvqjRRLPRTE6cJIBF1AEN6euvYXJnpEtkTtS63g%2Bb%2BT8QuSBatQoReWEUBmYLCXefDe3JfKLn4r3zVo5YE5SYUettH0yUSGb9fIX68qhoRQUyIbyDZXrhc8VJJE1P7TSeiErX5RqeMT%2Fdc76e%2BKHgcIvlfB9o9MtWP%2BURA1SEHhSL6rGUD4qCvidhEvorJPV%2FwxLN7B6Px3d29uCBBL9uCGIKs9VIQ0aQAMA6p7leCe%2BlHjcuAorYW6Uc%2Fr9P9l7C1QFfBYv8usGjqcDp5o8nxtgj6usQx3ktBeZtg2yJ4ReO2Vfi%2Fsqu9tVlhykoJ6bGPWHs1wJh1jBNBaOgRMnx0BHaCNNr5oE5JtC0VVVYY3g0YSSNSdx1pQS4es7%2BLtwhusT7QZsAKPSJDTL4Do8euXowvLSR926yUEZ1zHxlWoQLXDRdR%2BN%2BCMMvJ4Q3JDGOhf4tTaG4FUPQsz%2Bi0eQ4YD3T%2BfhQsTHOFOfzk6zA8Mpl2ovqT9RWVTSXgkah%2FZTwOowD%2Bsx9WryMiUhAx6vg6gf%2BUmaRzkCQ%2FIhrZb4blSTpYCidgHupJHAfYbAXIGd7NEQNMS8%2BBNVPQa0WIvGlP9dOeVqj%2FfRPztZJJ%2B38dpx8wED6vVV2qZT8fjuZ9i8osHNRPb1dQ18elgJW4bjIHHXF%2FVSTCma0bQD23WelDzySFeBmSTW8DA2Z3Nqodcllv1DmipOqZxEalJ16WDPYD%2F0MuxL4hYaf2BmJPupSQ92cMQ9APpNkUVmRnRNkl%2BgqNuNbm%2FXdMJZovn9sZ1yNaUDUKg2fyuEUV78psGZ5PCAld0YuvIIbSxiyy8%2B87UbUfVPmzx%2FBOzpYU%2BskAhbkpHKJrNvZ96p9%2FjpkC1%2FjVbd%2F534FR1lzVnsmAchY33Cm2eS0M1jZVUNzqMqGT5bEBU4StpTHIHDKjDZrnglk3p7vY2ar1d8uXIh3h15D9acTY1E%2BEzLeMwn7L3BRcovwkVhJkQx7Zdfb4jhkyI7aSjvghzEy%2By3jA%2FXWb984pht4LoIkVnGaTi7vC1gxuw11TxsaYaPExitnKtDy8t5QS8ggyt%2F62QUMHFjI8p0LdCr7iHYCNDoluJEc7cQ%3D%3D&redirectType=js&inIframe=false&inPopUp=false
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 103.224.182.206 , Australia, ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU),
Reverse DNS: bidr.trellian.com
Software: Apache /
Resource Hash: 3ffe9a0835ac7d45143789cb75e74d69c3eea99a8e6063459ec9b378622c4b1d

Request headers

Referer: https://ww99.aircamada.ca/page/bouncy.php?&bpae=GbhGczsbwtR5jkvEnJDGSK%2B%2B5rnyMxw29TK35i6Le1VlW0svWfM5bsSKbQGqrr9%2FaNcmHX7Z0YhQF%2FTa%2FJGxR5T9XoLfim%2B%2F%2FneH3SFKKppxpeP54U36a20YkhNV0GTFlwHaauT4N7kwbBNEL68dAF3HKC2VgTtAghFqiqrSIDAgO0vKyhX83tSt5prP2UyWlQa84fOQKulBZQlnxVytx3FRjklYtCNgDHia21qlI8nABL%2B0VCYuRYeR6YSgNv7sp%2F2kbpdbF62Ae9U2oLAqS%2F5lO%2BNSt3MPea4MgenLNpesOUr%2B8GUWKo5S1xvQSxGdHJ2GB8QsxCsdVpqf2e4qya3kzgOZLr%2F79DFa3THlB7kPIWNza%2F8oVAaK6fQMzNfF54SH9EGQ2pXGUN3kFEneMz22xOfUMSA%2BwbYQ4EqqG8vhjT%2BzydFTSp94VPxnHBPCR0wxXE%2FbIzOXWnRikhZZmG0nC0bXcLDuG4ZLQcFaD5gvqXvJOZSGnS5VwXR8c4M8373%2BBs8ZI3mO6%2FHF8rYRK1p5OgMONrnd6Hkp%2FvY04bzRQACjaMcVMa0LsNIm2X%2B43X2HmYVm4bT%2FwEnDHxp%2FsgQLsk7Io%2FwJkxtAhH2c%2FYDWoXRvBG5NBY7ayhnrPkb2Pcb8pt1NKd63Taqv%2BRBXWdb5hsR%2FUcEIoqiTMRkhE2tT4GX3FaYswsDOYGc4ZZ9iTfLt2ZGhN4nW%2BzbPtCRqRazvqjRRLPRTE6cJIBF1AEN6euvYXJnpEtkTtS63g%2Bb%2BT8QuSBatQoReWEUBmYLCXefDe3JfKLn4r3zVo5YE5SYUettH0yUSGb9fIX68qhoRQUyIbyDZXrhc8VJJE1P7TSeiErX5RqeMT%2Fdc76e%2BKHgcIvlfB9o9MtWP%2BURA1SEHhSL6rGUD4qCvidhEvorJPV%2FwxLN7B6Px3d29uCBBL9uCGIKs9VIQ0aQAMA6p7leCe%2BlHjcuAorYW6Uc%2Fr9P9l7C1QFfBYv8usGjqcDp5o8nxtgj6usQx3ktBeZtg2yJ4ReO2Vfi%2Fsqu9tVlhykoJ6bGPWHs1wJh1jBNBaOgRMnx0BHaCNNr5oE5JtC0VVVYY3g0YSSNSdx1pQS4es7%2BLtwhusT7QZsAKPSJDTL4Do8euXowvLSR926yUEZ1zHxlWoQLXDRdR%2BN%2BCMMvJ4Q3JDGOhf4tTaG4FUPQsz%2Bi0eQ4YD3T%2BfhQsTHOFOfzk6zA8Mpl2ovqT9RWVTSXgkah%2FZTwOowD%2Bsx9WryMiUhAx6vg6gf%2BUmaRzkCQ%2FIhrZb4blSTpYCidgHupJHAfYbAXIGd7NEQNMS8%2BBNVPQa0WIvGlP9dOeVqj%2FfRPztZJJ%2B38dpx8wED6vVV2qZT8fjuZ9i8osHNRPb1dQ18elgJW4bjIHHXF%2FVSTCma0bQD23WelDzySFeBmSTW8DA2Z3Nqodcllv1DmipOqZxEalJ16WDPYD%2F0MuxL4hYaf2BmJPupSQ92cMQ9APpNkUVmRnRNkl%2BgqNuNbm%2FXdMJZovn9sZ1yNaUDUKg2fyuEUV78psGZ5PCAld0YuvIIbSxiyy8%2B87UbUfVPmzx%2FBOzpYU%2BskAhbkpHKJrNvZ96p9%2FjpkC1%2FjVbd%2F534FR1lzVnsmAchY33Cm2eS0M1jZVUNzqMqGT5bEBU4StpTHIHDKjDZrnglk3p7vY2ar1d8uXIh3h15D9acTY1E%2BEzLeMwn7L3BRcovwkVhJkQx7Zdfb4jhkyI7aSjvghzEy%2By3jA%2FXWb984pht4LoIkVnGaTi7vC1gxuw11TxsaYaPExitnKtDy8t5QS8ggyt%2F62QUMHFjI8p0LdCr7iHYCNDoluJEc7cQ%3D%3D&redirectType=js&inIframe=false&inPopUp=false
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

connection: close
content-encoding: gzip
content-length: 1746
content-type: text/html; charset=UTF-8
date: Wed, 27 Nov 2024 14:00:25 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

Location: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK iife.min.js Show response
biruuq.com/js/fingerprint/ 33 KB
14 KB 546ms
157ms Script
application/javascript 103.224.182.206
TRELLIAN-AS-AP Tr...

General

Check archive.org

Show headers Download Go to

Full URL: https://biruuq.com/js/fingerprint/iife.min.js
Requested by: Host: biruuq.com
URL: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 103.224.182.206 , Australia, ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU),
Reverse DNS: bidr.trellian.com
Software: Apache /
Resource Hash: c6bc28686490aba34a53ab3b709afa1fd73c21e60feb25608b09f23efe170089

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D

Response headers

content-encoding: gzip
etag: "85c0-6250852d63500-gzip"
connection: close
accept-ranges: bytes
content-length: 14345
date: Wed, 27 Nov 2024 14:00:26 GMT
last-modified: Tue, 22 Oct 2024 03:25:40 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET favicon.ico
biruuq.com/ 0
0

GET
H/1.1

200
OK

f.php
biruuq.com/
Redirect Chain

http://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc01...
https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc0...

2 KB
2 KB

129ms
112ms

Document
text/html

103.224.182.206
TRELLIAN-AS-AP Tr...

General

Check archive.org

Show headers Download Go to

Full URL: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D&fp=7fe7f2e16dd7f48c00a4ea8141734fea
Requested by: Host: biruuq.com
URL: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 103.224.182.206 , Australia, ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU),
Reverse DNS: bidr.trellian.com
Software: Apache /
Resource Hash

Request headers

Referer: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

connection: close
content-encoding: gzip
content-length: 1569
content-type: text/html; charset=UTF-8
date: Wed, 27 Nov 2024 14:00:26 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

Location: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D&fp=7fe7f2e16dd7f48c00a4ea8141734fea
Non-Authoritative-Reason: HttpsUpgrades

GET
H3

200

Primary Request AircanadaTR.html Show response
faresbuddies.com/
Redirect Chain

http://biruuq.com/f2.php?e=bRok7L6H1f60O4Waw8g%2FT349fmQ4MC94YnNjakpFUm5KbFhHeWlSOXZJT3JNdS9CZHRpVDdLYk1oMkhMRVkva3g3Mm1JOG9qc1oyN21IaTlBckNKQUxvYXMyUlJ6SWtXL25QU3Z4bjhiQXA4Qk56cVRmdDVvM093UWtpMlpR...
https://biruuq.com/f2.php?e=bRok7L6H1f60O4Waw8g%2FT349fmQ4MC94YnNjakpFUm5KbFhHeWlSOXZJT3JNdS9CZHRpVDdLYk1oMkhMRVkva3g3Mm1JOG9qc1oyN21IaTlBckNKQUxvYXMyUlJ6SWtXL25QU3Z4bjhiQXA4Qk56cVRmdDVvM093UWtpMlp...
https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

47 KB
11 KB

383ms
118ms

Document
text/html

2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Requested by

Host: biruuq.com
URL: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D&fp=7fe7f2e16dd7f48c00a4ea8141734fea

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1af2d15a5c2c02f22f46ccd4ae8d8841e40d4a0a9064a5ba73fd7b1f47fa5699

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D&fp=7fe7f2e16dd7f48c00a4ea8141734fea
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: accept, content-type
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8e92a5070c978c4e-EWR
content-encoding: zstd
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
content-type: text/html
date: Wed, 27 Nov 2024 14:00:28 GMT
last-modified: Tue, 22 Oct 2024 18:18:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8DKvdLY4ECRjIiZ5SRUkSl6Tb0rnbBvrbADWOLWPgJqrOf7PRaJo47ac3ZaoMp3zdhskhly%2FMLQhxZEu7vIVhKb01c8QP%2BkX9fugmrWb4dRnrbxRXICpn4GLkBEHVJ8CBqk3QQtnFrtvhUjIXJDO"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=40228&min_rtt=39393&rtt_var=9762&sent=12&recv=9&lost=0&retrans=0&sent_bytes=4174&recv_bytes=4446&delivery_rate=13577&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=132&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-ua-compatible: IE=edge,chrome=1

Redirect headers

connection: close
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 27 Nov 2024 14:00:27 GMT
location: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6
server: Apache

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 406 KB
132 KB 274ms
82ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K5X70M5BR

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dca6bbecb934b8350c6c99212304108dfb377f27e4a0f637ae19364270452df8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 27 Nov 2024 14:00:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 134119
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 css
fonts.googleapis.com/ 8 KB
1 KB 242ms
56ms Stylesheet
text/css 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Hind:400,300,500,600%7cMontserrat:400,700

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

821ca845c6e412fd6117eda79aae04c373d54e0294a77acb6e216517d0b90ad0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 27 Nov 2024 14:00:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 27 Nov 2024 14:00:28 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 15 KB
826 B 260ms
74ms Stylesheet
text/css 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5945935b868b1a8f5eb9e4df30b412e760115b11aa161469fbcf79123816a3a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 27 Nov 2024 14:00:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 27 Nov 2024 13:30:22 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 font-awesome.min.css
faresbuddies.com/AirCanada/css/lib/ 23 KB
6 KB 77ms
73ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/css/lib/font-awesome.min.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9486c00df4a831289ee8e5467bfbde3cc5a767e651a5c570cd0d24550c20515b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"c999d465716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g2eJ1fmyF0CIje7MEtJdmakrDVTcP4xAvAm8yRmJfcQ1qKrtAY2GDnAQVdm%2BZdLXq1f5xI%2FYnMz40hoZm40CFK8%2FuORIZU6ExYmddDqXN9UqyriqfpCM3oTaVOiFtBqPM0i3iuA0Rm7Q6p3H%2BpAA"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=30&recv=32&lost=0&retrans=0&sent_bytes=19277&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=273&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:16:43 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5083e088c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 font-hilltericon.css
faresbuddies.com/AirCanada/css/lib/ 2 KB
1 KB 74ms
69ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/css/lib/font-hilltericon.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1525336a0cf5a8b66622665a90d5038d23e6d51613ff6dc63651638a20838e51

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"6b9f30465716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wtmHYLKLI9KQOg0WlrlCSRKaeZOJWwTDdSinOsyvC5UsMAfpBKDUZm5amcwOxMUA6uQeikThGdlToSq%2F5SbK4Wmz3YkEDjv%2B9cW1S09KYCR9mHC4pIHLPYsWB6P76qItMyAdzMl3BVL3L5qQAxmd"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=26&recv=32&lost=0&retrans=0&sent_bytes=15718&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=265&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:16:43 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5083e0c8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 bootstrap.min.css
faresbuddies.com/AirCanada/css/lib/ 158 KB
25 KB 149ms
145ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/css/lib/bootstrap.min.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

319c8683141cae0c5648f254545bb3e8abffb23f9566a706e1d161d0e37a1b4b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"5a3ba4455716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FxBWs7OQy%2Bxi6GgH77BuEXxkAx3C3smkfP91nFRVLpL8WkIdC3vVf4z5%2BgQd4rfZP5PHOJbVK3320XS1MypzT8FaLgp6ulz7aQWiGWHXL1ye9BSMv5WTqDE6gHkE3qC%2F7JppLVtaKK6UaOv5T5X5"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=51304&min_rtt=38735&rtt_var=15254&sent=62&recv=38&lost=0&retrans=0&sent_bytes=49865&recv_bytes=11324&delivery_rate=179330&cwnd=22800&unsent_bytes=0&cid=c0b2214edbd82949&ts=318&x=1", cfHdrFlush;dur=29
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:16:42 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5083e0e8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 owl.carousel.css
faresbuddies.com/AirCanada/css/lib/ 6 KB
2 KB 72ms
68ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/css/lib/owl.carousel.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7bfeae9283fa57b16680b6b82e540701d37f8af56a6593623280118228792fc6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"265845475716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mygzt%2FqX%2BEj%2BYRtAIWyP%2FbQttLijs3%2Br7QQAwP4gjzInxn%2BdoO9JEIc%2BIC5ljbKH9PRHSbiyXMtsQphdocrTbU90ZbP2DjkA4JzbBPNc%2FRDyqDoqa7hP4yL4WvCvtEoseyu1%2BhXsaGosss6OFdB7"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=28&recv=32&lost=0&retrans=0&sent_bytes=17199&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=271&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:16:45 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5083e118c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery-ui.min.css
faresbuddies.com/AirCanada/css/lib/ 29 KB
8 KB 118ms
105ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/css/lib/jquery-ui.min.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20b25939f4c2beb7d53703eba4e50e778b8d29c8bc9e0425fe0f599fb313708c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"6066b9465716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2dV1sIERjkFsFYFfpy%2B7AOEd8ZNrsG%2FCHYyAaFxRRTIxlEWCxCbPfa3%2Bzu3k6fu0XTiNJPoNbsTAUo8dAnxUBu%2FVE1wwjO%2F%2BWcczIedS4mu6ZDc6k65%2BQpCIgN7uht5njzrRTlorM%2BXRrDYfhZ1G"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=39&recv=32&lost=0&retrans=0&sent_bytes=27718&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=286&x=1", cfHdrFlush;dur=23
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:16:44 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e1d8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 magnific-popup.css
faresbuddies.com/AirCanada/css/lib/ 8 KB
3 KB 117ms
103ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/css/lib/magnific-popup.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1200315e086ade561036ffc51c2a77a2475ddb5eb9033885018805be7326c40

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"96c8bb465716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5jlmYky8xuqo9BgGUx6qoqbwQd7uFcuk64r9MXrVBtWaVCn968XzD7Gcb0sQM3nOULSeUWFiTeZkkeHZ%2FkGfPflHGprPiN12lhyUnn9OdOTaYlqAqSRWa3pE0i4WyTcv9o8LvkHPC3xtVcS61f%2B%2B"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=39&recv=32&lost=0&retrans=0&sent_bytes=27718&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=290&x=1", cfHdrFlush;dur=20
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:16:44 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e1e8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 settings.css
faresbuddies.com/AirCanada/css/lib/ 72 KB
13 KB 119ms
105ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/css/lib/settings.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfc5f440bd83038f2485860edfb8ed400b2ef890a6276300a90fa0f898e447f6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"e39e92475716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IxZlO2fMgDpq7Kz%2BaKoKXTEeWaT8mmDYTWq8rR5ktp%2B1u38E4R6uulqzscVDkP4h86W9oeUQBZf4oeUsqAGRrsNuv5x1dBox%2BaND9o8PUjKKWzdY2paC1gm5XoUyMlYG%2FtYpyCSN%2BL4DPpho7N6U"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=39&recv=32&lost=0&retrans=0&sent_bytes=27718&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=309&x=1", cfHdrFlush;dur=4
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:16:45 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e1f8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 bootstrap-select.min.css
faresbuddies.com/AirCanada/css/lib/ 6 KB
2 KB 120ms
106ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/css/lib/bootstrap-select.min.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b065a7a06b7a95d21213ae3b175cc4714d3b8fa62ff2f0b8005f198660bdd558

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"eb615e455716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9%2F%2FDYeZQ%2Fsm01qiUWcRh60Pigu8jeFQuOJyYpHBg7xZszorQ%2Bl7pIZgh173VM3cHEo0%2FIQrQ0ViSuJuviZyqaejnkKbIMtvf6Ka%2F%2F%2FacFmg6QNe02Ru8CaG6GG8np5HhLbmw%2BCx8B1DHPOkyQujS"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=39&recv=32&lost=0&retrans=0&sent_bytes=27718&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=279&x=1", cfHdrFlush;dur=34
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:16:41 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e208c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 style.css
faresbuddies.com/AirCanada/css/ 267 KB
41 KB 194ms
180ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/css/style.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ccc4a85af8ed33b854847377d97df535293eff0cb992d5d5a853209bb2743b1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"a7a0f1375716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t9mbJZNdvgpWVmcFsJ4QEjhLjc0bIgyJMxCG5p3L2cP1YNjJRiXnifS80LIJ7041vDwUHQZGLvx8LdD4gAN60yzGncUG6vplxA4g2jakV%2FHW%2FJrNRcM5pMSA39%2BdjJqy4tSIwxsiynVp7NeiYHyX"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=48270&min_rtt=38735&rtt_var=3546&sent=98&recv=50&lost=0&retrans=0&sent_bytes=84265&recv_bytes=11841&delivery_rate=346429&cwnd=34800&unsent_bytes=0&cid=c0b2214edbd82949&ts=369&x=1", cfHdrFlush;dur=17
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:16:19 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e218c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 script.js Show response
faresbuddies.com/AirCanada/sform/js/ 2 KB
1 KB 184ms
170ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/sform/js/script.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1d4ea98a3c8ea0c5e095f40e47ef4d6a0f7843a39bca44ba34bea2591da3d94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"eca4b6c95716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B9QONadcK2vpV0ddVaGCd4GuR79aZzjhWsrdv7vdCmCk9KK8Rjibb8fZ3E3NZMVyEQE8N3KxNgQuwyLKoqnOtbiIdNYgZqDoDKmmbNqpTbL2NTg2S9I95ZacMH%2FX69IeO1y7n5%2B63swY7vheJ1t%2B"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=39&recv=32&lost=0&retrans=0&sent_bytes=27718&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=281&x=1", cfHdrFlush;dur=32
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:20:23 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e228c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.js Show response
faresbuddies.com/AirCanada/sform/js/ 286 KB
87 KB 185ms
172ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/sform/js/jquery.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cbe1497c81688772eda8452278df4be4093e5ba2ed885b7578539a36130b40

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"732e14c75716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iZO%2BISPOZwtKSPxNnql%2FI51JtYkoDTBsG6I3XwwF9kJmRrCf4erR6jEEul99L0ZN1QGQLyj5DnH3tZpqrVONRA8eOBJUflWwfdIMQUprSUORQmidt8srMFAAywS1Iebc3OsVNZM%2FkLLl1oaPRiPl"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=51304&min_rtt=38735&rtt_var=15254&sent=62&recv=38&lost=0&retrans=0&sent_bytes=49865&recv_bytes=11324&delivery_rate=179330&cwnd=22800&unsent_bytes=0&cid=c0b2214edbd82949&ts=333&x=1", cfHdrFlush;dur=23
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:20:19 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e238c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 cycle.js Show response
faresbuddies.com/AirCanada/sform/js/ 52 KB
15 KB 272ms
258ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/sform/js/cycle.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e946fe30af50bf51c1224e69e3da4505347ab80f4897b511565340ad7d2f138

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"1ffc9cc55716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7woBf17IWEIyvaRNeyJpOlYfxiuBHiADGb5j5cwVFbQpuBUz1wNoSQ5EWLVi3rvMnMwcaPhO4gw39b5FADN0WgmxjIyBswMdV6Lq5zS6ma6D4VGneDqrmM4pHEJUPyNPrkzzW1Nomj9DfRBiWItT"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=51304&min_rtt=38735&rtt_var=15254&sent=62&recv=38&lost=0&retrans=0&sent_bytes=49865&recv_bytes=11324&delivery_rate=179330&cwnd=22800&unsent_bytes=0&cid=c0b2214edbd82949&ts=319&x=1", cfHdrFlush;dur=37
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:20:17 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e248c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery-ui.css
faresbuddies.com/AirCanada/sform/ui/1.11.4/themes/smoothness/ 31 KB
9 KB 274ms
260ms Stylesheet
text/css 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/sform/ui/1.11.4/themes/smoothness/jquery-ui.css

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

467d7126df55e309c956edc502d302d7f383c54e37704b59ea5126a54123fdbc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"e171a9225816db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YORDNS4CYAFoYXeY4sL9xNrTSaCP7Rl0DvUhrEztGhTYKxTPNJJem4isAKuRqudmzXNg8x78aNWME45uriJTkJGgUv6uBVYKGaW8dR%2BTTAtoPb9jmylYAzAizNLBFk%2FCoPKtI1XzEYv3p81nz20n"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=39&recv=32&lost=0&retrans=0&sent_bytes=27718&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=290&x=1", cfHdrFlush;dur=23
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 12:22:53 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e258c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery-ui.js Show response
faresbuddies.com/AirCanada/sform/ui/1.11.4/ 460 KB
118 KB 281ms
267ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/sform/ui/1.11.4/jquery-ui.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c8e8d7408611519ceda4e759ae9987834a17addc8f0028241ffed7fb0113612

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"3fb2ef155816db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sjzSwJmjyl9mGPMPP3OKliMBAUuolXHedf%2BcLSmrj9n%2FeekFX2QxaVtjYPDmzwKN8xZ3UIAaVUdo%2BReb%2Fl9QAZ%2FXcJRGmPinmCuQj9qj4rO%2BFLBMtegtfUgNBJkxUcBYheFS3UHdo8MAU8xQlSlt"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=51304&min_rtt=38735&rtt_var=15254&sent=62&recv=38&lost=0&retrans=0&sent_bytes=49865&recv_bytes=11324&delivery_rate=179330&cwnd=22800&unsent_bytes=0&cid=c0b2214edbd82949&ts=335&x=1", cfHdrFlush;dur=21
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:22:31 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e278c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 logo.png
faresbuddies.com/AirCanada/ 3 KB
4 KB 77ms
64ms Image
image/png 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://faresbuddies.com/AirCanada/logo.png

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1fec4f9995879fe3d41ddcae712464d9e88795db64df4e12c6771058268c964

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

cf-cache-status: DYNAMIC
etag: "3577f0345716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qR%2B6AA6d%2BVmZ%2BQI%2F5HqU6MS5uh%2FTR8NsV33o%2F7%2FgVukC5gT6m3bRNpcot2iSIzlQuq0JMmV%2FJEsRPTwPqGTcYxgdurh%2FeebFu4xdMPZtv2pIoYnfXLo%2BdpynK%2Fg6DK1Fj1pG0qL1l4xfpsoPn2Hs"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=37&recv=32&lost=0&retrans=0&sent_bytes=25865&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=279&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: image/png
last-modified: Fri, 04 Oct 2024 12:16:14 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e2b8c4e-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2991
server: cloudflare

GET
H3 200 bestprice.png
faresbuddies.com/AirCanada/images/ 7 KB
7 KB 348ms
335ms Image
image/png 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://faresbuddies.com/AirCanada/images/bestprice.png

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8caf1a33c8d914970dab1aaf0da9f28f4a3bac0efc500256a0d532aa21782382

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

cf-cache-status: DYNAMIC
etag: "f7349e3a5716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=awhHD9hToktLlU1qCyPEQwPh3kvK8nwPrsoFVRrKyiMcIR5fOR9u3uA9ncOON4GPlsLFAoiMYdW7Kg1zxtxm0qI%2BEL1VKrl1tkNfF22IElT%2BK91FCSNy6ZbwEihgDdYYDBKm7%2B1VztYRCjud%2F15u"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=40318&min_rtt=39336&rtt_var=2394&sent=39&recv=32&lost=0&retrans=0&sent_bytes=27718&recv_bytes=11066&delivery_rate=168783&cwnd=12000&unsent_bytes=0&cid=c0b2214edbd82949&ts=282&x=1", cfHdrFlush;dur=31
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: image/png
last-modified: Fri, 04 Oct 2024 12:16:23 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a5084e2d8c4e-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6773
server: cloudflare

GET
H3 200 easybooking.png
faresbuddies.com/AirCanada/images/ 7 KB
7 KB 73ms
72ms Image
image/png 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://faresbuddies.com/AirCanada/images/easybooking.png

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c9d9f6037f5e1522c783f30b04750fb9242ee7b82ca1a7d9a6c7b427a2228f8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

cf-cache-status: DYNAMIC
etag: "4fd1b53b5716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qdx83TjXqFV8tEDHmB9%2BtzXXiX%2Blbd45zXiq%2BgAGnHVChg3nuKOnoOPbcLwYxkm%2FQTRWz8GVjYY9wdoXjNcUuxZHhUEgtXfbGy908kGk4pXGcztr4cc3DL5YT2N%2BCSWHQIjKfD8urfpZ2IxNRrTi"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=65328&min_rtt=38735&rtt_var=14142&sent=353&recv=101&lost=0&retrans=0&sent_bytes=375350&recv_bytes=14909&delivery_rate=1632320&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=622&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: image/png
last-modified: Fri, 04 Oct 2024 12:16:25 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50a79018c4e-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6811
server: cloudflare

GET
H3 200 needhelpl.png
faresbuddies.com/AirCanada/images/ 7 KB
7 KB 73ms
72ms Image
image/png 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://faresbuddies.com/AirCanada/images/needhelpl.png

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

060fc3b22934748629237f69ec1ee40b7e822cd1b1e1abfee057b848f5ca9557

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

cf-cache-status: DYNAMIC
etag: "8ec18a3f5716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YNc%2B3A4flKYb0%2BBBdZ4tlKcgTVHRf7NDzng4bRyYapiOHpA8AQAJHduIzen8rmb8L44KVEUDPWN%2FYsrLtiNTixabe0o2dg1ZoJ58YWLxz4Ub71BVC4GoJg2iC53ZSfvN4dWT%2BDyjTEQf0fpurcLO"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=65328&min_rtt=38735&rtt_var=14142&sent=360&recv=101&lost=0&retrans=0&sent_bytes=383104&recv_bytes=14909&delivery_rate=1632320&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=623&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: image/png
last-modified: Fri, 04 Oct 2024 12:16:32 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50a79028c4e-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6690
server: cloudflare

GET
H3 200 mastercard.png
faresbuddies.com/AirCanada/images/ 2 KB
3 KB 148ms
147ms Image
image/png 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://faresbuddies.com/AirCanada/images/mastercard.png

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ff235fb47e996e83d2d852787db0716b6304b764c9dd5717c253bdad9f209b3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

cf-cache-status: DYNAMIC
etag: "1e1e2f3f5716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iwe5b6MAASBymmllvQGDpGSuuMAlzhiYBTqy0uQNLN7Ymfo9zc%2FSQOaAR6JdYFp4s7V4wxxb9mmICSsKQR3d%2B9q8fSn0zFw4MahJ%2BiI8MO02%2BSatUaQjruNvE9siE%2BpCp3X2XCtpgj4vPwPwuji6"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=62307&min_rtt=38735&rtt_var=13213&sent=368&recv=104&lost=0&retrans=0&sent_bytes=390757&recv_bytes=15777&delivery_rate=214829&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=704&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: image/png
last-modified: Fri, 04 Oct 2024 12:16:31 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50af9e58c4e-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2213
server: cloudflare

GET
H3 200 visa.png
faresbuddies.com/AirCanada/images/ 1 KB
2 KB 132ms
130ms Image
image/png 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://faresbuddies.com/AirCanada/images/visa.png

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b87b8dced5ce08da642941cb158cf77fac026dd51653f2cfe2bbb57215b8844

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

cf-cache-status: DYNAMIC
etag: "cb4aa8405716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0%2FmhxcQ%2BpgUxY9AYemuutidcU1YMt886gIr%2B4s79pg9E8LpzugRPQuNirTs1Ck%2B9UxRQYGknGOvWjFsLkuLLiSLwxCLZacOIZm44MDL5YT43xchJP2z5iy9eNEqG71eW5Zb6rsy4XhSOW5c8GZzv"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=70119&min_rtt=38735&rtt_var=25534&sent=406&recv=125&lost=0&retrans=0&sent_bytes=432294&recv_bytes=25267&delivery_rate=19949&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=839&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: image/png
last-modified: Fri, 04 Oct 2024 12:16:34 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcb068c4e-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1432
server: cloudflare

GET
H3 404 AirCanada-express.png
faresbuddies.com/AirCanada/images/ 1 KB
1 KB 127ms
124ms Image
text/html 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://faresbuddies.com/AirCanada/images/AirCanada-express.png

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cyhwEjIEWkLXk54U%2B7E61Pwvlx3hQ63EeHmJR4tuddGZGNuCLwRDoUcJCdeu7XPGgOeAwYr04OLtSJvkdO0pAf0Yb8NC1BSp6JF64iZ2dh9S0Tgv9bS%2FWDN3an1FKch%2FrMnB6FqrHsFfbbk8FlWu"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=70119&min_rtt=38735&rtt_var=25534&sent=413&recv=125&lost=0&retrans=0&sent_bytes=439388&recv_bytes=25267&delivery_rate=19949&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=845&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: text/html
x-frame-options: SAMEORIGIN
access-control-allow-headers: accept, content-type
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcb078c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 discover.png
faresbuddies.com/AirCanada/images/ 3 KB
4 KB 159ms
156ms Image
image/png 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://faresbuddies.com/AirCanada/images/discover.png

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee86af7c37252caba3c2f037f4bdff3acbd2d9863083c31f84ed0f3833fb6c77

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

cf-cache-status: DYNAMIC
etag: "a772a3b5716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wPoqBuru30cZMBhMhDK68XZPnwCfuvt87nBK1k%2FaLdhK8yIZaCJOam22br7XLUXofJUrTQyOd8u93hihgtS9f3r%2BXjjFJDRseRnKZrFfDReHVLXZ52URvLW5R9X9zIHLF0LHABcCXV9uboTfTWoF"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=63841&min_rtt=38735&rtt_var=25243&sent=433&recv=127&lost=0&retrans=0&sent_bytes=461478&recv_bytes=25355&delivery_rate=176777&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=856&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: image/png
last-modified: Fri, 04 Oct 2024 12:16:24 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcb098c4e-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3513
server: cloudflare

GET
H3 200 jquery-1.11.0.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 94 KB
35 KB 176ms
175ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery-1.11.0.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af2419dd15e09ea913cfe94d130f9870486732e57764e0f02ea3846f204146ee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"979b89a15716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zGifptNoT6cU8GMIUjYY4v4DJ8NBDhIazwBaOgeqdtsOYudgeRTTUwnAj6LhaG25NjZyA2d8945WIs3H2%2FbQTsiXMYGKeluno93BTPW4s7S7ePHBwueJmfenLJkh8dCH9M5if1IMwf%2FgdjXYc00E"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=62307&min_rtt=38735&rtt_var=13213&sent=372&recv=124&lost=0&retrans=0&sent_bytes=393834&recv_bytes=24832&delivery_rate=214829&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=813&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:16 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50af9e88c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery-ui.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 235 KB
67 KB 190ms
188ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery-ui.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"651759a25716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3hwG4hu2aVlL6aXuEZca97YUKZhtjhJNX%2BwBajxQBevjoWqh%2B5h%2BxsXK%2BGFqU0K0B5UbFpC3QSwB4cdZtaM3HcgVVUUi1%2FKAY%2FO%2FMa9oId0vXwyhANUNETywkyujmoy4M4KDc3FgizkpVSd0Y5Nc"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=57289&min_rtt=38735&rtt_var=20384&sent=545&recv=130&lost=0&retrans=0&sent_bytes=589039&recv_bytes=25488&delivery_rate=271987&cwnd=153300&unsent_bytes=0&cid=c0b2214edbd82949&ts=905&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:17 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcae98c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 bootstrap.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 35 KB
11 KB 178ms
172ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/bootstrap.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46c0dc89cf6d107e63f1ff8f8c2cc92c33294dab989d4bc6db9abe1151bb154c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"7b4794a05716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p77jQu6NkhKgIhieXCR1d7bp%2F1HVQgs54Qu1%2Bs4CsD1aY%2BPbBHZ6zpuX5PLOtAa3v2g3rNStMjrlkeYy4Bqrg82EkFdL4kfFa5M0HH18yWmNY%2BnCvqjzsB5qU%2B0txlHRJQroEePLHOFPlTbkweUP"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=61375&min_rtt=38735&rtt_var=23863&sent=477&recv=128&lost=0&retrans=0&sent_bytes=511173&recv_bytes=25399&delivery_rate=255190&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=873&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:14 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcaeb8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 bootstrap-select.js Show response
faresbuddies.com/AirCanada/js/lib/ 57 KB
15 KB 201ms
193ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/bootstrap-select.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

112487fa82aa24a62c46eafbdbef72e6c81f718cf70026cd207a1be43d1e31aa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"b87b6a05716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yHXPWX%2FodfdGMkaNwSQl6OPFNTkkB%2BmNn3pIt%2BpcT4UMKx93GLUz%2F%2FtItn07YaRb3AKvfgPuoYqWv0hbtpZdmc5LZFZxmZB2%2FgAMcEiQxvP8fq4MoBOtfbyREb54BbQ9jtkVIMrIK5rjtEBwaCzL"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=52388&min_rtt=38735&rtt_var=8964&sent=600&recv=136&lost=0&retrans=0&sent_bytes=651162&recv_bytes=25756&delivery_rate=414243&cwnd=183900&unsent_bytes=0&cid=c0b2214edbd82949&ts=917&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:15 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcaee8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 isotope.pkgd.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 39 KB
12 KB 156ms
148ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/isotope.pkgd.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7aa35a74008321d246065399014c79a8c86b676992e06cf47b071e5c4740700

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"5af83fa15716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0dp1AMHg5E6TxkZetTknVfOpZCdVRcN2IHe7RFegjfYj741oGEKMHU9un%2Fo1Itl3Mgg4U7beDQkKSjeYDvxLXcSHoXO3q%2B4SPOXLQ80AaLD7%2Fu%2BdlsEldnNZls1oHHWEOt%2BZ64wAy1%2BMOPV0APjX"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=61375&min_rtt=38735&rtt_var=23863&sent=443&recv=128&lost=0&retrans=0&sent_bytes=472392&recv_bytes=25399&delivery_rate=255190&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=864&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:16 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcaef8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.themepunch.revolution.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 110 KB
28 KB 176ms
168ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery.themepunch.revolution.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83ab7bb1e23d3c5cc3bbfcf865d176233071f363d91d4806b3f02c7eda5add30

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"f3effba45716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xwgjULkY10es7iOw2Tgb5kYhlhqA688vsBG3e2Wk1U%2BD73dbv7EQ%2FgogXb%2Bnw3%2BsKURtFvyCcYV%2FfCbhzzOpwNtWIbETPZ%2Fxu%2F3L99whWu6M0rnJ%2BTDyq5G3en9y8N6DGviEwpbqYB3JnrN7LN8n"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=58953&min_rtt=38735&rtt_var=22742&sent=519&recv=129&lost=0&retrans=0&sent_bytes=559854&recv_bytes=25443&delivery_rate=269841&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=882&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:22 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcaf08c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.themepunch.tools.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 96 KB
36 KB 178ms
170ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery.themepunch.tools.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efc814c188f4789ae820023eaab71b46f33ca62a1ec25dc45817fdafe64471aa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"91cc0a55716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JQ1CXkIjfXl5MfuxUk8S7X5AK1tMhZbwmyFrlh0mWiH0Qp3FDe61ODdV39W0x5%2BysEt%2FVN%2BidScFeJygK0toim2%2F%2BykgvF%2Fmk3kvgdYEFOXwD%2BPhqYER4FfqjbbS9m%2FJoYGuFb3kRgTjzeNyN9na"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=58953&min_rtt=38735&rtt_var=22742&sent=487&recv=129&lost=0&retrans=0&sent_bytes=522599&recv_bytes=25443&delivery_rate=269841&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=876&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:22 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcaf28c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 owl.carousel.js Show response
faresbuddies.com/AirCanada/js/lib/ 52 KB
11 KB 172ms
165ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/owl.carousel.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c3ee451882f55975e5cd2b018ce4ad2b8c9c1f886f75d21ced76d0dacb49107e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"9654dca55716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OpH%2FKR%2FtnciqJWOZBVtOZ6S%2FNeFvjZDPCo9UjSEKFI%2Bvm4bM2NeSXF8yFfFlaFHHtEqoKy1cZs3%2BS5qigBAwPWNV%2BU7vk4UKAkP3mkE%2B90hmYzRZuFv1HdVI8BesL4%2Fv7MN8wHULUU3t1jrr53kz"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=61375&min_rtt=38735&rtt_var=23863&sent=467&recv=128&lost=0&retrans=0&sent_bytes=499936&recv_bytes=25399&delivery_rate=255190&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=868&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:23 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcaf48c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.appear.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 4 KB
2 KB 139ms
133ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery.appear.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b683ce74846a80a1643a51a68f56911b8a3acce936ecb82decd1ef58355d85d0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"932b17a25716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MGBEsLM1iGySDysnmkFQWIPG2JN4pZDmgAoUtWWMdu8La%2BwXY22Frx6T8SBGPqiWjbYb84Z2qmRaktX0%2FGuTgSSire%2BjpGYBLSEH5b%2BH9hOCv9iDcSp8UqQNO9PI0G8MxMGpagdLwfvUeh3LHdgk"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=70119&min_rtt=38735&rtt_var=25534&sent=415&recv=125&lost=0&retrans=0&sent_bytes=440889&recv_bytes=25267&delivery_rate=19949&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=847&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:17 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcaf58c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.countTo.js Show response
faresbuddies.com/AirCanada/js/lib/ 1 KB
1 KB 116ms
109ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery.countTo.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11a0caeb0b2d5b599bff55f4e78ba79745da5c73830e30ab24da63de1b0befcf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"82c1e6a25716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WEGsiqqlgIQQTAJPWlTf55tVdi3jBBLc8mU8y%2Ftl6PRBJgWPEfOp9ekw06xMuQ75D4oYpZm8vGHGDy4PR0t0uKTRQ%2Fkxf28j4E3WwdLf9BmK1YT47S8RB4xRvyGzJtYwIx7JzVM2ZhsZF6IVClXT"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=62307&min_rtt=38735&rtt_var=13213&sent=403&recv=124&lost=0&retrans=0&sent_bytes=430876&recv_bytes=24832&delivery_rate=214829&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=833&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:18 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcaf88c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.countdown.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 5 KB
3 KB 130ms
124ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery.countdown.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ad6299aa0ffaf80b23ebeb852618f545a1652cad9d8992c46e539381b6e1269

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"478ea4a25716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MfC%2BqYj4Em5ShwX%2Flll6s72VIrBKs2oE7FrC2A4eAK9AcJrQDiXKK0RYHd6Njy8kqR1Iv%2F0SSDRrMkq0a9cE7x5w3DyG%2BGgUe7nKACOmTQ4iZNiFPaUf2ubhOVLDfA8aG%2Btj6mhPxTaSN8STUhck"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=70119&min_rtt=38735&rtt_var=25534&sent=408&recv=125&lost=0&retrans=0&sent_bytes=434539&recv_bytes=25267&delivery_rate=19949&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=841&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:18 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcafa8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.parallax-1.1.3.js Show response
faresbuddies.com/AirCanada/js/lib/ 2 KB
2 KB 134ms
128ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery.parallax-1.1.3.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f503129318acedac215ac588bc183f30fa4fe4fda3731681634313776f0f4ef

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"84e52a45716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v%2F8xqUKQO5TYcZbUVTHXcv91q3geKo4syJEI6ol1EISlnvW8n238C6akSMn2%2FiVCOcEoKP0lh2tvdfR9GyvSqnQU%2FRpVJsJzRzDkyqPlCyN5z%2FmZpubu%2FffaqarrROsgTXlRQs3U1x3qZbwhLstE"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=70119&min_rtt=38735&rtt_var=25534&sent=408&recv=125&lost=0&retrans=0&sent_bytes=434539&recv_bytes=25267&delivery_rate=19949&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=841&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:20 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcafd8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.magnific-popup.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 21 KB
9 KB 160ms
154ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery.magnific-popup.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecbef0f33e8ccedd2c605816e052cfff778abcc0e30a80b874c097a5fddd24fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"17aa7a45716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CV8NMyVl15801wvRL71mTkpjwg%2BEsQ48EAo6j1%2FAjl2HCFa7EiPngjfdkhhRhGv%2F5b86iHtrf4bjKMCEeaicDfftm0hBpehbS8BYstLPtGNPmPOjPvMs%2FXiZ1arMSvtaC9vnc8%2FwMwHd7SB%2B34cr"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=70119&min_rtt=38735&rtt_var=25534&sent=425&recv=125&lost=0&retrans=0&sent_bytes=452277&recv_bytes=25267&delivery_rate=19949&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=855&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:20 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcafe8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 SmoothScroll.js Show response
faresbuddies.com/AirCanada/js/lib/ 14 KB
5 KB 162ms
156ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/SmoothScroll.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ddd550d5f7991e3c4406b2624aaf583ad8546c5902371bd96ec4e23fec0a15a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"79313ba65716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SoYisNJW9piPP%2BwUH9I3M1LcQzWPdsy746H2zu5oZQ2WpFi5%2BGtGB8QdBPC9LAU7xNrWPPk70ULVHK7%2F37%2Bv2uhl3E7IBhXAipPbUxForV%2FOaD%2BGuGg0lX%2FcMDyUs3m933gWjWzrvpJ7YXovBPbI"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=70119&min_rtt=38735&rtt_var=25534&sent=417&recv=125&lost=0&retrans=0&sent_bytes=443179&recv_bytes=25267&delivery_rate=19949&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=852&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:24 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcb008c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.form.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 18 KB
6 KB 169ms
165ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery.form.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eccb09f71c6181f4a60bfeb6ae7daa1a8e451a8fe4e1ca4f1567e7decc970882

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"5f6255a35716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IHHZmUEYkcwBgAcdw9gL9kX6piriVKOHt9Db4cgQ0ZB3WJD%2BnULE5sGh%2Feu63dQeMGX3qUnSt5pFsqVA%2FvxdYoURWtYvWQdXtzBVAKAM8FC3SKSRna0KDYKkKKImzTmxoQ3r5aatpubN%2Bl6ZivCr"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=61375&min_rtt=38735&rtt_var=23863&sent=453&recv=128&lost=0&retrans=0&sent_bytes=484392&recv_bytes=25399&delivery_rate=255190&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=865&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:19 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcb018c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 jquery.validate.min.js Show response
faresbuddies.com/AirCanada/js/lib/ 21 KB
8 KB 169ms
166ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/lib/jquery.validate.min.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a931d758e10b5f646f42e4b1100ee31b7ce4cdf5a86d59133424b65c8802788b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"a2a6ada55716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pd5O8LU1y%2BzTeJdoqFgDqJjZpSxbCzgOQRQ2pnrQGgoEMWHOf9Q3V8umCe4SP%2B4a6rM%2F5gULFbsU8GgB%2BHiYaT1S5t6VZoypUJut4uizi0Zb8jfmw2fpqZkcnf93txr6Z5T%2F4pzlw5EWfOuWVeYE"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=61375&min_rtt=38735&rtt_var=23863&sent=453&recv=128&lost=0&retrans=0&sent_bytes=484392&recv_bytes=25399&delivery_rate=255190&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=865&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:19:23 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcb028c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 scripts.js Show response
faresbuddies.com/AirCanada/js/ 18 KB
6 KB 160ms
157ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/scripts.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4bb557dde95b0f4f77c38cd27539e1ba7f551a1427c434f2e94847ac1d58ce3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"4949a5435716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BXqRyr%2BRcCQWadLxJwA%2BI2cleDIVndxl6EasbIXptF2WWZ%2BEyn5J9BfxMSfm1X0PlPksNa8nn78osYVqdluFSGV3ctN3xHbb0T9GdZ9BVIb3QrLPK55FMYv6AcWAj5veS39KXkr5CI6TsAKkwlAe"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=61375&min_rtt=38735&rtt_var=23863&sent=437&recv=128&lost=0&retrans=0&sent_bytes=465853&recv_bytes=25399&delivery_rate=255190&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=858&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Fri, 04 Oct 2024 12:16:39 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcb048c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 custom.js Show response
faresbuddies.com/AirCanada/js/ 9 KB
3 KB 160ms
158ms Script
application/javascript 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/js/custom.js

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

888e044c13093315da7c54dc7aa4844cbafbab6a2db13f3bd87358984cbc96ec

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"d8c52e5aac18db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1u%2Bz3%2BJJNr8kQ1T9Vup0Wr2zQto7eqZIpoNG1ryYFWrdfdBx6kxM6WRuz0ZOMS8N2wNbjDOeBNUbQ%2FeCLMMyeMQoDh%2BvOduZb%2FFcWsGsui8xvtP%2BuGGpZu7iOavR0Nyed2XW51F276DsF7ggqcIF"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=70119&min_rtt=38735&rtt_var=25534&sent=422&recv=125&lost=0&retrans=0&sent_bytes=448800&recv_bytes=25267&delivery_rate=19949&cwnd=152400&unsent_bytes=0&cid=c0b2214edbd82949&ts=854&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 11:30:46 GMT
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bcb058c4e-EWR
access-control-allow-origin: *
server: cloudflare

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 832ms
290ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K5X70M5BR&gtm=45je4bk0v9194992903za200&_p=1732716028235&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=1295190464.1732716029&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1732716028&sct=1&seg=0&dl=https%3A%2F%2Ffaresbuddies.com%2FAircanadaTR.html%3FSRC%3DTRILLION%26SUBID%3D230924041%26KWD%3Dair%2Bcanada%26sid%3D20241128010024db8d873eb4105262d6&dt=Flight%20Booking%20With%20FaresBuddies&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1642
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2K5X70M5BR
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://faresbuddies.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v21/ 8 KB
8 KB 170ms
42ms Font
font/woff2 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://fonts.googleapis.com/

Response headers

age: 437721
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 22 Nov 2025 12:25:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 22 Nov 2024 12:25:07 GMT
last-modified: Fri, 22 Mar 2024 00:00:38 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7884
x-xss-protection: 0
server: sffe

GET
H3 200 icomoonaabe.woff
faresbuddies.com/AirCanada/fonts/hillterIcon/ 17 KB
11 KB 118ms
117ms Font
font/x-woff 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/AirCanada/fonts/hillterIcon/icomoonaabe.woff?-kpo47j

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AirCanada/css/lib/font-hilltericon.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

576639c617b714049113e9d45544fcb59fdf5e534dfb0e3f6f14f66ba550d6f9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://faresbuddies.com/AirCanada/css/lib/font-hilltericon.css

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"b5335515716db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N0NjiOe36OMEnBd5537C6%2BRP3EZTKHlhRFzjpqWntEosWTI9u0zq4UmdXUTzG3w2iR%2BUL3cTX6dpVdCBZbSUjcGaQfC7vcDyPczrnG0UEqJj88BFcdlHrzI3JYtw%2FlvmJr5XRelVYtgc61u%2BeviE"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=53681&min_rtt=38735&rtt_var=11963&sent=589&recv=134&lost=0&retrans=0&sent_bytes=639191&recv_bytes=25666&delivery_rate=282107&cwnd=161100&unsent_bytes=0&cid=c0b2214edbd82949&ts=910&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:28 GMT
content-type: font/x-woff
last-modified: Fri, 04 Oct 2024 12:17:01 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50bfb698c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v21/ 8 KB
8 KB 167ms
41ms Font
font/woff2 2607:f8b0:4006:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://fonts.googleapis.com/

Response headers

age: 410939
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 22 Nov 2025 19:51:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 22 Nov 2024 19:51:29 GMT
last-modified: Fri, 22 Mar 2024 00:00:32 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7816
x-xss-protection: 0
server: sffe

GET
H3 200 1iaq3pf3j Show response
embed.tawk.to/67179cdb4304e3196ad598d0/ 2 KB
1011 B 214ms
66ms Script
application/x-javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/67179cdb4304e3196ad598d0/1iaq3pf3j

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46886c9ffe96df51d1894639c4364a027b2ffa78d9811f9310886bc4d1226408

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"stable-v4-67354992019"
age: 1996
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: application/x-javascript
vary: Accept-Encoding
priority: u=3,i=?0
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=7200, s-maxage=3600
cf-ray: 8e92a50efe3e436a-EWR
access-control-allow-origin: *
server: cloudflare

POST
H3 200 InsertData.ashx Show response
faresbuddies.com/Insert_v2/ 21 B
824 B 142ms
133ms XHR
text/plain 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/Insert_v2/InsertData.ashx?Keyword_=air%20canada&pagename_=AC&Adsource_=TRILLION&SUBID_=230924041

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AirCanada/js/custom.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd71b4493cbd4873620c4b80068fc363d2f0c55c8cec40f1de75b49c44a989ab

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBeBz320f3vNmdHPj
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wca0pXAEGxeAMhA4fl90mkZJ5PcgCw9wc%2Fe2%2FcCJIqlBPCsivbWTXbEAgQn3qQqobJhGqRLEvNnYmafhuN4w10Fgc3nMiIpVJy4pcMPErPpKBH5BWQz3X9scvObVDCEOdPiIETWTGuPxxRgbZzCH"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=45517&min_rtt=38735&rtt_var=5040&sent=638&recv=156&lost=0&retrans=0&sent_bytes=688710&recv_bytes=27682&delivery_rate=2427708&cwnd=194700&unsent_bytes=0&cid=c0b2214edbd82949&ts=1280&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
cache-control: private
x-aspnet-version: 4.0.30319
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50e1e4b8c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 ui-bg_flat_75_ffffff_40x100.png
faresbuddies.com/AirCanada/sform/ui/1.11.4/themes/smoothness/images/ 247 B
1009 B 106ms
104ms Image
image/png 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://faresbuddies.com/AirCanada/sform/ui/1.11.4/themes/smoothness/images/ui-bg_flat_75_ffffff_40x100.png

Requested by

Host: faresbuddies.com
URL: https://faresbuddies.com/AirCanada/sform/ui/1.11.4/themes/smoothness/jquery-ui.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fc87114ecf1d8bdd5f75fd6a3cff45db5782d41249cd7af503bfd54a106a8bb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AirCanada/sform/ui/1.11.4/themes/smoothness/jquery-ui.css

Response headers

cf-cache-status: DYNAMIC
etag: "6492b5225816db1:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Y3UadwkHCMUwK7xE8ODaLO5PMlMdVWAThVZSz3r7J%2FiyOmV1puXoPgHAUMON1os934w1N2GCmQpya3IAiiKT3mYkklyooGso1B0sb%2BnIZXSiNof38aQ22rjpIdTGfSEL4cChLtfkUx8orFG3JmL"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=45517&min_rtt=38735&rtt_var=5040&sent=637&recv=156&lost=0&retrans=0&sent_bytes=687677&recv_bytes=27682&delivery_rate=2427708&cwnd=194700&unsent_bytes=0&cid=c0b2214edbd82949&ts=1212&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: image/png
last-modified: Fri, 04 Oct 2024 12:22:53 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50e2e5f8c4e-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 247
server: cloudflare

GET
H3 200 twk-main.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 121 B
382 B 56ms
54ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-main.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/67179cdb4304e3196ad598d0/1iaq3pf3j

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

705186becc9e0a306a6b4867ae2768aa9dd3b8c12393d9f9c52029e9a6fcf31c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://faresbuddies.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"da5bb1dc647470204df0e49f5afac2de"
age: 1147588
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a50f9f04436a-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-vendor.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 81 KB
32 KB 97ms
95ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-vendor.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/67179cdb4304e3196ad598d0/1iaq3pf3j

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

548669d6434f5204dca25b9a6f8a02f63301b8c1b58a717b91fec8b6c2918305

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"3b341e35b39f6195793ecaf5db7c1d63"
age: 1147588
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a50f9f05436a-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-chunk-vendors.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 212 KB
71 KB 168ms
167ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-vendors.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/67179cdb4304e3196ad598d0/1iaq3pf3j

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

194c4fa82fa9bf5897963b335fddcfdb462fe898cafbe8b2eb72a9803f2db05f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"77a40166698f808a0942865537165b0f"
age: 1147588
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a50f9f06436a-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-chunk-common.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 223 KB
63 KB 57ms
56ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-common.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/67179cdb4304e3196ad598d0/1iaq3pf3j

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b17f212fc06e1cde0574bdd1ee89d507461f5777e3039c725dbb40b5ebb3f192

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"ae0a97d1265892fc012190aa72881581"
age: 1147588
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a50f9f08436a-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-runtime.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 2 KB
1 KB 58ms
57ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-runtime.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/67179cdb4304e3196ad598d0/1iaq3pf3j

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41c6e86ff4eff6723f15faa7650734836876f67fd98e91d08908115271eac6e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"895415bbe1b8cf97aef258d17cb33187"
age: 120484
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a50f9f0a436a-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-app.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 151 B
406 B 248ms
248ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-app.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/67179cdb4304e3196ad598d0/1iaq3pf3j

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13cf82e6f9d48221cd55f8b3c3d206f7bdb83f291034b478e484ccfef7d500dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://faresbuddies.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"e736e189edb5d0d9d5b8e7f23dd9114a"
age: 1147588
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a50f9f0b436a-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 favicon.ico
faresbuddies.com/content/images/ 4 KB
3 KB 59ms
58ms Other
image/x-icon 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/content/images/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af52e48fba434fe6ce02fdf1ea715fd227ab75dd491b393ad4cde7d97eca545a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"8e9a7d9d4d5d91:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FCS3M5zKR0K6R1fszASZYMrIEjM5NZPbkrwzgXN5u5G7h7OCq3SVwRWm6IdW5AOqWG%2BElokC9lCgsafZGCiRe2%2FP36VvIMQvFZjkBQHoY%2F7ufMwsS9JMR%2BsacrklAHHXAmC7MvDexF5tu4vTLtbg"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=48154&min_rtt=38735&rtt_var=11223&sent=640&recv=159&lost=0&retrans=0&sent_bytes=689583&recv_bytes=28266&delivery_rate=16065&cwnd=194700&unsent_bytes=0&cid=c0b2214edbd82949&ts=1470&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: image/x-icon
last-modified: Wed, 23 Aug 2023 15:16:54 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50fc8868c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 favicon.ico
faresbuddies.com/content/images/ 4 KB
0 0ms
0ms Other
image/x-icon 2606:4700:3030::ac43:b1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://faresbuddies.com/content/images/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:b1b5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af52e48fba434fe6ce02fdf1ea715fd227ab75dd491b393ad4cde7d97eca545a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors http://skyflight-nfo.be.openfares.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/AircanadaTR.html?SRC=TRILLION&SUBID=230924041&KWD=air+canada&sid=20241128010024db8d873eb4105262d6

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
etag: W/"8e9a7d9d4d5d91:0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FCS3M5zKR0K6R1fszASZYMrIEjM5NZPbkrwzgXN5u5G7h7OCq3SVwRWm6IdW5AOqWG%2BElokC9lCgsafZGCiRe2%2FP36VvIMQvFZjkBQHoY%2F7ufMwsS9JMR%2BsacrklAHHXAmC7MvDexF5tu4vTLtbg"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=48154&min_rtt=38735&rtt_var=11223&sent=640&recv=159&lost=0&retrans=0&sent_bytes=689583&recv_bytes=28266&delivery_rate=16065&cwnd=194700&unsent_bytes=0&cid=c0b2214edbd82949&ts=1470&x=1", cfHdrFlush;dur=0
x-ua-compatible: IE=edge,chrome=1
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: image/x-icon
last-modified: Wed, 23 Aug 2023 15:16:54 GMT
access-control-allow-headers: accept, content-type
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors http://skyflight-nfo.be.openfares.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8e92a50fc8868c4e-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 widget-settings Show response
va.tawk.to/v1/ 3 KB
1 KB 65ms
53ms Fetch
application/json 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/v1/widget-settings?propertyId=67179cdb4304e3196ad598d0&widgetId=1iaq3pf3j&sv=null

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-common.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea081538b71426db47b34275d48490f59c9b20ad9f4596f3e79ef605b4a238cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: HIT
etag: W/"2-4-0"
age: 1558
access-control-allow-methods: GET,OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:29 GMT
content-type: application/json
x-served-by: visitor-application-preemptive-0k4n
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: content-type,x-tawk-token
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=7200, s-maxage=1800
cf-ray: 8e92a511c993436a-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 en.js Show response
embed.tawk.to/_s/v4/app/67354992019/languages/ 17 KB
5 KB 184ms
181ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/languages/en.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-common.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9b048a94a13087fea28ca2dfe0ac3125b59bee2ce84829943918114045c707d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"1e587fa30ae5bd661c7a0887bb95b40a"
age: 1150992
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a5137e9618b4-EWR
access-control-allow-origin: *
server: cloudflare

POST
H3 200 start Show response
va.tawk.to/v1/session/ 1 KB
1 KB 268ms
266ms Fetch
application/json 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/v1/session/start

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-common.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13c45786798850a0031961dcb648be4737569abeee95ea344a16bd8999abad16

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json; charset=utf-8
Referer: https://faresbuddies.com/

Response headers

access-control-max-age: 3600
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/json
x-served-by: visitor-application-preemptive-10rk
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: content-type,x-tawk-token
strict-transport-security: max-age=0; includeSubDomains; preload
access-control-allow-credentials: true
cf-ray: 8e92a5146f7018b4-EWR
access-control-allow-origin: https://faresbuddies.com
server: cloudflare

OPTIONS
H3 200 start
va.tawk.to/v1/session/ Frame 0
0 95ms
95ms Preflight
text/html 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/v1/session/start

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://faresbuddies.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-tawk-token
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://faresbuddies.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=86400
cache-control: public, s-maxage=600, max-age=600
cf-cache-status: DYNAMIC
cf-ray: 8e92a513ebca436a-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 27 Nov 2024 14:00:30 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=0; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-served-by: visitor-application-preemptive-tb90

GET
H3 200 twk-chunk-bf24a88e.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 10 KB
3 KB 106ms
103ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-bf24a88e.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-runtime.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf0bb2630fde34a664dc471d3a575a72c37b5a96cb74fcafb92ca7f17fefbe40

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"c96127c9a0429d69fecbeb73fd410443"
age: 129675
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: STALE
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a51648b618b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-chunk-71978bb6.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 18 KB
5 KB 52ms
49ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-71978bb6.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-runtime.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c3e24c6486aaebd7397266feec4133d7ece6c169444a438e5ccd93d7aa89246d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"adcf466d8e820d5dd8a7df9975fcba50"
age: 120490
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a51648b718b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-chunk-f1565420.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 11 KB
4 KB 106ms
104ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-f1565420.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-runtime.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c794b77e334506d36bd79580f6d33ccedc6d13b5c05b2b701123399d3d49947

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"1f098cd7a811a2ceef21d53835262c2d"
age: 1150983
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a51648b818b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-chunk-7c2f6ba4.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 5 KB
2 KB 50ms
47ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-7c2f6ba4.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-runtime.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

357f86eb123b4e1a850f2583a8779a9171a61b98284cea3c89fb285e1baebb81

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"977b0aa25f349861d14d837b480e5615"
age: 583994
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a51648b918b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-chunk-48f3b594.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 17 KB
6 KB 52ms
49ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-48f3b594.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-runtime.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4decde1fd4af3ee8c5952646190f4c638de918ceb129cc4e87e2e2edc67dc87d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"d26f24b5583b0a809ef3db128cbf6a06"
age: 1150991
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a51648ba18b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-chunk-4fe9d5dd.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 906 B
696 B 102ms
101ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-4fe9d5dd.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-runtime.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb193c2bcf1a14030cea8d72baa20ab7b1cf88f9e90adb31895279beedf6bf84

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"1c5ecf371149feca23bd895ba9dfec4d"
age: 109187
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a51648bc18b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-chunk-2d0b9454.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 535 B
607 B 103ms
101ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-2d0b9454.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-runtime.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e0a886153a50f34adeb6d141b542d08a6338c5e3bada9fc3ccf88d0580356df

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"c506281367048d4a134c9affbc68c8c6"
age: 94732
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a51648bd18b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 twk-chunk-24d8db78.js Show response
embed.tawk.to/_s/v4/app/67354992019/js/ 120 KB
31 KB 104ms
102ms Script
application/javascript 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-24d8db78.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-runtime.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e42428b7cf745a93ba7853cdb58324b7e0121fbbeb5f61be5479d73e384be104

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"ad43e469764eb884ca6ab070740c1931"
age: 1150991
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a51648bf18b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 min-widget.css
embed.tawk.to/_s/v4/app/67354992019/css/ Frame 0197 24 KB
6 KB 66ms
66ms Stylesheet
text/css 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/css/min-widget.css

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-bf24a88e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

69fb03e8827d27e64583979ae09fe2242047e15c953e7aa3a85b9af66a031cbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"2d7f176b563b25833791f4844819b5ee"
age: 1150991
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: text/css
last-modified: Thu, 14 Nov 2024 00:52:21 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a517ba6118b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 bubble-widget.css
embed.tawk.to/_s/v4/app/67354992019/css/ Frame 0F26 13 KB
3 KB 56ms
55ms Stylesheet
text/css 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/css/bubble-widget.css

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-bf24a88e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb4d72e4e2a01c6eb415c6645a0e9da33f5e85afe211230132f59341e1f1a23e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"ce7913b80c763449b3895d46419f7a6b"
age: 1150983
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: text/css
last-modified: Thu, 14 Nov 2024 00:52:20 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a517da7e18b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 message-preview.css
embed.tawk.to/_s/v4/app/67354992019/css/ Frame 35D9 42 KB
10 KB 49ms
48ms Stylesheet
text/css 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/css/message-preview.css

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-bf24a88e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4ebe81ec01c33bd339149314130d65c8a716890fe6c9edb50300c0965c759b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"313ec28abf9889abec5153d8318e8022"
age: 1150991
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: text/css
last-modified: Thu, 14 Nov 2024 00:52:20 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-cache-status: MISS
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a517fa9418b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 max-widget.css
embed.tawk.to/_s/v4/app/67354992019/css/ Frame 2574 79 KB
18 KB 47ms
47ms Stylesheet
text/css 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/67354992019/css/max-widget.css

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-bf24a88e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7b24be039d81d334a5b082bd6c883988e026ca276debc7bea3b4941d4146abd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"d20ad407080e4c57efd32ce36955d7db"
age: 1150991
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: text/css
last-modified: Thu, 14 Nov 2024 00:52:20 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a5183abc18b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 168-r-br.svg
embed.tawk.to/_s/v4/assets/images/attention-grabbers/ Frame 0F26 22 KB
7 KB 50ms
49ms Image
image/svg+xml 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://embed.tawk.to/_s/v4/assets/images/attention-grabbers/168-r-br.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5108ef00c54e1f6ce859852834135447457cf19ee19aa7b0fb55b64b425cb526

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"f66e029841759471d2ec78b86760dca7"
age: 1740560
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: image/svg+xml
last-modified: Sat, 22 May 2021 07:25:19 GMT
vary: Accept-Encoding
priority: u=3,i
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a5186ae618b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H3 200 tawk-font-icon-2.woff2
embed.tawk.to/_s/v4/assets/fonts/ Frame 0F26 10 KB
11 KB 61ms
60ms Font
font/woff2 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/assets/fonts/tawk-font-icon-2.woff2?55755728=

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/css/bubble-widget.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4d4fcb3cdd9f021bca50bedb83de05b77fd23b3c98ad36b103fea8c0744ea71

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://embed.tawk.to/_s/v4/app/67354992019/css/bubble-widget.css

Response headers

cf-cache-status: HIT
etag: "054b3b66812d0a4b87ffc6776f0a42f1"
age: 517320
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: font/woff2
last-modified: Sat, 22 May 2021 07:25:13 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-cache-status: HIT
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a5187a0d436a-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10520
server: cloudflare

GET
H2 200 emojione.min.js Show response
cdn.jsdelivr.net/emojione/2.2.7/lib/js/ 295 KB
41 KB 373ms
20ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/emojione/2.2.7/lib/js/emojione.min.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-vendors.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f5c06455e539dcd889f7f05d709b5adc76c444099fe57f431365af2fc57e803b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://faresbuddies.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"49dda-cp9vjKV4fYl0Ow7X6yf9dkBr+YU"
age: 3049889
x-content-type-options: nosniff
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Wed, 27 Nov 2024 14:00:31 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220140-FRA, cache-yyz4522-YYZ
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 41275

POST
H3 200 v3 Show response
va.tawk.to/log-performance/ 5 B
313 B 79ms
77ms Fetch
text/html 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/log-performance/v3

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/js/twk-chunk-common.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json; charset=utf-8
Referer: https://faresbuddies.com/

Response headers

access-control-max-age: 3600
content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:31 GMT
content-type: text/html; charset=utf-8
x-served-by: visitor-application-preemptive-c94z
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: content-type,x-tawk-token
strict-transport-security: max-age=0; includeSubDomains; preload
access-control-allow-credentials: true
cf-ray: 8e92a51b0cca436a-EWR
access-control-allow-origin: https://faresbuddies.com
server: cloudflare

OPTIONS
H3 200 v3
va.tawk.to/log-performance/ Frame 0
0 86ms
85ms Preflight
text/html 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/log-performance/v3

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://faresbuddies.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-tawk-token
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://faresbuddies.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=86400
cache-control: public, s-maxage=600, max-age=600
cf-cache-status: DYNAMIC
cf-ray: 8e92a51a7c42436a-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 27 Nov 2024 14:00:31 GMT
priority: u=1,i
server: cloudflare
server-timing: cfExtPri
strict-transport-security: max-age=0; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-served-by: visitor-application-preemptive-tb90

GET
H3 200 tawk-font-icon-2.woff2
embed.tawk.to/_s/v4/assets/fonts/ Frame 35D9 10 KB
0 1ms
1ms Font
font/woff2 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/assets/fonts/tawk-font-icon-2.woff2?55755728=

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/67354992019/css/message-preview.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4d4fcb3cdd9f021bca50bedb83de05b77fd23b3c98ad36b103fea8c0744ea71

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://faresbuddies.com
Referer: https://embed.tawk.to/_s/v4/app/67354992019/css/message-preview.css

Response headers

cf-cache-status: HIT
etag: "054b3b66812d0a4b87ffc6776f0a42f1"
age: 517320
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:30 GMT
content-type: font/woff2
last-modified: Sat, 22 May 2021 07:25:13 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-cache-status: HIT
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a5187a0d436a-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10520
server: cloudflare

GET
H3 200 default-profile.svg
embed.tawk.to/_s/v4/assets/images/ Frame 35D9 4 KB
2 KB 51ms
50ms Image
image/svg+xml 2606:4700:10::ac43:f0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://embed.tawk.to/_s/v4/assets/images/default-profile.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:f0e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d30ef5a13391aefdea0738a1e15d88c19e986f865409f9457e5c7d8468e15817

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"eacd4642ddb798db835cf8f285bbbb19"
age: 1841801
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 27 Nov 2024 14:00:31 GMT
content-type: image/svg+xml
last-modified: Sat, 22 May 2021 07:25:18 GMT
vary: Accept-Encoding
priority: u=3,i
x-cache-status: MISS
strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=2592000, immutable
cf-ray: 8e92a51f499a18b4-EWR
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1f44b.png
cdn.jsdelivr.net/emojione/assets/png/ Frame 35D9 1 KB
1 KB 22ms
21ms Image
image/png 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.jsdelivr.net/emojione/assets/png/1f44b.png?v=2.2.7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d84e890fa93c018d8b78e3bff3f6252036aa7ead6e48b292c0b92b1cb5127371

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: *
etag: W/"51f-Lhpf/5pVjttXKKAzYbc9FjP7pB4"
age: 4944050
x-content-type-options: nosniff
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Wed, 27 Nov 2024 14:00:31 GMT
content-type: image/png
x-served-by: cache-fra-eddf8230054-FRA, cache-yyz4522-YYZ
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1311

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: biruuq.com
URL: https://biruuq.com/favicon.ico

Verdicts & Comments Add Verdict or Comment

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.faresbuddies.com/	1970-01-21 10:54:36	Name: _ga_2K5X70M5BR Value: GS1.1.1732716028.1.0.1732716028.0.0.0
.faresbuddies.com/	1970-01-21 10:54:36	Name: _ga Value: GA1.1.1295190464.1732716029
faresbuddies.com/	1969-12-31 23:59:59	Name: twk_idm_key Value: farZPKEyMwvlQL_nupkL9
faresbuddies.com/	1969-12-31 23:59:59	Name: TawkConnectionTime Value: 0
.faresbuddies.com/	1970-01-21 05:37:48	Name: twk_uuid_67179cdb4304e3196ad598d0 Value: %7B%22uuid%22%3A%221.2Bisgr9bVUI5X8Lr5owQgjW4VHOgUSsv0QrrFThHnq6jitNGEi6WITj0aTYkUKnJrzSO18vdU41B4Z1Fibwhahq6AqWE151eEptrsQIYZlaBoE8Fqs98GIMGLW7%22%2C%22version%22%3A3%2C%22domain%22%3A%22faresbuddies.com%22%2C%22ts%22%3A1732716030405%7D

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://biruuq.com/f.php?e=JjHBdrjo54e1YRnVx8OHA349fkNiT0VrOEpmcWwwQ2tOS01BekptbjlaQkE4L0daK050QzQvdzZ0VjlOTWdlbjZRbFluQnNMbFhIOWJyV0U2L3FvbXAxZFBYbFhZcDU2bGJxN3RGdWRWVlBkdjEybGtMSVVCNDMrUDZHTDFCc011TTJUN0d0eEJNb05TQU5oMnEvOGZ5bmNjejJxbkl4L29JNVRjdjdtdlgxRXpUY2ZpalFPTDJnY2x4RUMySCtsTHliT3RFMWd6TnNkdG1KWjY0NHpwTlZ6cW5ybWphaStHbytkSnltT2pPMCtPdXh2OGVXa25ZS3BEbFY4d2p6SzgvMW1jcGlLYmRvQVgzVk1HdGNRWlJzWEdyTlpyRXIzMldmRGtFb05JeEpYdVNVdmI3Ry93cHJXOGo0MmZzZXVRaUMzNHJ6eEUvT0J4QlJsbGNWVGhRMVdiZnNYVDZSN2J2cHpES2FNU3ZHdkJ5REZxUTdBMlRoNjk0aTRIUWZTWjlRekU3RFR3ZEh5NTJwL2hJRnFlS0Y2MmpzNTVEa3FSMThYRHNiS0x2RTJXcXZQajFxQjlhYjZ5MVlSUzZsMkZxKzVYMVVKcFU5NEJVQmpXeUJUeEZ5Qm5nbDRzSlNIcnc0aE5vSG5LcHdFSWllc2VrVWFiRkhHL0xNdG15OWZiQUtDWWlWUVlybzJ3UzkzUXViazJSd01QQjg2OEkrZVRWT1FTTHhFam5HM0U2Z1ZuMGFKcmZzTlRlZWdwWmJacmdVSXdOdzBwWWFsM1Nkd2FyWDRvQ05FNnc5ZDVrcHYyOGNxaDRKZTcxVlFLOEJsK1FCL2NEN3RhYU9qTGJjSVBycHVlcUtObzQ4MkVLK0Z1dllONm5hWlpacVc4bk02bnFrckFhZTFzZjlic2l5dDM4YytQdFVPdUlyRnFoRUVWcmdXdXp5RkdHa0RzUXBNY09vWXF0dC9kY3JLMGZNUFVEU3ZCTGN2ajI2N1ZTOUUyaEsvUi9lS0ZidXF5Y0MwU0VRR1FrTlVlSnVGSWpZRlJXQlFreFJLaHlQdkJsT1QrQ3VBM3pYa0tuNEtUZlpnWjFuMGdKSzdBS0I3VVdyRmlBVFpTeUZyYi9YTTBUWllxNjdsQ1ZCajVyT09OVkljVDVvRUs3T0xwcWFPVnVDSHVwT2xIdWtRWFdFVGVDbW5FdldhYVEvem9Kb3ZjZlJhaUZWZ1BSb0lScHpuMEdjVWZBUFZjZGFscXRkc1ZocnR0OW9kZTlPdzhGVnhsUE93R0Y0ZmlzUGNzOVpSc3BnYzdyWkFBdlBoQ1B1SDV6dXIvblphTDlwbFJYWEJBSjMvU0RscFowdjRxNHBoVGNqeHltVlJpclY1Y3p3djhTTk1IUno%3D Message: [GroupMarkerNotSet(crbug.com/242999)!:A0D09600A4360000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://faresbuddies.com/AirCanada/images/AirCanada-express.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

biruuq.com
cdn.jsdelivr.net
embed.tawk.to
faresbuddies.com
fonts.googleapis.com
fonts.gstatic.com
region1.google-analytics.com
va.tawk.to
ww99.aircamada.ca
www.googletagmanager.com
www.www.www.www.sitemap.aircamada.ca
biruuq.com
103.224.182.206
172.233.219.123
2001:4860:4802:32::36
2606:4700:10::ac43:f0e
2606:4700:3030::ac43:b1b5
2607:f8b0:4006:80c::2003
2607:f8b0:4006:80e::200a
2607:f8b0:4006:820::2008
2a04:4e42:200::485
72.52.178.23
060fc3b22934748629237f69ec1ee40b7e822cd1b1e1abfee057b848f5ca9557
0c8e8d7408611519ceda4e759ae9987834a17addc8f0028241ffed7fb0113612
0ccc4a85af8ed33b854847377d97df535293eff0cb992d5d5a853209bb2743b1
0fc87114ecf1d8bdd5f75fd6a3cff45db5782d41249cd7af503bfd54a106a8bb
112487fa82aa24a62c46eafbdbef72e6c81f718cf70026cd207a1be43d1e31aa
11a0caeb0b2d5b599bff55f4e78ba79745da5c73830e30ab24da63de1b0befcf
13c45786798850a0031961dcb648be4737569abeee95ea344a16bd8999abad16
13cf82e6f9d48221cd55f8b3c3d206f7bdb83f291034b478e484ccfef7d500dd
1525336a0cf5a8b66622665a90d5038d23e6d51613ff6dc63651638a20838e51
194c4fa82fa9bf5897963b335fddcfdb462fe898cafbe8b2eb72a9803f2db05f
1af2d15a5c2c02f22f46ccd4ae8d8841e40d4a0a9064a5ba73fd7b1f47fa5699
20b25939f4c2beb7d53703eba4e50e778b8d29c8bc9e0425fe0f599fb313708c
2b87b8dced5ce08da642941cb158cf77fac026dd51653f2cfe2bbb57215b8844
2f503129318acedac215ac588bc183f30fa4fe4fda3731681634313776f0f4ef
319c8683141cae0c5648f254545bb3e8abffb23f9566a706e1d161d0e37a1b4b
357f86eb123b4e1a850f2583a8779a9171a61b98284cea3c89fb285e1baebb81
3e946fe30af50bf51c1224e69e3da4505347ab80f4897b511565340ad7d2f138
3ffe9a0835ac7d45143789cb75e74d69c3eea99a8e6063459ec9b378622c4b1d
41c6e86ff4eff6723f15faa7650734836876f67fd98e91d08908115271eac6e5
467d7126df55e309c956edc502d302d7f383c54e37704b59ea5126a54123fdbc
46886c9ffe96df51d1894639c4364a027b2ffa78d9811f9310886bc4d1226408
46c0dc89cf6d107e63f1ff8f8c2cc92c33294dab989d4bc6db9abe1151bb154c
4decde1fd4af3ee8c5952646190f4c638de918ceb129cc4e87e2e2edc67dc87d
5108ef00c54e1f6ce859852834135447457cf19ee19aa7b0fb55b64b425cb526
548669d6434f5204dca25b9a6f8a02f63301b8c1b58a717b91fec8b6c2918305
576639c617b714049113e9d45544fcb59fdf5e534dfb0e3f6f14f66ba550d6f9
57cbe1497c81688772eda8452278df4be4093e5ba2ed885b7578539a36130b40
5945935b868b1a8f5eb9e4df30b412e760115b11aa161469fbcf79123816a3a0
5c9d9f6037f5e1522c783f30b04750fb9242ee7b82ca1a7d9a6c7b427a2228f8
5ddd550d5f7991e3c4406b2624aaf583ad8546c5902371bd96ec4e23fec0a15a
5ff235fb47e996e83d2d852787db0716b6304b764c9dd5717c253bdad9f209b3
69fb03e8827d27e64583979ae09fe2242047e15c953e7aa3a85b9af66a031cbd
705186becc9e0a306a6b4867ae2768aa9dd3b8c12393d9f9c52029e9a6fcf31c
7ad6299aa0ffaf80b23ebeb852618f545a1652cad9d8992c46e539381b6e1269
7bfeae9283fa57b16680b6b82e540701d37f8af56a6593623280118228792fc6
7c794b77e334506d36bd79580f6d33ccedc6d13b5c05b2b701123399d3d49947
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7e0a886153a50f34adeb6d141b542d08a6338c5e3bada9fc3ccf88d0580356df
821ca845c6e412fd6117eda79aae04c373d54e0294a77acb6e216517d0b90ad0
83ab7bb1e23d3c5cc3bbfcf865d176233071f363d91d4806b3f02c7eda5add30
888e044c13093315da7c54dc7aa4844cbafbab6a2db13f3bd87358984cbc96ec
8caf1a33c8d914970dab1aaf0da9f28f4a3bac0efc500256a0d532aa21782382
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9
9486c00df4a831289ee8e5467bfbde3cc5a767e651a5c570cd0d24550c20515b
a7b24be039d81d334a5b082bd6c883988e026ca276debc7bea3b4941d4146abd
a931d758e10b5f646f42e4b1100ee31b7ce4cdf5a86d59133424b65c8802788b
af2419dd15e09ea913cfe94d130f9870486732e57764e0f02ea3846f204146ee
af52e48fba434fe6ce02fdf1ea715fd227ab75dd491b393ad4cde7d97eca545a
b065a7a06b7a95d21213ae3b175cc4714d3b8fa62ff2f0b8005f198660bdd558
b17f212fc06e1cde0574bdd1ee89d507461f5777e3039c725dbb40b5ebb3f192
b683ce74846a80a1643a51a68f56911b8a3acce936ecb82decd1ef58355d85d0
b9b048a94a13087fea28ca2dfe0ac3125b59bee2ce84829943918114045c707d
c1d4ea98a3c8ea0c5e095f40e47ef4d6a0f7843a39bca44ba34bea2591da3d94
c3e24c6486aaebd7397266feec4133d7ece6c169444a438e5ccd93d7aa89246d
c3ee451882f55975e5cd2b018ce4ad2b8c9c1f886f75d21ced76d0dacb49107e
c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c
c4ebe81ec01c33bd339149314130d65c8a716890fe6c9edb50300c0965c759b8
c6bc28686490aba34a53ab3b709afa1fd73c21e60feb25608b09f23efe170089
cd71b4493cbd4873620c4b80068fc363d2f0c55c8cec40f1de75b49c44a989ab
cf0bb2630fde34a664dc471d3a575a72c37b5a96cb74fcafb92ca7f17fefbe40
d1200315e086ade561036ffc51c2a77a2475ddb5eb9033885018805be7326c40
d30ef5a13391aefdea0738a1e15d88c19e986f865409f9457e5c7d8468e15817
d84e890fa93c018d8b78e3bff3f6252036aa7ead6e48b292c0b92b1cb5127371
dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f
dca6bbecb934b8350c6c99212304108dfb377f27e4a0f637ae19364270452df8
dfc5f440bd83038f2485860edfb8ed400b2ef890a6276300a90fa0f898e447f6
e1fec4f9995879fe3d41ddcae712464d9e88795db64df4e12c6771058268c964
e42428b7cf745a93ba7853cdb58324b7e0121fbbeb5f61be5479d73e384be104
e7aa35a74008321d246065399014c79a8c86b676992e06cf47b071e5c4740700
ea081538b71426db47b34275d48490f59c9b20ad9f4596f3e79ef605b4a238cc
ecbef0f33e8ccedd2c605816e052cfff778abcc0e30a80b874c097a5fddd24fc
eccb09f71c6181f4a60bfeb6ae7daa1a8e451a8fe4e1ca4f1567e7decc970882
ee86af7c37252caba3c2f037f4bdff3acbd2d9863083c31f84ed0f3833fb6c77
efc814c188f4789ae820023eaab71b46f33ca62a1ec25dc45817fdafe64471aa
f4bb557dde95b0f4f77c38cd27539e1ba7f551a1427c434f2e94847ac1d58ce3
f4d4fcb3cdd9f021bca50bedb83de05b77fd23b3c98ad36b103fea8c0744ea71
f5c06455e539dcd889f7f05d709b5adc76c444099fe57f431365af2fc57e803b
fb193c2bcf1a14030cea8d72baa20ab7b1cf88f9e90adb31895279beedf6bf84
fb4d72e4e2a01c6eb415c6645a0e9da33f5e85afe211230132f59341e1f1a23e

faresbuddies.com Open in urlscan Pro 2606:4700:3030::ac43:b1b5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

89 Requests

96 %HTTPS

70 %IPv6

9 Domains

11 Subdomains

10 IPs

2 Countries

1155 kBTransfer

4059 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

89 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

faresbuddies.com Open in urlscan Pro
2606:4700:3030::ac43:b1b5 Public Scan

Screenshot
Live screenshot

Full Image

89
Requests

96 %
HTTPS

70 %
IPv6

9
Domains

11
Subdomains

10
IPs

2
Countries

1155 kB
Transfer

4059 kB
Size

5
Cookies

89 HTTP transactions
0 data transactions