www.departures.com Open in urlscan Pro
34.207.25.27 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://click.email.departures.com/?qs=0177a47d1f27f2832e0d664474182c19ae922f5e44d141c7f9157bb33f2ff5a7865bfe15e09e0a2a93494c80f201...
Effective URL:
https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Submission: On March 22 via api (March 22nd 2022, 5:47:38 pm UTC) from US — Scanned from DE

Summary HTTP 84 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 22 IPs in 6 countries across 30 domains to perform 84 HTTP transactions. The main IP is 34.207.25.27, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.departures.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on June 15th 2021. Valid for: a year.

This is the only time www.departures.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	95.101.27.43 95.101.27.43	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
17	34.207.25.27 34.207.25.27	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700::68... 2606:4700::6810:7daf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.117.208.213 104.117.208.213	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a02:26f0:6c0... 2a02:26f0:6c00:299::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 18	54.154.126.215 54.154.126.215	16509 (AMAZON-02) (AMAZON-02)
4	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
13	2a04:4e42:600... 2a04:4e42:600::591	54113 (FASTLY) (FASTLY)
3	3.124.119.57 3.124.119.57	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
5	15.188.95.229 15.188.95.229	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 1	185.29.132.245 185.29.132.245	30419 (MEDIAMATH...) (MEDIAMATH-INC)
2 2	18.198.69.109 18.198.69.109	16509 (AMAZON-02) (AMAZON-02)
1	2a02:6ea0:c70... 2a02:6ea0:c700::10	60068 (CDN77 ^_^) (CDN77 ^_^)
4	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
1	184.30.24.121 184.30.24.121	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
2 2	37.252.172.36 37.252.172.36	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	2001:678:cb4:... 2001:678:cb4:bbbb::13	56396 (AMOBEE) (AMOBEE)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 1	104.89.42.102 104.89.42.102	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
1 1	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:b4f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
2 2	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
1 1	2620:116:800d... 2620:116:800d:21:3175:5196:e3fd:8c1d	16509 (AMAZON-02) (AMAZON-02)
1	104.18.102.194 104.18.102.194	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	209.197.3.19 209.197.3.19	20446 (STACKPATH...) (STACKPATH-CDN)
1 2	54.93.153.188 54.93.153.188	16509 (AMAZON-02) (AMAZON-02)
2 2	35.186.212.60 35.186.212.60	15169 (GOOGLE) (GOOGLE)
2 3	52.46.130.91 52.46.130.91	16509 (AMAZON-02) (AMAZON-02)
84	22

1 95.101.27.43 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-27-43.deploy.static.akamaitechnologies.com

click.email.departures.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 34.207.25.27 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-207-25-27.compute-1.amazonaws.com

www.departures.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7daf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.117.208.213 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-117-208-213.deploy.static.akamaitechnologies.com

www.aexp-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:6c00:299::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 54.154.126.215 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
aexp.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a04:4e42:600::591 (United States)

ASN54113 (FASTLY, US)

departures-web-va-private-herokuapp-com.freetls.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.124.119.57 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com

tms.americanexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

b03c65aed92e27d82b9aea89294f7d43.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 15.188.95.229 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

omns.americanexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.132.245 (United Kingdom) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.198.69.109 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-69-109.eu-central-1.compute.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::10 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

load77.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.24.121 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-24-121.deploy.static.akamaitechnologies.com

su.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.172.36 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::13 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

d.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.89.42.102 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-89-42-102.deploy.static.akamaitechnologies.com

x.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.248.159 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.226 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:b4f (United States)

ASN13335 (CLOUDFLARENET, US)

idpix.media6degrees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.128 (United States) 1 redirects

ASN54312 (ROCKETFUEL, US)

p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.131.137 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:3175:5196:e3fd:8c1d (United States) 1 redirects

ASN16509 (AMAZON-02, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.102.194 (None, )

ASN13335 (CLOUDFLARENET, US)

p.adsymptotic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.197.3.19 (United States) 1 redirects

ASN20446 (STACKPATH-CDN, US)
PTR: vip0x013.map2.ssl.hwcdn.net

servedby.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.153.188 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-93-153-188.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.212.60 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 60.212.186.35.bc.googleusercontent.com

tag.yieldoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.46.130.91 (Ashburn, United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 184 aexp.demdex.net — Cisco Umbrella Rank: 6678	21 KB
18	departures.com 1 redirects click.email.departures.com www.departures.com	912 KB
13	fastly.net departures-web-va-private-herokuapp-com.freetls.fastly.net	212 KB
8	googlesyndication.com b03c65aed92e27d82b9aea89294f7d43.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 90 tpc.googlesyndication.com — Cisco Umbrella Rank: 122	40 KB
8	americanexpress.com tms.americanexpress.com — Cisco Umbrella Rank: 20195 omns.americanexpress.com — Cisco Umbrella Rank: 16560	22 KB
5	doubleclick.net 1 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 159 cm.g.doubleclick.net — Cisco Umbrella Rank: 176	164 KB
3	amazon-adsystem.com 2 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 260	2 KB
3	exelator.com 2 redirects loadm.exelator.com — Cisco Umbrella Rank: 950 load77.exelator.com — Cisco Umbrella Rank: 3015	2 KB
3	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 515	93 KB
2	yieldoptimizer.com 2 redirects tag.yieldoptimizer.com — Cisco Umbrella Rank: 4322	893 B
2	advertising.com 1 redirects pixel.advertising.com — Cisco Umbrella Rank: 307	602 B
2	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 293	937 B
2	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 365	897 B
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 281	804 B
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 205	2 KB
2	addthis.com 1 redirects su.addthis.com — Cisco Umbrella Rank: 2256 x.dlx.addthis.com — Cisco Umbrella Rank: 980	270 B
2	google.com adservice.google.com — Cisco Umbrella Rank: 57 www.google.com — Cisco Umbrella Rank: 2	1 KB
1	flashtalking.com 1 redirects servedby.flashtalking.com — Cisco Umbrella Rank: 655	545 B
1	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 193	538 B
1	adsymptotic.com p.adsymptotic.com — Cisco Umbrella Rank: 499
1	quantserve.com 1 redirects pixel.quantserve.com — Cisco Umbrella Rank: 381	488 B
1	rfihub.com 1 redirects p.rfihub.com — Cisco Umbrella Rank: 631	755 B
1	media6degrees.com idpix.media6degrees.com — Cisco Umbrella Rank: 1824	278 B
1	turn.com 1 redirects d.turn.com — Cisco Umbrella Rank: 652	402 B
1	mathtag.com 1 redirects sync.mathtag.com — Cisco Umbrella Rank: 384	685 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 96	408 B
1	aexp-static.com www.aexp-static.com — Cisco Umbrella Rank: 11532	21 KB
1	unpkg.com unpkg.com — Cisco Umbrella Rank: 821	12 KB
0	gwallet.com Failed rp.gwallet.com Failed
0	google.de Failed adservice.google.de Failed www.google.de Failed
84	30

	Domain	Requested by
17	dpm.demdex.net	2 redirects www.departures.com assets.adobedtm.com
17	www.departures.com	www.departures.com
13	departures-web-va-private-herokuapp-com.freetls.fastly.net	www.departures.com
5	omns.americanexpress.com	assets.adobedtm.com
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	securepubads.g.doubleclick.net	www.departures.com securepubads.g.doubleclick.net
3	s.amazon-adsystem.com	2 redirects
3	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
3	tms.americanexpress.com	www.aexp-static.com
3	assets.adobedtm.com	www.departures.com assets.adobedtm.com
2	tag.yieldoptimizer.com	2 redirects
2	pixel.advertising.com	1 redirects
2	match.adsrvr.org	2 redirects
2	pixel.tapad.com	2 redirects
2	idsync.rlcdn.com	2 redirects
2	ib.adnxs.com	2 redirects
2	loadm.exelator.com	2 redirects
1	servedby.flashtalking.com	1 redirects
1	c.bing.com	1 redirects
1	p.adsymptotic.com
1	pixel.quantserve.com	1 redirects
1	p.rfihub.com	1 redirects
1	idpix.media6degrees.com
1	cm.g.doubleclick.net	1 redirects
1	x.dlx.addthis.com	1 redirects
1	d.turn.com	1 redirects
1	www.google.com	tpc.googlesyndication.com
1	su.addthis.com
1	load77.exelator.com
1	sync.mathtag.com	1 redirects
1	www.facebook.com	www.departures.com
1	aexp.demdex.net	assets.adobedtm.com
1	b03c65aed92e27d82b9aea89294f7d43.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	www.aexp-static.com	www.departures.com
1	unpkg.com	www.departures.com
1	click.email.departures.com	1 redirects
0	rp.gwallet.com Failed
0	www.google.de Failed	www.departures.com
0	adservice.google.de Failed	securepubads.g.doubleclick.net
84	40

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
twitter.com
www.americanexpress.com
info.evidon.com

Subject Issuer	Validity	Valid
www.departures.com DigiCert SHA2 Extended Validation Server CA	`2021-06-15` - `2022-06-20`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-02` - `2022-07-01`	a year	crt.sh
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2021-06-08` - `2022-07-09`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-10` - `2022-09-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.freetls.fastly.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-27` - `2022-05-29`	a year	crt.sh
tms.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2022-02-07` - `2023-03-10`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
omns.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2022-01-20` - `2023-01-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-12-29` - `2022-03-29`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
odc-addthis-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
dstillery.com Sectigo RSA Domain Validation Secure Server CA	`2021-04-09` - `2022-05-10`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Frame ID: EA78A421108570121A6EB2FA3ACF39B0
Requests: 57 HTTP requests in this frame

Frame: https://b03c65aed92e27d82b9aea89294f7d43.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 1112FA4A448F0557D7F5607FF4CD0A7A
Requests: 1 HTTP requests in this frame

Frame: https://aexp.demdex.net/dest5.html?d_nsid=15
Frame ID: 668DC56880689F369EC9613F520C657F
Requests: 21 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 3A5881E0312CDBDF7561439CFE0AD16D
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0FC3CE9AC8643C70BA42FAD5D32BB55F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Travel | Departuresinstagram logo to go Instagram accounttwitter logo to go Twitter accountSignIn Close Button

Page URL History Show full URLs

http://click.email.departures.com/?qs=0177a47d1f27f2832e0d664474182c19ae922f5e44d141c7f9157bb33f2ff5a7865bfe15... HTTP 302
https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Amex Express Checkout (Payment processors) Expand

Overall confidence: 100%
Detected patterns

aexp-static\.com

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Page Statistics

84
Requests

75 %
HTTPS

39 %
IPv6

30
Domains

40
Subdomains

22
IPs

6
Countries

1497 kB
Transfer

2789 kB
Size

43
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.instagram.com/departures
Title: Follow Us

Search URL Search Domain Scan URL

URL: https://twitter.com/DeparturesMag

Search URL Search Domain Scan URL

URL: https://www.americanexpress.com/?intlink=us-departures-signinmodule-territory-travel-membership
Title: membership.

Search URL Search Domain Scan URL

URL: https://www.americanexpress.com/us/legal-disclosures/website-rules-and-regulations.html?intlink=us-departures-footer-termsofuse
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.americanexpress.com/us/privacy-center/index.html?intlink=us-departures-footer-privacypolicy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://info.evidon.com/pub_info/1328?v=1&nt=1&nw=true&inav=footer_adChoices
Title: AdChoices

Search URL Search Domain Scan URL

URL: https://www.americanexpress.com/?intlink=us-departures-signinmodule-membership
Title: membership.

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://click.email.departures.com/?qs=0177a47d1f27f2832e0d664474182c19ae922f5e44d141c7f9157bb33f2ff5a7865bfe15e09e0a2a93494c80f2017c907aafb2839d7d67980aebcaadba1e65b6 HTTP 302
https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&ts=1647971252321 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&ts=1647971252321

Request Chain 49

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/332912992/?url=https%3A%2F%2Fdepartures.com%2F&script=0 HTTP 302
https://www.google.com/pagead/1p-user-list/332912992/?url=https%3A%2F%2Fdepartures.com%2F&script=0&is_vtc=1&random=883895017 HTTP 0
https://www.google.de/pagead/1p-user-list/332912992/?url=https%3A%2F%2Fdepartures.com%2F&script=0&is_vtc=1&random=883895017&ipr=y

Request Chain 52

https://sync.mathtag.com/sync/img?mt_exid=10004&mt_exuid=25655402181406394163432343004953981475&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D269%26dpuuid%3D[MM_UUID]%26ddsuuid%3d25655402181406394163432343004953981475 HTTP 302
https://dpm.demdex.net/ibs:dpid=269&dpuuid=705a623a-0bb5-4a00-9539-49c88afb8668&ddsuuid=25655402181406394163432343004953981475

Request Chain 55

https://loadm.exelator.com/load/?p=204&g=091&j=0&bi=25655402181406394163432343004953981475 HTTP 302
https://loadm.exelator.com/load/?p=204&g=091&j=0&bi=25655402181406394163432343004953981475&xl8blockcheck=1 HTTP 302
https://load77.exelator.com/pixel.gif

Request Chain 61

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP 302
https://dpm.demdex.net/ibs:dpid=358&dpuuid=6445819511751916595

Request Chain 64

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjM2NTYzMjkvdC8y/url/https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D470%26dpuuid%3D%24!%7BTURN_UUID%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=470&dpuuid=7489904598220520935

Request Chain 66

https://idsync.rlcdn.com/365868.gif?partner_uid=25655402181406394163432343004953981475 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomMjU2NTU0MDIxODE0MDYzOTQxNjM0MzIzNDMwMDQ5NTM5ODE0NzUQABoNCLaX6JEGEgUI6AcQAEIASgA HTTP 307
https://dpm.demdex.net/ibs:dpid=477&dpuuid=3bf982d224b50f84a928aeadad97e21f5dacdbef63c3c3da7a7cef62681372b4b0da87c991749652

Request Chain 67

https://x.dlx.addthis.com/e/demdex_sync?na_exid=25655402181406394163432343004953981475&ru=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D134096%26dpuuid%3D%3Cna_id%3E%20 HTTP 301
https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2022032217473400016344457256

Request Chain 68

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D540%26dpuuid%3D%24%7BTA_DEVICE_ID%7D&partner_device_id=25655402181406394163432343004953981475 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=ADB&partner_url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D540%26dpuuid%3D%24%7BTA_DEVICE_ID%7D&partner_device_id=25655402181406394163432343004953981475 HTTP 302
https://dpm.demdex.net/ibs:dpid=540&dpuuid=77eb3d5d-20af-403d-8943-a112212a17c5

Request Chain 69

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjU2NTU0MDIxODE0MDYzOTQxNjM0MzIzNDMwMDQ5NTM5ODE0NzU= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKZiDvrOxMZPaEadmQY2v1U&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 74

https://p.rfihub.com/cm?in=1&pub=7085 HTTP 302
https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5123196421654220393

Request Chain 75

https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=555d7256-fce4-4c4f-936d-81825c9a934e

Request Chain 76

https://pixel.quantserve.com/pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=1175&&dpuuid=Bee4RwO36RAesb8WC-OmRwe37x8etLhFVbAcW8_j

Request Chain 78

https://c.bing.com/c.gif?uid=25655402181406394163432343004953981475&Red3=MSAdobe_pd&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=1C2553BA164262E31CFE42D517296350

Request Chain 79

https://servedby.flashtalking.com/map/?key=a74thHgsfK627J6Ftt8sj5ks52bKe&gdpr=0&gdpr_consent=&url=https://dpm.demdex.net/ibs:dpid=3047&dpuuid=[%FT_GUID%]&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=3047&dpuuid=5194BDDBBBEF07&gdpr=0&gdpr_consent=

Request Chain 80

https://pixel.advertising.com/ups/28/sync?uid=25655402181406394163432343004953981475&_origin=1&redir=true HTTP 302
https://pixel.advertising.com/ups/28/sync?uid=25655402181406394163432343004953981475&_origin=1&redir=true&verify=true

Request Chain 81

https://tag.yieldoptimizer.com/ps/ps?t=i&p=2233 HTTP 302
https://tag.yieldoptimizer.com/ps/ps?tc=477276614&t=i&p=2233 HTTP 302
https://dpm.demdex.net/ibs:dpid=22069&dpuuid=3015644796961

Request Chain 82

https://s.amazon-adsystem.com/dcm?pid=5c420d2b-f139-4fee-b0c0-89a7b8ce9433 HTTP 302
https://s.amazon-adsystem.com/dcm?pid=5c420d2b-f139-4fee-b0c0-89a7b8ce9433&dcc=t HTTP 302
https://dpm.demdex.net/ibs:dpid=139200&dpuuid=qbElvSdBTXGs19nX1nYlsA&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dadobe.com%26id%3D%24%7BDD_UUID%7D HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=adobe.com&id=25655402181406394163432343004953981475

84 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request travel Show response
www.departures.com/
Redirect Chain

http://click.email.departures.com/?qs=0177a47d1f27f2832e0d664474182c19ae922f5e44d141c7f9157bb33f2ff5a7865bfe15e09e0a2a93494c80f2017c907aafb2839d7d67980aebcaadba1e65b6
https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

62 KB
17 KB

383ms
100ms

Document
text/html

34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ba229aba5ef45945fb3eee772ea4d9927718cac47811ef5422d3e7a21a8ece5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Length: 17314
Content-Type: text/html;charset=UTF-8
Date: Tue, 22 Mar 2022 17:47:31 GMT
Expires: 0
Permissions-Policy: interest-cohort=()
Pragma: no-cache
Referrer-Policy: same-origin
Server: Apache
Strict-Transport-Security: max-age=31536000;
Vary: Accept-Encoding
Via: 1.1 spaces-router (4eb074ceed91)
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: all
X-Xss-Protection: 1; mode=block

Redirect headers

Content-Type: text/html; charset=utf-8
Location: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
X-Cnection: close
Content-Length: 203
Expires: Tue, 22 Mar 2022 17:47:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 22 Mar 2022 17:47:31 GMT
Connection: keep-alive

GET
H/1.1 200
OK main.40a26527.css
www.departures.com/assets/css/ 49 KB
9 KB 174ms
99ms Stylesheet
text/css 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/css/main.40a26527.css

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

894874788a871c70c3acdded5e7b2de4df381f1a485fcfe57ef85878a9873d4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Content-Length: 8802
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "c2ab-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H/1.1 200
OK territory.192faabc.css
www.departures.com/assets/css/ 25 KB
5 KB 274ms
98ms Stylesheet
text/css 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/css/territory.192faabc.css

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ef02cfa21f67f31b6d6431c0f4d4090325f62992742171453a9ac6495311d311

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Content-Length: 4392
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "63c6-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H/1.1 200
OK main.feccab59.js Show response
www.departures.com/assets/js/ 208 KB
73 KB 225ms
103ms Script
application/javascript 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/js/main.feccab59.js

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

0392b055eb94752840a87f811275fc9441e1e06987192028edf4c66209284664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000;
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "33e86-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H2 200 htmx.min.js Show response
unpkg.com/htmx.org@1.6.0/dist/ 34 KB
12 KB 59ms
30ms Script
application/javascript 2606:4700::6810:7daf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/htmx.org@1.6.0/dist/htmx.min.js

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

035c007044c2434e73e8528a4a0039005564b4b1dea5bbb00ef0859e538f30fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://www.departures.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
age: 14688274
fly-request-id: 01FH3M0WZ3MTTSKJ325XRP6M08
content-encoding: br
vary: Accept-Encoding
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"8693-TT1H3aprO8o87hMPEHvgzz/PLvU"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6f00c0c5591501f4-ZRH

GET
H/1.1 200
OK territory.31d6cfe0.js Show response
www.departures.com/assets/js/ 0
513 B 219ms
98ms Script
application/javascript 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/js/territory.31d6cfe0.js

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Via: 1.1 spaces-router (4eb074ceed91)
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
Etag: "0-5d9cd8943d380"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Accept-Ranges: bytes
Content-Length: 0
X-Xss-Protection: 1; mode=block
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H2 200 Bootstrap.js Show response
www.aexp-static.com/cdaas/api/axpi/ensighten/amex/ 73 KB
21 KB 270ms
237ms Script
application/javascript 104.117.208.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/api/axpi/ensighten/amex/Bootstrap.js
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.208.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-208-213.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f25ced7e4b07d9d7c09a5d541a8fa3d6367a8659b6136ef5313d550211743bd9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
content-encoding: gzip
last-modified: Mon, 07 Mar 2022 07:32:46 GMT
etag: W/"6225b51e-124d6"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, must-revalidate
timing-allow-origin: *
content-length: 21586

GET
H2 200 satelliteLib-f424e4c1e880782914108fb45b503d9aae8fe034.js Show response
assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/ 302 KB
63 KB 53ms
14ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-f424e4c1e880782914108fb45b503d9aae8fe034.js
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4f4a2fbc3843d7d27f00bc5c89499841d7d4a70a598b251a2b7e289ef7a650ab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
content-encoding: gzip
last-modified: Tue, 15 Mar 2022 03:57:19 GMT
server: AkamaiNetStorage
etag: "f1050d885ee986aa05682a56d2732dd5:1647316639.787095"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 63944
expires: Tue, 22 Mar 2022 18:47:32 GMT

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&ts=1647971252321
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&ts=1647971252321

4 KB
2 KB

38ms
37ms

XHR
application/json

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&ts=1647971252321

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

d44f2a872c0a75d52de5e5983410470d747216b81cd6f42e4cd6adb1640fa823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-04298c2a3.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: eObvc4WaR2k=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.departures.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1378
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v030-00213c1f5.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.departures.com
X-TID: tZ7hXSybR24=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&ts=1647971252321
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 EX2e39ef00e8e34b74906786b0e7d4e00d-libraryCode_source.min.js Show response
assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/437b26f18e6b/ 88 KB
30 KB 17ms
17ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/437b26f18e6b/EX2e39ef00e8e34b74906786b0e7d4e00d-libraryCode_source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-f424e4c1e880782914108fb45b503d9aae8fe034.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e5a45eeb77b80a88a46baf0c83dfd88804d482de3e884ce9cf4bef3e1889b497

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
content-encoding: gzip
last-modified: Tue, 15 Mar 2022 03:57:20 GMT
server: AkamaiNetStorage
etag: "553974e5404dd5b89e42f6c3d74d2db1:1647316640.791182"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 29969
expires: Tue, 22 Mar 2022 18:47:32 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 82 KB
28 KB 475ms
23ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

ed54c622898162bdb56dfb1bf5471c977b401a911a270ce95fd26299e33a6593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27962
x-xss-protection: 0
server: sffe
etag: "1165 / 120 of 1000 / last-modified: 1647965886"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 22 Mar 2022 17:47:32 GMT

GET
H/1.1 200
OK Maison-Regular.woff
www.departures.com/assets/fonts/ 40 KB
41 KB 109ms
109ms Font
font/woff 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/fonts/Maison-Regular.woff

Requested by

Host: www.departures.com
URL: https://www.departures.com/assets/css/main.40a26527.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

7bcb931e411106cad7661417bf784f8fef1418d6384af9760cc126b3695f348f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.departures.com/assets/css/main.40a26527.css
Origin: https://www.departures.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Content-Length: 41177
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "a11c-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: font/woff
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H/1.1 200
OK Maison-Demi.woff
www.departures.com/assets/fonts/ 40 KB
40 KB 110ms
109ms Font
font/woff 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/fonts/Maison-Demi.woff

Requested by

Host: www.departures.com
URL: https://www.departures.com/assets/css/main.40a26527.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

57b7ef076c579835d62a46128243ef25657202faf26afd79839faaddd8476f6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.departures.com/assets/css/main.40a26527.css
Origin: https://www.departures.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Content-Length: 40811
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "9f94-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: font/woff
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H2 200 favorite-resorts-and-spas-fiji-3.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_navigationFeaturedSeries_web/230056/ 18 KB
18 KB 478ms
16ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_navigationFeaturedSeries_web/230056/favorite-resorts-and-spas-fiji-3.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d7698d0db9a43d066ff8917b61d0b5e9a5f88312ada14988d8f82fe3dca7286b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 29357
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 18462
x-amz-id-2: QRnb+GxBMNfw2tJNB5N/bMBMMzoybWqi0H7z4a/pr84P58tJLaKIWbI4tsjMukPIgbu6m0w9LGM=
x-served-by: cache-mxp6939-MXP
last-modified: Wed, 09 Mar 2022 21:41:22 GMT
server: AmazonS3
x-timer: S1647971253.816949,VS0,VE0
etag: "b0c5c6f43dcbe94171def34e86b28f4c"
x-amz-request-id: SWVYE1JK3ZE02Y93
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 2

GET
H/1.1 200
OK instagram.4cb6c4e4.svg
www.departures.com/assets/img/ 2 KB
2 KB 106ms
106ms Image
image/svg+xml 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.departures.com/assets/img/instagram.4cb6c4e4.svg

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

a001dd03b53452b4d744b3088484a02357b1f71962acdfa516f13abb09f11243

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Content-Length: 1011
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "95b-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H/1.1 200
OK twitter.b0c9e489.svg
www.departures.com/assets/img/ 2 KB
1 KB 111ms
110ms Image
image/svg+xml 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.departures.com/assets/img/twitter.b0c9e489.svg

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

5661421bd67e4bc9efd7cc49bf8cee53fc269824e7115d9f391eca4dc235de2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Content-Length: 834
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "60b-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H/1.1 200
OK nib-light-pro.ttf
www.departures.com/assets/fonts/ 204 KB
96 KB 212ms
107ms Font
font/ttf 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/fonts/nib-light-pro.ttf

Requested by

Host: www.departures.com
URL: https://www.departures.com/assets/css/main.40a26527.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ab8ba165844efd1399f8eef03d6778ce50703eacd7072761a00cfacd7d573f7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.departures.com/assets/css/main.40a26527.css
Origin: https://www.departures.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000;
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "33094-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: font/ttf
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H/1.1 200
OK nib-semibold-pro.ttf
www.departures.com/assets/fonts/ 220 KB
108 KB 213ms
108ms Font
font/ttf 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/fonts/nib-semibold-pro.ttf

Requested by

Host: www.departures.com
URL: https://www.departures.com/assets/css/main.40a26527.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ab7a73ff3f21b94d8f4e809c519705fd62962e1e474bf4d9586f203672c21ef4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.departures.com/assets/css/main.40a26527.css
Origin: https://www.departures.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000;
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "371e0-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: font/ttf
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H/1.1 200
OK Maison-Light.woff
www.departures.com/assets/fonts/ 39 KB
40 KB 215ms
105ms Font
font/woff 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/fonts/Maison-Light.woff

Requested by

Host: www.departures.com
URL: https://www.departures.com/assets/css/main.40a26527.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

bf7d52f77aad7484b3c43c939c080199a3603f2c733d307b0d886db1a0456048

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.departures.com/assets/css/main.40a26527.css
Origin: https://www.departures.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Content-Length: 40252
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "9d84-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: font/woff
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H2 200 galei-kinneret-hotel-israel-8.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_big/247187/ 48 KB
48 KB 471ms
24ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_big/247187/galei-kinneret-hotel-israel-8.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2b28785f737f9d43b5d6afc3066a39426e433501d692c052934371a4f09f6095

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 48970
x-amz-id-2: 0OhcpBgJYh81mY3n3sxxsZi/RSS4oRKinqUqfBTG2nyJOkgZ1aB475MDzuevQ9f00wKOSr7M8SE=
x-served-by: cache-mxp6939-MXP
last-modified: Tue, 22 Mar 2022 11:38:23 GMT
server: AmazonS3
x-timer: S1647971253.817050,VS0,VE1
etag: "b5e28b6a09947526ae5e529f72aa12bb"
x-amz-request-id: QBHT4RKSJTYESZR0
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H2 200 melinda-hill-self-partnered-honeymoon-in-playa-del-carmen-15.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/218275/ 10 KB
10 KB 494ms
48ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/218275/melinda-hill-self-partnered-honeymoon-in-playa-del-carmen-15.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fc0355aed72233dc3b1a7c5ef3e66a58c9f0c2f060ac60442231ff96824dd563

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 9970
x-amz-id-2: w4I63nthyVl3z+a68KsFFmTON1HCWz84Y4Bo86ukVLIwl66R+K1aO4pJyqnie0llDOba4TNfhic=
x-served-by: cache-mxp6939-MXP
last-modified: Fri, 25 Feb 2022 21:05:37 GMT
server: AmazonS3
x-timer: S1647971253.817217,VS0,VE1
etag: "251f29a778eef551b536ee80510e4fe4"
x-amz-request-id: QBHXS5CVKB2N3067
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H/1.1 200
OK TERRITORY_TRAVEL_1x.3da33ffa.jpg
www.departures.com/assets/img/ 285 KB
286 KB 381ms
97ms Image
image/jpeg 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.departures.com/assets/img/TERRITORY_TRAVEL_1x.3da33ffa.jpg

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

fc844f0110369415e237bd34c13bf61f0b00a8450d76790941c910b282feb9f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Via: 1.1 spaces-router (4eb074ceed91)
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
Etag: "4757b-5d9cd8943d380"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Accept-Ranges: bytes
Content-Length: 292219
X-Xss-Protection: 1; mode=block
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H2 200 the-proper-downtown-los-angeles-review.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/240618/ 13 KB
13 KB 486ms
46ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/240618/the-proper-downtown-los-angeles-review.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 87770705bd0066b2e84aadaebadd721808d8f900dcaaa9a8d6fe88a740a4ed08

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 13522
x-amz-id-2: BLMGLj8X5XyBqfZiL5ISu21pDB7w3Dolx1h6hW9MPA1KtFYTUz9ySaXgOyimYlclBO2E7mVW5vg=
x-served-by: cache-mxp6939-MXP
last-modified: Thu, 17 Mar 2022 17:33:13 GMT
server: AmazonS3
x-timer: S1647971253.817173,VS0,VE1
etag: "fe87f406ade7dc6cc479aa844a498d95"
x-amz-request-id: QBHGRBVF14FC68SZ
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H2 200 best-food-drinks-shopping-march-2022_2022-02-28-224854_dscs.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/232922/ 13 KB
13 KB 460ms
20ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/232922/best-food-drinks-shopping-march-2022_2022-02-28-224854_dscs.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: beeb3447c281af633b86a0b539e6602bc1619aefc06feae27d2f2189abdb0e86

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 12986
x-amz-id-2: n2gqDJUz+dgpTSSrI/34uJ/eXLZ73n2OXxozECCthZqYM2qF1F7hMBDbv1BvuLps64OjU+X7JHg=
x-served-by: cache-mxp6939-MXP
last-modified: Fri, 11 Mar 2022 12:16:19 GMT
server: AmazonS3
x-timer: S1647971253.817235,VS0,VE0
etag: "a10669d64e28c80e9ceac9c0b17f8b21"
x-amz-request-id: QBHZZ9SVEPMFZ42J
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 2

GET
H2 200 best-cruise-antarctica-le-commandant-charcot-1.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/230769/ 7 KB
7 KB 486ms
47ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/230769/best-cruise-antarctica-le-commandant-charcot-1.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3c035736f3570224361d795b4a8e38a275eedae3a9d6134e67895e526db0669b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 6954
x-amz-id-2: 8K+rlUqMqclju6ahR8Z60hj3b8zY/LuRcFTKaSS2qnntAetvMUO2yNgBMdgZwJ23r9SEedbWdIg=
x-served-by: cache-mxp6939-MXP
last-modified: Wed, 09 Mar 2022 04:03:39 GMT
server: AmazonS3
x-timer: S1647971253.817301,VS0,VE1
etag: "c14a4a521b5c5dbc33cb1c6d6641b138"
x-amz-request-id: QBHZJSXKNG7XB1CY
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H2 200 Vietnam-a-second-act-header_WEB.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/28411/ 7 KB
7 KB 24ms
7ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/28411/Vietnam-a-second-act-header_WEB.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5214776bf24313e781b1d7f67ed6545c33805a315e0ab2758e0150d722b19322

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 7372
x-amz-id-2: SsfuVh/2B1Y9IKUwTgPQfTvQv2FkTgE5/mGdC3HaTkDZtGuZAEG1DZ+UX9aXbnqLCFO2w8YByhc=
x-served-by: cache-mxp6939-MXP
last-modified: Thu, 13 Jan 2022 17:52:54 GMT
server: AmazonS3
x-timer: S1647971253.855751,VS0,VE1
etag: "5067fe10f101e2566c1db6f7bfd0c64b"
x-amz-request-id: QBHWKE2SV0AJX73Z
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H2 200 Fiji-Travel-Guide-Best-Hotels-Resorts-Spas-WEB-2.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_big/234708/ 26 KB
26 KB 26ms
8ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_big/234708/Fiji-Travel-Guide-Best-Hotels-Resorts-Spas-WEB-2.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2e1698f53935f78113155404844e6b83c72053bc3ffbbf335ea2344bad4dd961

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 26696
x-amz-id-2: 9DD0nbZZtOIM/INItjaP/eIdctcXyuq4FhqtdqBL4JtGmwO3s/Wm4OK/r5NBi/oT0KvCiYRi+BE=
x-served-by: cache-mxp6939-MXP
last-modified: Mon, 07 Mar 2022 15:27:42 GMT
server: AmazonS3
x-timer: S1647971253.855932,VS0,VE1
etag: "a3c695b38a488bab2b9a5a2c4009b1f2"
x-amz-request-id: QBHWTSZYKSKEWBZP
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H2 200 golden-rock-inn-nevis-caribbean-boutique-hotel-4.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/208018/ 22 KB
23 KB 31ms
13ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/208018/golden-rock-inn-nevis-caribbean-boutique-hotel-4.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 94f721e1645ef65c2acdc9539677671d3984b729b921210ae29dd5d69d527ef8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 22894
x-amz-id-2: QS6Zw6WT3+j2wJJ0lsbFnRgRbJEriWrgbJVMzf2F0EWAtby7vuzqjZzL2G9J5MKrT83YSspIDTk=
x-served-by: cache-mxp6939-MXP
last-modified: Tue, 15 Mar 2022 20:46:54 GMT
server: AmazonS3
x-timer: S1647971253.855991,VS0,VE1
etag: "34bff0673979a4358d460c633d2ad354"
x-amz-request-id: QBHRR0K1WFM6XJT7
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H/1.1 200
OK newsletter-banner.e693c09e.jpg
www.departures.com/assets/img/ 44 KB
44 KB 379ms
99ms Image
image/jpeg 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.departures.com/assets/img/newsletter-banner.e693c09e.jpg

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

2416e46fdbf13444aa79850c9c55d73ec79c9533b6bdd6f030fc062ce2c88d7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Via: 1.1 spaces-router (4eb074ceed91)
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
Etag: "aec6-5d9cd8943d380"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Accept-Ranges: bytes
Content-Length: 44742
X-Xss-Protection: 1; mode=block
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H/1.1 200
OK nib-regular-pro.ttf
www.departures.com/assets/fonts/ 221 KB
107 KB 279ms
102ms Font
font/ttf 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/fonts/nib-regular-pro.ttf

Requested by

Host: www.departures.com
URL: https://www.departures.com/assets/css/main.40a26527.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

80310f70dd69e8b1ba61bd9e10031a2dec0aa7e104556cf4c9947e6944778b48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.departures.com/assets/css/main.40a26527.css
Origin: https://www.departures.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000;
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "373a8-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: font/ttf
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H/1.1 200
OK Maison-Medium.woff
www.departures.com/assets/fonts/ 39 KB
40 KB 287ms
101ms Font
font/woff 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/assets/fonts/Maison-Medium.woff

Requested by

Host: www.departures.com
URL: https://www.departures.com/assets/css/main.40a26527.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache /

Resource Hash

06f6faf0e9a94d4fafaba2be94cc596c71797fd6455551342ccc57e2dda720cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.departures.com/assets/css/main.40a26527.css
Origin: https://www.departures.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
Content-Length: 40366
X-Xss-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Wed, 09 Mar 2022 18:47:58 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Etag: "9dd0-5d9cd8943d380-gzip"
Vary: Accept-Encoding
Content-Type: font/woff
Via: 1.1 spaces-router (4eb074ceed91)
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes
Expires: Wed, 22 Mar 2023 17:47:32 GMT

GET
H2 200 the-resort-at-paws-up-in-greenough-montana-11.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/199587/ 12 KB
12 KB 31ms
13ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/199587/the-resort-at-paws-up-in-greenough-montana-11.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8c6c6ecdc6450929c6ddc8c4a65f748d8b1a7169f266c9d6ee106b40e81aeb58

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 12190
x-amz-id-2: JhGpN3OBu+Q/mWaBldqu8Pj1Z2YWQXpH16FsQz5Ft3zmQEKKZTkPNgcYmv66AkG5p0yzZdPXcMk=
x-served-by: cache-mxp6939-MXP
last-modified: Wed, 16 Feb 2022 16:47:54 GMT
server: AmazonS3
x-timer: S1647971253.856060,VS0,VE1
etag: "da1689b9f7cbb629b809031905dee118"
x-amz-request-id: QBHQ5MRHSVX9J1WZ
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H2 200 Returns-letter-header-invert-2_WEB.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/29015/ 7 KB
7 KB 29ms
12ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/29015/Returns-letter-header-invert-2_WEB.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a51d166487836c0b3056c89723b3a0913dc5fa1ada3c5bac83d731290801f4e0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 6816
x-amz-id-2: +SDi67YTVGyCpetmfxgixoSd1BgoQHu6n+yZXUNI4H37hPd7dwKqSi7frXNvmy7md6BwPB69kFY=
x-served-by: cache-mxp6939-MXP
last-modified: Thu, 13 Jan 2022 17:52:58 GMT
server: AmazonS3
x-timer: S1647971253.856143,VS0,VE1
etag: "5a3824dec3766af23bdee5f4306d62da"
x-amz-request-id: QBHR8T9G9AS91FZF
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H2 200 harbor-house-inn-mendocino-california-11.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/194785/ 10 KB
10 KB 32ms
15ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/194785/harbor-house-inn-mendocino-california-11.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6b994ed428d03f47e32b40854a65a5ad30094b09d41c269bc21212575a57d0fd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 9828
x-amz-id-2: yK8HyL/qQQ3fNbj9/FYbDO132d8hQ9yz681kvl66DlZyO+EH6Ya5qZSVntueWe+UcsPfuJdPw2M=
x-served-by: cache-mxp6939-MXP
last-modified: Thu, 10 Feb 2022 16:36:16 GMT
server: AmazonS3
x-timer: S1647971253.856216,VS0,VE1
etag: "def10a51a50ab8fff07dc4082584d3ba"
x-amz-request-id: QBHH34DZRRDDHT2G
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H2 200 nayara-resorts-costa-rica-4.webp
departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/186404/ 17 KB
17 KB 32ms
14ms Image
image/webp 2a04:4e42:600::591
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://departures-web-va-private-herokuapp-com.freetls.fastly.net/public/assets/_territoryArticleCard_small/186404/nayara-resorts-costa-rica-4.webp
Requested by: Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::591 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 404cfc3dacd8fa0992888acbb8a0ee5e64c414ac558d5303c11ba412fcfc0e4c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
via: 1.1 varnish
age: 218
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 17672
x-amz-id-2: mz6LV7CAK9RHEmkCTerCHVGRQ81CEf1XcdkXGXQgTzbVsWBmYtrbvEGBf+/AGXZ5tcSEl2zwWEk=
x-served-by: cache-mxp6939-MXP
last-modified: Tue, 01 Feb 2022 12:12:01 GMT
server: AmazonS3
x-timer: S1647971253.856397,VS0,VE1
etag: "ceec8fd17ade8d00f0fb85ee3f203c78"
x-amz-request-id: QBHJK0WY3QEYJPY4
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1

GET
H/1.1 200
OK json Show response
www.departures.com/actions/blitz/csrf/ 326 B
936 B 387ms
141ms Fetch
application/json 34.207.25.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.departures.com/actions/blitz/csrf/json

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.207.25.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-25-27.compute-1.amazonaws.com

Software

Apache / Craft CMS

Resource Hash

1d0515826c48115763518376769fcaa9dcea06c81fda1cd36a14bb9355ea4d6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 17:47:32 GMT
Content-Encoding: gzip
Referrer-Policy: same-origin
Server: Apache
X-Powered-By: Craft CMS
X-Frame-Options: SAMEORIGIN
Content-Type: application/json; charset=UTF-8
Via: 1.1 spaces-router (4eb074ceed91)
Permissions-Policy: interest-cohort=()
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;
X-Robots-Tag: none
Vary: Accept-Encoding
Content-Length: 211
X-Xss-Protection: 1; mode=block

GET
H2 200 serverComponent.php Show response
tms.americanexpress.com/amex/ 403 B
425 B 427ms
133ms Script
text/javascript 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tms.americanexpress.com/amex/serverComponent.php?clientID=218&PageID=https%3A%2F%2Fwww.departures.com%2Ftravel%3Fextlink%3Dem-us-dp-sfmcmail13-body-3-travelterritory-o%26ens_env%3D3%26deviceType%3Dlarge
Requested by: Host: www.aexp-static.com
URL: https://www.aexp-static.com/cdaas/api/axpi/ensighten/amex/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f20cd896d8adf9abd8428a76eab49474865c782207804b5e5aebd7c70698142c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
cache-control: no-cache, no-store
content-type: text/javascript
server: nginx
content-encoding: gzip
vary: Accept-Encoding
expires: Tue, 22 Mar 2022 17:47:31 GMT

GET
H2 200 RC2faef58e39844e5ca4a57ba8ed855bb2-source.min.js Show response
assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/437b26f18e6b/ 1013 B
734 B 16ms
16ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/437b26f18e6b/RC2faef58e39844e5ca4a57ba8ed855bb2-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-f424e4c1e880782914108fb45b503d9aae8fe034.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 512b9275d80d28ad524a3188d16b9ad572d75e460bd64bba6ad04f829bd304af

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
content-encoding: gzip
last-modified: Tue, 15 Mar 2022 03:57:20 GMT
server: AkamaiNetStorage
etag: "553974e5404dd5b89e42f6c3d74d2db1:1647316640.791182"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 488
expires: Tue, 22 Mar 2022 18:47:32 GMT

GET
H2 200 pubads_impl_2022031601.js Show response
securepubads.g.doubleclick.net/gpt/ 365 KB
124 KB 12ms
10ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

5042f25c3eb1530880fa3b05325462c028492caf22141409999cdd7e6364b8ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:38:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126823
x-xss-protection: 0
last-modified: Wed, 16 Mar 2022 08:34:12 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 22 Mar 2023 17:38:58 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 143 B
134 B 37ms
18ms XHR
application/json 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.departures.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

683def6071b7d3ac54d26c5acb9b96da0a6b16e6d5a27e4cdfd8672d6ee31499

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Mar 2022 17:47:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 109
x-xss-protection: 0
expires: Tue, 22 Mar 2022 17:47:32 GMT

GET integrator.js
adservice.google.de/adsid/ 0
0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 437ms
17ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.departures.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Mar 2022 17:47:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 27 KB
11 KB 158ms
158ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=957921676273513&correlator=43538691655472&eid=31065724%2C31063246&output=ldjh&gdfp_req=1&vrg=2022031601&ptt=17&impl=fifs&iu_parts=22584186460%2CTerritory%2CTerritory2&enc_prev_ius=%2F0%2F1%2C%2F0%2F1%2F2&prev_iu_szs=460x696%7C512x735%2C300x250&ifi=1&adks=1711744537%2C3602123049&sfv=1-0-38&ecs=20220322&fsapi=false&cust_params=trackUrl%3Dhttps%253A%252F%252Fassets.adobedtm.com%252F98caf8fccc463fd7e47088b35e73b27720bb5cc1%252FsatelliteLib-f424e4c1e880782914108fb45b503d9aae8fe034.js%26login%3Dfalse%26country%3Dus%26language%3Den%26businessUnit%3Ddepartures%26primaryCategory%3Dterritory%26subCategory1%3Dtravel%26intlinkimp%3DloginStatus%253Aanonymous%26territory%3Dtravel%26env%3Dproduction%26section%3Dterritory&sc=1&cookie_enabled=1&abxe=1&dt=1647971252934&lmt=1647971252&dlt=1647971251925&idt=978&biw=1600&bih=1200&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&ucis=1%7C2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fwww.departures.com%2Ftravel%3Fextlink%3Dem-us-dp-sfmcmail13-body-3-travelterritory-o&frm=20&vis=1&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&fws=128%2C128&ohw=0%2C0&ga_vid=2131220341.1647971253&ga_sid=1647971253&ga_hid=1949501515&ga_fc=false&btvi=-1%7C-1&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

04b8fd8a8f241a75fce2b02a77d145bfbb70a206149160cf57b83fa57cdbe9cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:33 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11126
x-xss-protection: 0
google-lineitem-id: -2,5918448628
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,138381315787
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.departures.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
b03c65aed92e27d82b9aea89294f7d43.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1112 6 KB
4 KB 84ms
16ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b03c65aed92e27d82b9aea89294f7d43.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 22 Mar 2022 17:47:33 GMT
expires: Wed, 22 Mar 2023 17:47:33 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK dest5.html Show response
aexp.demdex.net/ Frame 668D 7 KB
3 KB 121ms
31ms Document
text/html 54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aexp.demdex.net/dest5.html?d_nsid=15

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-f424e4c1e880782914108fb45b503d9aae8fe034.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Tue, 22 Mar 2022 17:47:33 GMT
DCS: dcs-prod-irl1-1-v030-0d99b628d.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Tue, 15 Mar 2022 12:08:42 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: cuXDPTNWQ3E=
Content-Length: 2791
Connection: keep-alive

GET
H2 200 id Show response
omns.americanexpress.com/ 89 B
694 B 437ms
19ms XHR
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://omns.americanexpress.com/id?d_visid_ver=5.0.1&d_fieldgroup=A&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&mid=25811697120106260963452757702343685803&ts=1647971252955

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-f424e4c1e880782914108fb45b503d9aae8fe034.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

ce80ef4cc905954254b96a1e7e8dbf618e134822df41f080d293e4cee18ca7cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 22 Mar 2022 17:47:33 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-7f6b754cd4-xwx9f
vary: Origin
x-c: main-1629.I879dac.M0-556
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.departures.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 89
x-xss-protection: 1; mode=block

GET
H2 200 a77b85b7d8ff624dd847b8ffb6f2da3d.js Show response
tms.americanexpress.com/amex/prod/code/ 564 B
737 B 8ms
7ms Script
application/javascript 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tms.americanexpress.com/amex/prod/code/a77b85b7d8ff624dd847b8ffb6f2da3d.js?conditionId0=4911024
Requested by: Host: www.aexp-static.com
URL: https://www.aexp-static.com/cdaas/api/axpi/ensighten/amex/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ad5543ce03f625bbdf6ca1882e9dba75e605793290938fb30ff9ae633e9e21ab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
last-modified: Mon, 30 Aug 2021 07:58:18 GMT
server: nginx
etag: "612c8f9a-234"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 564

GET
H2 200 71f0e0dde74d63e30759dbddab9e6108.js Show response
tms.americanexpress.com/amex/prod/code/ 9 KB
2 KB 9ms
9ms Script
application/javascript 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tms.americanexpress.com/amex/prod/code/71f0e0dde74d63e30759dbddab9e6108.js?conditionId0=181208
Requested by: Host: www.aexp-static.com
URL: https://www.aexp-static.com/cdaas/api/axpi/ensighten/amex/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 04df6f29275338cd3afe57f7836d93a8ec558aeb96a2271302181a608383b051

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:32 GMT
content-encoding: gzip
last-modified: Thu, 24 Feb 2022 03:54:45 GMT
server: nginx
etag: W/"62170185-2565"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 tr
www.facebook.com/ 44 B
408 B 29ms
12ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr?id=579992713163376&ev=PageView&noscript=1

Requested by

Host: www.departures.com
URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:33 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Tue, 22 Mar 2022 17:47:33 GMT

GET

/
www.google.de/pagead/1p-user-list/332912992/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/332912992/?url=https%3A%2F%2Fdepartures.com%2F&script=0
https://www.google.com/pagead/1p-user-list/332912992/?url=https%3A%2F%2Fdepartures.com%2F&script=0&is_vtc=1&random=883895017
https://www.google.de/pagead/1p-user-list/332912992/?url=https%3A%2F%2Fdepartures.com%2F&script=0&is_vtc=1&random=883895017&ipr=y

0
0

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 4 KB
2 KB 33ms
33ms XHR
application/json 54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5C36123F5245AF470A490D45%40AdobeOrg&d_nsid=15&d_mid=25811697120106260963452757702343685803&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%01311D05DAF6AC11BC-400017E9C1B03693&ts=1647971253395

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-f424e4c1e880782914108fb45b503d9aae8fe034.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

1b0ae04a389baf033d31f74991dbd8e564453e641b582250324fbca44f27fc26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcscanary-prod-irl1-1-v035-0e67bfa71.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: dSyo7pjnQB0=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.departures.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1381
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 s95296843544721 Show response
omns.americanexpress.com/b/ss/amexpressenterpriseprod/10/JS-2.17.0-LBWB/ 4 KB
4 KB 53ms
52ms Script
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://omns.americanexpress.com/b/ss/amexpressenterpriseprod/10/JS-2.17.0-LBWB/s95296843544721?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=22%2F2%2F2022%2017%3A47%3A33%202%200&d.&nsid=15&jsonv=1&.d&mid=25811697120106260963452757702343685803&aid=311D05DAF6AC11BC-400017E9C1B03693&aamlh=6&ce=UTF-8&ns=1americanexpress&pageName=US%7Cdepartures%7Cterritory%7Ctravel&g=https%3A%2F%2Fwww.departures.com%2Ftravel%3Fextlink%3Dem-us-dp-sfmcmail13-body-3-travelterritory-o&c.&visitorCheck=VisitorAPI%20Present&gvs=1&.c&cc=USD&server=www.departures.com&v0=extlink%3Dem-us-dp-sfmcmail13-body-3-travelterritory-o&events=event20%2Cevent45&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&h1=US%7Cdepartures%7Cterritory%7Ctravel&l1=loginStatus%3Aanonymous&c3=en&c4=US&c10=prospect&c19=US%7Cdepartures%7Cterritory&v21=US%3ALegacy%20Non-Search&v22=D%3Dgctrac&c24=US%7Cdepartures%7Cterritory%7Ctravel&v27=US&c30=US%7Cdepartures%7Cterritory%7Ctravel&c31=US%7Cdepartures&c38=US%7Cdepartures%7Cterritory%7Ctravel&v45=prospect&c48=D%3Dgctrac&c49=Launch-Acq%3Av1.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3A9.3-Mbox%3ANA-CSVisID%3Afalse-msuite%3Atrue-PD%3A2022-03-15&c50=non-authenticated&v60=1600&v61=landscape&v65=D%3Domnmycademo&c67=D%3Dmrcards&v67=D%3Dmrcards&v71=US%7Cdepartures%7Cterritory%7Ctravel&c72=loginStatus%3Aanonymous&v72=n%2Fa&v74=US%7Cdepartures%7Cterritory%7Ctravel&c75=Launch&v75=25811697120106260963452757702343685803&v85=em-us-dp-sfmcmail13-body-3-travelterritory-o&v94=D%3Dagent-id&v131=extlink%3Dem-us-dp-sfmcmail13-body-3-travelterritory-o&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/437b26f18e6b/EX2e39ef00e8e34b74906786b0e7d4e00d-libraryCode_source.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

437872d4a6ac3214c75916ac1e680c3291c248fb6254b63aa8911c58e6b60611

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-aam-tid: o5wDVgHrT9Y=
date: Tue, 22 Mar 2022 17:47:33 GMT
x-content-type-options: nosniff
x-c: main-1629.I879dac.M0-556
p3p: CP="This is not a P3P policy"
vary: *
content-length: 4091
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-1-v030-0d120a3af.edge-irl1.demdex.com UNKNOWN
pragma: no-cache
last-modified: Wed, 23 Mar 2022 17:47:33 GMT
server: jag
xserver: anedge-7f6b754cd4-jxdqg
etag: 3538991320327749632-4619839141989339270
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 21 Mar 2022 17:47:33 GMT

GET
H/1.1

200
OK

ibs:dpid=269&dpuuid=705a623a-0bb5-4a00-9539-49c88afb8668&ddsuuid=25655402181406394163432343004953981475
dpm.demdex.net/ Frame 668D
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=10004&mt_exuid=25655402181406394163432343004953981475&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D269%26dpuuid%3D[MM_UUID]%26ddsuuid%3d25655402181406...
https://dpm.demdex.net/ibs:dpid=269&dpuuid=705a623a-0bb5-4a00-9539-49c88afb8668&ddsuuid=25655402181406394163432343004953981475

42 B
951 B

57ms
38ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=269&dpuuid=705a623a-0bb5-4a00-9539-49c88afb8668&ddsuuid=25655402181406394163432343004953981475

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcscanary-prod-irl1-1-v035-0e67bfa71.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: x+XnRkYaS0o=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Date: Tue, 22 Mar 2022 17:47:33 GMT
Server: MT3 4281 354de82 master zrh-pixel-x15 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://dpm.demdex.net/ibs:dpid=269&dpuuid=705a623a-0bb5-4a00-9539-49c88afb8668&ddsuuid=25655402181406394163432343004953981475
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 22 Mar 2022 17:47:32 GMT

GET
H2 200 s99876079194981 Show response
omns.americanexpress.com/b/ss/amexpressenterpriseprod/10/JS-2.17.0-LBWB/ 4 KB
4 KB 41ms
41ms Script
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://omns.americanexpress.com/b/ss/amexpressenterpriseprod/10/JS-2.17.0-LBWB/s99876079194981?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=22%2F2%2F2022%2017%3A47%3A33%202%200&d.&nsid=15&jsonv=1&.d&mid=25811697120106260963452757702343685803&aid=311D05DAF6AC11BC-400017E9C1B03693&aamlh=6&ce=UTF-8&ns=1americanexpress&pageName=US%7Cdepartures%7Cterritory%7Ctravel&g=https%3A%2F%2Fwww.departures.com%2Ftravel%3Fextlink%3Dem-us-dp-sfmcmail13-body-3-travelterritory-o&cc=USD&c4=US&v4=US%3Adepartures%3Aterritory%3Atravel&v5=US%3Adepartures%3Aterritory%3Atravel%3E%3EmoduleImpression%3Etravel-card-254045-p-1&c21=US%3Adepartures%3Aterritory%3Atravel&c22=US%3Adepartures%3Aterritory%3Atravel%3E%3EmoduleImpression%3Etravel-card-254045-p-1&v27=US&c49=Launch-Acq%3Av1.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3A9.3-Mbox%3ANA-CSVisID%3Afalse-msuite%3Atrue-PD%3A2022-03-15&c75=Launch&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/437b26f18e6b/EX2e39ef00e8e34b74906786b0e7d4e00d-libraryCode_source.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

6de9b97d1a499b4926ac3b996463f99ddf9c668bc34ae1209ca783d9fba36419

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-aam-tid: /KRBlQ0eQ/0=
date: Tue, 22 Mar 2022 17:47:33 GMT
x-content-type-options: nosniff
x-c: main-1629.I879dac.M0-556
p3p: CP="This is not a P3P policy"
vary: *
content-length: 4091
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-2-v030-01952d331.edge-irl1.demdex.com UNKNOWN
pragma: no-cache
last-modified: Wed, 23 Mar 2022 17:47:33 GMT
server: jag
xserver: anedge-7f6b754cd4-jxdqg
etag: 3538991320327749632-4619839141989339316
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 21 Mar 2022 17:47:33 GMT

GET
H2 200 s92820573034967 Show response
omns.americanexpress.com/b/ss/amexpressenterpriseprod/10/JS-2.17.0-LBWB/ 4 KB
4 KB 42ms
42ms Script
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://omns.americanexpress.com/b/ss/amexpressenterpriseprod/10/JS-2.17.0-LBWB/s92820573034967?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=22%2F2%2F2022%2017%3A47%3A33%202%200&d.&nsid=15&jsonv=1&.d&mid=25811697120106260963452757702343685803&aid=311D05DAF6AC11BC-400017E9C1B03693&aamlh=6&ce=UTF-8&ns=1americanexpress&pageName=US%7Cdepartures%7Cterritory%7Ctravel&g=https%3A%2F%2Fwww.departures.com%2Ftravel%3Fextlink%3Dem-us-dp-sfmcmail13-body-3-travelterritory-o&cc=USD&c4=US&v4=US%3Adepartures%3Aterritory%3Atravel&v5=US%3Adepartures%3Aterritory%3Atravel%3E%3EmoduleImpression%3Etravel-card-246937-p-2&c21=US%3Adepartures%3Aterritory%3Atravel&c22=US%3Adepartures%3Aterritory%3Atravel%3E%3EmoduleImpression%3Etravel-card-246937-p-2&v27=US&c49=Launch-Acq%3Av1.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3A9.3-Mbox%3ANA-CSVisID%3Afalse-msuite%3Atrue-PD%3A2022-03-15&c75=Launch&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/437b26f18e6b/EX2e39ef00e8e34b74906786b0e7d4e00d-libraryCode_source.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

608d47bf9be2efe704b7ace0c6adc4e7c724a5aba837f2e9c0b1f63930381ed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-aam-tid: VYEsL7XoR7Q=
date: Tue, 22 Mar 2022 17:47:33 GMT
x-content-type-options: nosniff
x-c: main-1629.I879dac.M0-556
p3p: CP="This is not a P3P policy"
vary: *
content-length: 4091
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-2-v030-083bac2ae.edge-irl1.demdex.com UNKNOWN
pragma: no-cache
last-modified: Wed, 23 Mar 2022 17:47:33 GMT
server: jag
xserver: anedge-7f6b754cd4-m4bzt
etag: 3538991318436085760-4619865618851660065
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 21 Mar 2022 17:47:33 GMT

GET
H2

200

pixel.gif
load77.exelator.com/ Frame 668D
Redirect Chain

https://loadm.exelator.com/load/?p=204&g=091&j=0&bi=25655402181406394163432343004953981475
https://loadm.exelator.com/load/?p=204&g=091&j=0&bi=25655402181406394163432343004953981475&xl8blockcheck=1
https://load77.exelator.com/pixel.gif

43 B
332 B

50ms
14ms

Image
image/gif

2a02:6ea0:c700::10
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://load77.exelator.com/pixel.gif
Protocol: H2
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-77-nzt: Abk73BA0fP3/pPkDAA
x-accel-expires: @1648747537
date: Tue, 22 Mar 2022 17:47:33 GMT
etag: "59f0c3fc-2b"
last-modified: Wed, 25 Oct 2017 17:03:56 GMT
server: CDN77-Turbo
x-77-nzt-ray: zjUK/oCp29c
x-77-cache: HIT
content-type: image/gif
access-control-allow-origin: *
x-cache: HIT
x-age: 260516
accept-ranges: bytes
x-77-pop: frankfurtDE
content-length: 43

Redirect headers

date: Tue, 22 Mar 2022 17:47:33 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://load77.exelator.com/pixel.gif
cache-control: no-cache
access-control-allow-credentials: true
content-type: image/gif
content-length: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 65ms
33ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022031601&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

999090a6a835c9a6664c69ccfac4ce30adaae79107ebc3a0f7a7a8b305030453

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 22 Mar 2022 17:47:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10674
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 85ms
53ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Mar 2022 17:47:33 GMT

GET
H2 204 usync
su.addthis.com/red/ Frame 668D 0
95 B 222ms
177ms Image
text/plain 184.30.24.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://su.addthis.com/red/usync?pid=16&puid=25655402181406394163432343004953981475&url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D420%26dpuuid%3D%7B%7Buid%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.24.121 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-121.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Mar 2022 17:47:33 GMT
cache-control: max-age=0, no-cache, no-store, no-transform

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3A58 13 KB
5 KB 24ms
6ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 22 Mar 2022 17:39:20 GMT
expires: Wed, 22 Mar 2023 17:39:20 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 493
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0FC3 783 B
535 B 34ms
17ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d676bb5720630086fd2a7609cbaba52edba2b808c2f473e84dc2206042c19e4f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GMjTS4RyvOAmISA6pnUvmA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 22 Mar 2022 17:47:33 GMT
date: Tue, 22 Mar 2022 17:47:33 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-GMjTS4RyvOAmISA6pnUvmA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

ibs:dpid=358&dpuuid=6445819511751916595
dpm.demdex.net/ Frame 668D
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID
https://dpm.demdex.net/ibs:dpid=358&dpuuid=6445819511751916595

42 B
945 B

37ms
37ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=358&dpuuid=6445819511751916595

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-0b737a958.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: whvT01QeTYs=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
Date: Tue, 22 Mar 2022 17:47:33 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e34ff2d7-1607-47db-97b5-70d25d87af4c
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dpm.demdex.net/ibs:dpid=358&dpuuid=6445819511751916595
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js Show response
pagead2.googlesyndication.com/bg/ Frame 3A58 35 KB
14 KB 24ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/w5W1EixFGUzWFgZOi1zWjT-g-ai_4t-KN23ava9eLxA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c395b5122c45194cd616064e8b5cd68d3fa0f9a8bfe2df8a376ddabdaf5e2f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 15:06:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9684
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13798
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 22 Mar 2023 15:06:09 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0FC3 0
0 107ms
96ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022031601&jk=957921676273513&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H/1.1

200
OK

ibs:dpid=470&dpuuid=7489904598220520935
dpm.demdex.net/ Frame 668D
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjM2NTYzMjkvdC8y/url/https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D470%26dpuuid%3D%24!%7BTURN_UUID%7D
https://dpm.demdex.net/ibs:dpid=470&dpuuid=7489904598220520935

42 B
945 B

35ms
34ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=470&dpuuid=7489904598220520935

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-07266cba8.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: CvT3bV3sSrk=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=470&dpuuid=7489904598220520935
pragma: no-cache
date: Tue, 22 Mar 2022 17:47:33 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 3A58 0
9 B 8ms
7ms Image
text/plain 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Cmd0cQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1

200
OK

ibs:dpid=477&dpuuid=3bf982d224b50f84a928aeadad97e21f5dacdbef63c3c3da7a7cef62681372b4b0da87c991749652
dpm.demdex.net/ Frame 668D
Redirect Chain

https://idsync.rlcdn.com/365868.gif?partner_uid=25655402181406394163432343004953981475
https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomMjU2NTU0MDIxODE0MDYzOTQxNjM0MzIzNDMwMDQ5NTM5ODE0NzUQABoNCLaX6JEGEgUI6AcQAEIASgA
https://dpm.demdex.net/ibs:dpid=477&dpuuid=3bf982d224b50f84a928aeadad97e21f5dacdbef63c3c3da7a7cef62681372b4b0da87c991749652

42 B
945 B

35ms
35ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=477&dpuuid=3bf982d224b50f84a928aeadad97e21f5dacdbef63c3c3da7a7cef62681372b4b0da87c991749652

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-00923ae7d.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: zapxs7bHTkc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Tue, 22 Mar 2022 17:47:34 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://dpm.demdex.net/ibs:dpid=477&dpuuid=3bf982d224b50f84a928aeadad97e21f5dacdbef63c3c3da7a7cef62681372b4b0da87c991749652
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

ibs:dpid=134096&dpuuid=2022032217473400016344457256
dpm.demdex.net/ Frame 668D
Redirect Chain

https://x.dlx.addthis.com/e/demdex_sync?na_exid=25655402181406394163432343004953981475&ru=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D134096%26dpuuid%3D%3Cna_id%3E%20
https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2022032217473400016344457256

42 B
945 B

32ms
32ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2022032217473400016344457256

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-0b3cdc53e.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: BoKM8cIiSU0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2022032217473400016344457256
pragma: no-cache
date: Tue, 22 Mar 2022 17:47:34 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Tue, 22 Mar 2022 17:47:34 GMT

GET
H/1.1

200
OK

ibs:dpid=540&dpuuid=77eb3d5d-20af-403d-8943-a112212a17c5
dpm.demdex.net/ Frame 668D
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D540%26dpuuid%3D%24%7BTA_DEVICE_ID%7D&partner_device_id=25655402181406394163432343004...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=ADB&partner_url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D540%26dpuuid%3D%24%7BTA_DEVICE_ID%7D&partner_device_id=25655402181406394163432...
https://dpm.demdex.net/ibs:dpid=540&dpuuid=77eb3d5d-20af-403d-8943-a112212a17c5

42 B
945 B

31ms
31ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=540&dpuuid=77eb3d5d-20af-403d-8943-a112212a17c5

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-004bed570.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: EtPjwhU8SA8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=540&dpuuid=77eb3d5d-20af-403d-8943-a112212a17c5
date: Tue, 22 Mar 2022 17:47:34 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEKZiDvrOxMZPaEadmQY2v1U&google_cver=1
dpm.demdex.net/ Frame 668D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjU2NTU0MDIxODE0MDYzOTQxNjM0MzIzNDMwMDQ5NTM5ODE0NzU=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKZiDvrOxMZPaEadmQY2v1U&google_cver=1?gdpr=0&gdpr_consent=

42 B
945 B

38ms
38ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKZiDvrOxMZPaEadmQY2v1U&google_cver=1?gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-035a33309.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 4JiJTA7iQGY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 22 Mar 2022 17:47:34 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKZiDvrOxMZPaEadmQY2v1U&google_cver=1?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hbpix
idpix.media6degrees.com/orbserv/ Frame 668D 43 B
278 B 176ms
131ms Image
image/gif 2606:4700::6812:b4f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idpix.media6degrees.com/orbserv/hbpix?pixId=16873&pcv=70&ptid=66&tpuv=01&tpu=25655402181406394163432343004953981475
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:b4f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4abdc5bae3773141e85e6bed6c09953d57aded7ef98b1d304c42807f2229474f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:34 GMT
cf-cache-status: DYNAMIC
last-modified: Fri, 08 Sep 2017 18:54:28 GMT
server: cloudflare
etag: "59b2e764-2b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif
accept-ranges: bytes
cf-ray: 6f00c0d48d45cc42-ZRH
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 49ms
49ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022031601&jk=957921676273513&bg=!jY6ljsrNAAba2mK92to7ACkAdvg8WlluNP7-KgZdpmqsv29RLl2Ljomp1i_iD6V01QQlapLq1P-jVwIAAAB6UgAAAANoAQcKACtlkCPjDXU2QbAHXiezAARzC4AmS2gwV-qEE2olqTJRqtdeHNs1du0oh-BmmQLQzr2IjVoSOp_h2qEqkW8n5JNpTPGzeuhhibIzXRl8Qu_bWGEKr-oOLcoV2VImd6nIhQcArg4arb0KgjigY2yrz8Zb9kz5aJn9SQW9n1-ddrI1CB9xQNFfb99mr6up6R0swUrIVaF40G7iKbbV94krdwnGlPRnS6Z0luiI6S15M0ocHPLVTc1LBb2saDgPIawNqY4rOOK2WXV3GO5EARmNeW1NLbTz-PNNlcS1ltVeeQ0AYQ3zDdjbUQr4lDA9j9-8GB0Nm2bE9YWRXtMmrv9P8Ab5vxeiVSdIySeGe_eI5jN21oAAIZLgT0PRtqQN33Mu5M7eH78jXzy0hM4EHLZfmhLh2yydm50ZipJpjxMefQ9ZkRHlzpUbRNvkXITYip45irMmq3emg04f6ZrJkDe4Y-Kesr0gwv7H60Kh74tl78LvEN9ChajafKXdiLJpTWNdj0Wvbny2o9Hp6aAjKmgkzx5uFY8Nc38dlwRsiSMtdYQp8f0OSY5zaIT0f7SrCUblzI9fO_oXuK4a395qsOd_PE-dusBzAV9r9aJPUWi5SefAcDxDRXHTDOQUaESNhZ3gifml_pdt-khxA8CbX0lRZJQfULD6HDBNy4NV7RpWQhFomnRbCAGOcIKRsb7re8I6PrXW7AMVXu7mKRmfCfCTya6gB1tW7eg_fobX6k7kNOWFsJ37L61UKPHI7v666OcCvbrO9qRHmSc1jCEIi5Prckd08oqLxb0wJGh-XWBTDVkEa9w_RtWZP3oVUlmQA75bONM4FbbnG2Ta6Rt0YzoBEMlMaXFM5Tjy2vr-K71jWtRK4hwlmjBmgKpUkGaKyy_WxXxADz3LeIK-3pOQqA6i8GnM4tsCioRVsF2Fu8NSk5ExjIxWwmRMTXIadyaLKzoV4DvlFNTBbs7BLdSopJ4qn1E3QkcNHftORaRLy4WX17GRJjMyTiHkZ-AQKLMZFFjx

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Mar 2022 17:47:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET p50
rp.gwallet.com/r1/cm/ Frame 668D 0
0

GET
H2 200 s92963579665819 Show response
omns.americanexpress.com/b/ss/amexpressenterpriseprod/10/JS-2.17.0-LBWB/ 4 KB
4 KB 41ms
41ms Script
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://omns.americanexpress.com/b/ss/amexpressenterpriseprod/10/JS-2.17.0-LBWB/s92963579665819?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=22%2F2%2F2022%2017%3A47%3A34%202%200&d.&nsid=15&jsonv=1&.d&mid=25811697120106260963452757702343685803&aid=311D05DAF6AC11BC-400017E9C1B03693&aamlh=6&ce=UTF-8&ns=1americanexpress&pageName=US%7Cdepartures%7Cterritory%7Ctravel&g=https%3A%2F%2Fwww.departures.com%2Ftravel%3Fextlink%3Dem-us-dp-sfmcmail13-body-3-travelterritory-o&cc=USD&c4=US&v4=US%3Adepartures%3Aterritory%3Atravel&v5=US%3Adepartures%3Aterritory%3Atravel%3E%3EmoduleImpression%3Etravel-card-235710-p-3&c21=US%3Adepartures%3Aterritory%3Atravel&c22=US%3Adepartures%3Aterritory%3Atravel%3E%3EmoduleImpression%3Etravel-card-235710-p-3&v27=US&c49=Launch-Acq%3Av1.0-AM%3A2.17.0-VISID%3A5.0.1-DIL%3A9.3-Mbox%3ANA-CSVisID%3Afalse-msuite%3Atrue-PD%3A2022-03-15&c75=Launch&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&lrt=45&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/437b26f18e6b/EX2e39ef00e8e34b74906786b0e7d4e00d-libraryCode_source.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

3c2aa3be3734d3d173685b8be1352b89c7a260e9513c01415c0f6d045d053ba6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-aam-tid: R+Yl8WFgQHY=
date: Tue, 22 Mar 2022 17:47:34 GMT
x-content-type-options: nosniff
x-c: main-1629.I879dac.M0-556
p3p: CP="This is not a P3P policy"
vary: *
content-length: 4090
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-1-v030-083d49765.edge-irl1.demdex.com UNKNOWN
pragma: no-cache
last-modified: Wed, 23 Mar 2022 17:47:34 GMT
server: jag
xserver: anedge-7f6b754cd4-ph6kv
etag: 3538991321295650816-4619804369934398362
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 21 Mar 2022 17:47:34 GMT

GET
H/1.1

200
OK

ibs:dpid=1121&dpuuid=5123196421654220393
dpm.demdex.net/ Frame 668D
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=7085
https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5123196421654220393

42 B
945 B

33ms
33ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5123196421654220393

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-061e64b58.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: +PNjKL+DRf0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5123196421654220393
Date: Tue, 22 Mar 2022 17:47:34 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ibs:dpid=903&dpuuid=555d7256-fce4-4c4f-936d-81825c9a934e
dpm.demdex.net/ Frame 668D
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1
https://dpm.demdex.net/ibs:dpid=903&dpuuid=555d7256-fce4-4c4f-936d-81825c9a934e

42 B
945 B

34ms
34ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=555d7256-fce4-4c4f-936d-81825c9a934e

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-08c0323de.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: /zvTRUgiTaM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 22 Mar 2022 17:47:34 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=555d7256-fce4-4c4f-936d-81825c9a934e
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 189

GET
H/1.1

200
OK

ibs:dpid=1175&&dpuuid=Bee4RwO36RAesb8WC-OmRwe37x8etLhFVbAcW8_j
dpm.demdex.net/ Frame 668D
Redirect Chain

https://pixel.quantserve.com/pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=1175&&dpuuid=Bee4RwO36RAesb8WC-OmRwe37x8etLhFVbAcW8_j

42 B
945 B

36ms
36ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1175&&dpuuid=Bee4RwO36RAesb8WC-OmRwe37x8etLhFVbAcW8_j

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-0a6c4291d.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: El61jzV9QZ4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 22 Mar 2022 17:47:34 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dpm.demdex.net/ibs:dpid=1175&&dpuuid=Bee4RwO36RAesb8WC-OmRwe37x8etLhFVbAcW8_j
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 403 px
p.adsymptotic.com/d/ Frame 668D 0
0 61ms
32ms Image
text/html 104.18.102.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px?_pid=11693&_psign=bf265992ae7fbdc1ab4b39651c157974&_puuid=25655402181406394163432343004953981475&_rand=1166095213&_pp=adobeXtest&_redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=1524%26dpuuid=${UUID}
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.102.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H/1.1

200
OK

ibs:dpid=1957&dpuuid=1C2553BA164262E31CFE42D517296350
dpm.demdex.net/ Frame 668D
Redirect Chain

https://c.bing.com/c.gif?uid=25655402181406394163432343004953981475&Red3=MSAdobe_pd&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=1C2553BA164262E31CFE42D517296350

42 B
945 B

41ms
40ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1957&dpuuid=1C2553BA164262E31CFE42D517296350

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-0cacb0317.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: n9/WGXEfT/A=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 22 Mar 2022 17:47:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 47263CA1DA2D4DC19CF944784F3BAD78 Ref B: FRAEDGE1421 Ref C: 2022-03-22T17:47:35Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://dpm.demdex.net/ibs:dpid=1957&dpuuid=1C2553BA164262E31CFE42D517296350
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H/1.1

200
OK

ibs:dpid=3047&dpuuid=5194BDDBBBEF07&gdpr=0&gdpr_consent=
dpm.demdex.net/ Frame 668D
Redirect Chain

https://servedby.flashtalking.com/map/?key=a74thHgsfK627J6Ftt8sj5ks52bKe&gdpr=0&gdpr_consent=&url=https://dpm.demdex.net/ibs:dpid=3047&dpuuid=[%FT_GUID%]&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=3047&dpuuid=5194BDDBBBEF07&gdpr=0&gdpr_consent=

42 B
945 B

34ms
34ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=3047&dpuuid=5194BDDBBBEF07&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v030-0123cbe82.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: irXwsgxLSUU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
Date: Tue, 22 Mar 2022 17:47:35 GMT
Server: prod-xre-app21.frk11
X-HW: 1647971255.dop221.fr8.t,1647971255.cds106.fr8.shn,1647971255.dop221.fr8.t,1647971255.cds124.fr8.sc,1647971255.cds124.fr8.p
Location: https://dpm.demdex.net/ibs:dpid=3047&dpuuid=5194BDDBBBEF07&gdpr=0&gdpr_consent=
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Length: 0

GET
H2

404

sync
pixel.advertising.com/ups/28/ Frame 668D
Redirect Chain

https://pixel.advertising.com/ups/28/sync?uid=25655402181406394163432343004953981475&_origin=1&redir=true
https://pixel.advertising.com/ups/28/sync?uid=25655402181406394163432343004953981475&_origin=1&redir=true&verify=true

0
255 B

11ms
10ms

Image
text/plain

54.93.153.188
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/28/sync?uid=25655402181406394163432343004953981475&_origin=1&redir=true&verify=true

Protocol

Server

54.93.153.188 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-153-188.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 17:47:35 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://pixel.advertising.com/ups/28/sync?uid=25655402181406394163432343004953981475&_origin=1&redir=true&verify=true
date: Tue, 22 Mar 2022 17:47:35 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

ibs:dpid=22069&dpuuid=3015644796961
dpm.demdex.net/ Frame 668D
Redirect Chain

https://tag.yieldoptimizer.com/ps/ps?t=i&p=2233
https://tag.yieldoptimizer.com/ps/ps?tc=477276614&t=i&p=2233
https://dpm.demdex.net/ibs:dpid=22069&dpuuid=3015644796961

42 B
945 B

33ms
32ms

Image
image/gif

54.154.126.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22069&dpuuid=3015644796961

Protocol

HTTP/1.1

Server

54.154.126.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-126-215.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v030-0462a0296.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 3r8tyQYcSYo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 22 Mar 2022 17:47:35 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NON DSP COR TAIo PSAo PSDo HISo OUR BUS UNI INT DEM OTC"
location: https://dpm.demdex.net/ibs:dpid=22069&dpuuid=3015644796961
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 668D
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=5c420d2b-f139-4fee-b0c0-89a7b8ce9433
https://s.amazon-adsystem.com/dcm?pid=5c420d2b-f139-4fee-b0c0-89a7b8ce9433&dcc=t
https://dpm.demdex.net/ibs:dpid=139200&dpuuid=qbElvSdBTXGs19nX1nYlsA&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dadobe.com%26id%3D%24%7BDD_UUID%7D
https://s.amazon-adsystem.com/ecm3?ex=adobe.com&id=25655402181406394163432343004953981475

43 B
556 B

105ms
105ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=adobe.com&id=25655402181406394163432343004953981475

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://aexp.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Mar 2022 17:47:35 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: W9T2K92A71V0N3EAQRAE
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

DCS: dcs-prod-irl1-1-v030-0b3cdc53e.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 9neuz96aTsY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://s.amazon-adsystem.com/ecm3?ex=adobe.com&id=25655402181406394163432343004953981475
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: adservice.google.de
URL: https://adservice.google.de/adsid/integrator.js?domain=www.departures.com

Domain: adservice.google.de
URL: https://adservice.google.de/adsid/integrator.js?domain=www.departures.com

Domain: www.google.de
URL: https://www.google.de/pagead/1p-user-list/332912992/?url=https%3A%2F%2Fdepartures.com%2F&script=0&is_vtc=1&random=883895017&ipr=y

Domain: rp.gwallet.com
URL: https://rp.gwallet.com/r1/cm/p50

Verdicts & Comments Add Verdict or Comment

78 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

43 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-20 06:05:23	Name: demdex Value: 25655402181406394163432343004953981475
www.departures.com/	1969-12-31 23:59:59	Name: CRAFT_CSRF_TOKEN Value: c1e8ee221f39945ecefb5c814da374fd01f831e73a4d199a203ef0d19acc53faa%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22CRAFT_CSRF_TOKEN%22%3Bi%3A1%3Bs%3A40%3A%22FqROEjlT3vmkmybsTwnAXoWiunnSp82bMytuyT07%22%3B%7D
.departures.com/	1969-12-31 23:59:59	Name: AMCVS_5C36123F5245AF470A490D45%40AdobeOrg Value: 1
.departures.com/	1970-01-20 11:07:47	Name: __gads Value: ID=066417699b13e358:T=1647971252:S=ALNI_MY16-pUEHGES0So2Q7CWI3Z6Ppj6Q
.facebook.com/	1970-01-20 03:55:47	Name: fr Value: 0WbBCg1qKrV0RdoVv..BiOgu1...1.0.BiOgu1.
.americanexpress.com/	1970-01-20 19:17:23	Name: s_vi Value: [CS]v1\|311D05DAF6AC11BC-400017E9C1B03693[CE]
.americanexpress.com/	1970-01-20 19:17:23	Name: s_ecid Value: MCMID%7C25811697120106260963452757702343685803
.doubleclick.net/	1970-01-20 11:07:47	Name: IDE Value: AHWqTUnUGSgYHSLi8-u1vx4vfYHgr3Ut9h-cGppRZvoBs2Pj0soV0sjaY4x4h2-A
.departures.com/	1970-01-20 19:18:49	Name: AMCV_5C36123F5245AF470A490D45%40AdobeOrg Value: 359503849%7CMCIDTS%7C19074%7CMCMID%7C25811697120106260963452757702343685803%7CMCAAMLH-1648576053%7C6%7CMCAAMB-1648576053%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1647978453s%7CNONE%7CMCAID%7C311D05DAF6AC11BC-400017E9C1B03693%7CvVersion%7C5.0.1
.departures.com/	1970-01-20 02:29:23	Name: aam_id Value: 25655402181406394163432343004953981475
.exelator.com/	1970-01-20 04:38:59	Name: EE Value: "adfc1ccd566fd3d516cb27418fa6ae4c"
.exelator.com/	1970-01-20 04:38:59	Name: ud Value: "eJxrXxzq6XKLQSExJS3ZMDk5xdTMLC3FOMXU0Cw5ycjcxNAiLdEsMdUkeXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq0yNJySX5RZvoiF9fFRSlpDItKik8F778ZDwDTTitR"
.departures.com/	1969-12-31 23:59:59	Name: s_sess Value: %20wc_ttc%3D1647971252497%3B%20v85%3Dem-us-dp-sfmcmail13-body-3-travelterritory-o%3B%20s_visit%3D1%3B%20s_dedupeCM%3Dextlink%253Dem-us-dp-sfmcmail13-body-3-travelterritory-oUS%253ALegacy%2520Non-Searchn%252Fan%252Fa%3B%20s_cpc%3D1%3B%20s_cc%3Dtrue%3B%20%2520s_ips%3D1200%3B%20s_tp%3D4168%3B%20s_ppv%3DUS%25257Cdepartures%25257Cterritory%25257Ctravel%252C29%252C0%252C1200%252C1%252C3%3B
.adnxs.com/	1970-01-20 03:55:47	Name: uuid2 Value: 6445819511751916595
.mathtag.com/	1970-01-20 11:12:06	Name: uuid Value: 705a623a-0bb5-4a00-9539-49c88afb8668
.dpm.demdex.net/	1970-01-20 06:05:23	Name: dpm Value: 25655402181406394163432343004953981475
.rlcdn.com/	1970-01-20 10:31:47	Name: rlas3 Value: XOZoIA63epL97Fv/m5BWK82jiDJNpWkGBR3m1UNtuII=
.turn.com/	1970-01-20 06:05:23	Name: uid Value: 7489904598220520935
.rlcdn.com/	1970-01-20 03:12:35	Name: pxrc Value: CLaX6JEGEgUI6AcQABIGCPHrARAA
.tapad.com/	1970-01-20 03:12:35	Name: TapAd_TS Value: 1647971254392
.tapad.com/	1970-01-20 03:12:35	Name: TapAd_DID Value: 77eb3d5d-20af-403d-8943-a112212a17c5
.tapad.com/	1970-01-20 03:12:35	Name: TapAd_3WAY_SYNCS Value:
.departures.com/	1970-01-21 21:34:11	Name: s_pers Value: %20om_ttc%3D1647971252495%7C1679075252495%3B%20s_uvid%3D1647971252498333%7C1805651252498%3B%20s_vnum%3D1%7C1805651252499%3B%20s_invisit%3Dtrue%7C1647973052499%3B%20s_tbm%3Dtrue%7C1647973053462%3B%20s_campStack%3D%255B%255B%2522extlink%25253Dem-us-dp-sfmcmail13-body-3-travelterritory-o%2522%252C%25221647971253468%2522%255D%255D%7C1650563253467%3B%20gpv_v41%3DUS%257Cdepartures%257Cterritory%257Ctravel%7C1647973054546%3B
.rfihub.com/	1970-01-20 11:07:47	Name: eud Value: H4sIAAAAAAAAAFvFxGtoZmJuaW5oZGpibmAIANoZ2YwQAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSNjU0Mja0NDMxMjQzNTEyMjC2NBbiM9T1DY5PN00tjorKyysCAKg-9UclAAAA
.rfihub.com/	1970-01-20 11:07:47	Name: rud Value: H4sIAAAAAAAAAOMSNjU0Mja0NDMxMjQzNTEyMjC2NBbiM9T1DY5PN00tjorKyyuS4jU0MzG3NDc0MjUxNzAEAGyJ56k0AAAA
.adsrvr.org/	1970-01-20 10:31:47	Name: TDID Value: 555d7256-fce4-4c4f-936d-81825c9a934e
.quantserve.com/	1970-01-20 03:55:47	Name: d Value: EJMBDAHcJbmvYA
.quantserve.com/	1970-01-20 11:16:25	Name: mc Value: 623a0bb6-d4086-a4bd9-a3cfe
.adsrvr.org/	1970-01-20 10:31:47	Name: TDCPM Value: CAESEgoDYWFtEgsIhoj1yMKNxjoQBRgFIAEoAjILCJqx-vPYjcY6EAU4AQ..
.bing.com/	1970-01-20 11:07:47	Name: MUID Value: 1C2553BA164262E31CFE42D517296350
.flashtalking.com/	1970-01-20 19:17:23	Name: flashtalkingad1 Value: "GUID=5194BDDBBBEF07"
.advertising.com/	1970-01-20 10:33:13	Name: APID Value: UP2835616f-aa08-11ec-b5ae-065f72b997e2
.yieldoptimizer.com/	1970-01-20 10:31:47	Name: fbh0 Value: %7B%7D
.yieldoptimizer.com/	1970-01-20 10:31:47	Name: gcma Value: %7B%22t%22%3A0%2C%22o%22%3Afalse%7D
.yieldoptimizer.com/	1970-01-20 10:31:47	Name: rmxc Value: %7B%22t%22%3A0%2C%22e%22%3A%22%22%2C%22i%22%3Afalse%7D
.yieldoptimizer.com/	1970-01-20 10:31:47	Name: cktst Value: 477276614
.yieldoptimizer.com/	1970-01-20 10:31:47	Name: ckid Value: 3015644796961
.yieldoptimizer.com/	1970-01-20 10:31:47	Name: dph Value: %7B%22t%22%3A%5B115889%5D%2C%22dp%22%3A%5B2233%5D%7D
.yieldoptimizer.com/	1970-01-20 10:31:47	Name: ph Value: %7B%22p%22%3A%5B1025%5D%2C%22t%22%3A%5B115889%5D%7D
.demdex.net/	1970-01-20 06:05:23	Name: dextp Value: 269-1-1647971253512\|3-1-1647971253613\|420-1-1647971253715\|358-1-1647971253817\|470-1-1647971253928\|477-1-1647971254029\|843-1-1647971254130\|540-1-1647971254231\|771-1-1647971254332\|992-1-1647971254433\|1127-1-1647971254534\|1121-1-1647971254635\|903-1-1647971254736\|1175-1-1647971254840\|1524-1-1647971254941\|1957-1-1647971255042\|3047-1-1647971255143\|6835-1-1647971255244\|22069-1-1647971255345\|139200-1-1647971255445
.amazon-adsystem.com/	1970-01-20 06:24:06	Name: ad-id Value: A6Swrdwq_ENHosxnZV4MFtY
.amazon-adsystem.com/	1970-01-21 21:50:01	Name: ad-privacy Value: 0

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
other	warning	URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o(Line 7) Message: <link rel=preload> has an unsupported `type` value
other	warning	URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o(Line 8) Message: <link rel=preload> has an unsupported `type` value
other	warning	URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o(Line 9) Message: <link rel=preload> has an unsupported `type` value
other	warning	URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o(Line 10) Message: <link rel=preload> has an unsupported `type` value
other	warning	URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o(Line 11) Message: <link rel=preload> has an unsupported `type` value
security	error	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js(Line 9) Message: Refused to load the script 'https://adservice.google.de/adsid/integrator.js?domain=www.departures.com' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' data: blob: .americanexpress.com .doubleclick.net .fastly.net unpkg.com .google.com .adobedtm.com .aexp-static.com .lpsnmedia.net .nr-data.net .liveperson.net .facebook.com .googleadservices.com .demdex.net .newrelic.com .googletagservices.com .googlesyndication.com .stripe.com .craftcms.com .turn.com .adnxs.com .media6degrees.com .adsrvr.org .adsymptotic.com .rfihub.com .advertising.com .tapad.com .gwallet.com .amazon-adsystem.com .flashtalking.com .addthis.com .yieldoptimizer.com". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js(Line 9) Message: Refused to load the script 'https://adservice.google.de/adsid/integrator.js?domain=www.departures.com' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' data: blob: .americanexpress.com .doubleclick.net .fastly.net unpkg.com .google.com .adobedtm.com .aexp-static.com .lpsnmedia.net .nr-data.net .liveperson.net .facebook.com .googleadservices.com .demdex.net .newrelic.com .googletagservices.com .googlesyndication.com .stripe.com .craftcms.com .turn.com .adnxs.com .media6degrees.com .adsrvr.org .adsymptotic.com .rfihub.com .advertising.com .tapad.com .gwallet.com .amazon-adsystem.com .flashtalking.com .addthis.com .yieldoptimizer.com". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://www.departures.com/travel?extlink=em-us-dp-sfmcmail13-body-3-travelterritory-o Message: Refused to load the image 'https://www.google.de/pagead/1p-user-list/332912992/?url=https%3A%2F%2Fdepartures.com%2F&script=0&is_vtc=1&random=883895017&ipr=y' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' data: blob: .americanexpress.com .doubleclick.net .fastly.net unpkg.com .google.com .adobedtm.com .aexp-static.com .lpsnmedia.net .nr-data.net .liveperson.net .facebook.com .googleadservices.com .demdex.net .newrelic.com .googletagservices.com .googlesyndication.com .stripe.com .craftcms.com .turn.com .adnxs.com .media6degrees.com .adsrvr.org .adsymptotic.com .rfihub.com .advertising.com .tapad.com .gwallet.com .amazon-adsystem.com .flashtalking.com .addthis.com .yieldoptimizer.com". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.
network	error	URL: https://p.adsymptotic.com/d/px?_pid=11693&_psign=bf265992ae7fbdc1ab4b39651c157974&_puuid=25655402181406394163432343004953981475&_rand=1166095213&_pp=adobeXtest&_redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=1524%26dpuuid=${UUID} Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://pixel.advertising.com/ups/28/sync?uid=25655402181406394163432343004953981475&_origin=1&redir=true&verify=true Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
aexp.demdex.net
assets.adobedtm.com
b03c65aed92e27d82b9aea89294f7d43.safeframe.googlesyndication.com
c.bing.com
click.email.departures.com
cm.g.doubleclick.net
d.turn.com
departures-web-va-private-herokuapp-com.freetls.fastly.net
dpm.demdex.net
ib.adnxs.com
idpix.media6degrees.com
idsync.rlcdn.com
load77.exelator.com
loadm.exelator.com
match.adsrvr.org
omns.americanexpress.com
p.adsymptotic.com
p.rfihub.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pixel.tapad.com
rp.gwallet.com
s.amazon-adsystem.com
securepubads.g.doubleclick.net
servedby.flashtalking.com
su.addthis.com
sync.mathtag.com
tag.yieldoptimizer.com
tms.americanexpress.com
tpc.googlesyndication.com
unpkg.com
www.aexp-static.com
www.departures.com
www.facebook.com
www.google.com
www.google.de
x.dlx.addthis.com
adservice.google.de
rp.gwallet.com
www.google.de
104.117.208.213
104.18.102.194
104.89.42.102
142.250.181.226
142.250.184.226
15.188.95.229
18.198.69.109
184.30.24.121
185.29.132.245
193.0.160.128
2001:678:cb4:bbbb::13
209.197.3.19
2606:4700::6810:7daf
2606:4700::6812:b4f
2620:116:800d:21:3175:5196:e3fd:8c1d
2620:1ec:c11::200
2a00:1450:4001:80e::2002
2a00:1450:4001:811::2002
2a00:1450:4001:82a::2001
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2004
2a02:26f0:6c00:299::1e80
2a02:6ea0:c700::10
2a03:2880:f12d:181:face:b00c:0:25de
2a04:4e42:600::591
3.124.119.57
34.207.25.27
35.186.212.60
35.227.248.159
35.244.174.68
35.71.131.137
37.252.172.36
52.46.130.91
54.154.126.215
54.93.153.188
95.101.27.43
035c007044c2434e73e8528a4a0039005564b4b1dea5bbb00ef0859e538f30fd
0392b055eb94752840a87f811275fc9441e1e06987192028edf4c66209284664
04b8fd8a8f241a75fce2b02a77d145bfbb70a206149160cf57b83fa57cdbe9cc
04df6f29275338cd3afe57f7836d93a8ec558aeb96a2271302181a608383b051
06f6faf0e9a94d4fafaba2be94cc596c71797fd6455551342ccc57e2dda720cb
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1b0ae04a389baf033d31f74991dbd8e564453e641b582250324fbca44f27fc26
1d0515826c48115763518376769fcaa9dcea06c81fda1cd36a14bb9355ea4d6b
2416e46fdbf13444aa79850c9c55d73ec79c9533b6bdd6f030fc062ce2c88d7a
2b28785f737f9d43b5d6afc3066a39426e433501d692c052934371a4f09f6095
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e1698f53935f78113155404844e6b83c72053bc3ffbbf335ea2344bad4dd961
3c035736f3570224361d795b4a8e38a275eedae3a9d6134e67895e526db0669b
3c2aa3be3734d3d173685b8be1352b89c7a260e9513c01415c0f6d045d053ba6
404cfc3dacd8fa0992888acbb8a0ee5e64c414ac558d5303c11ba412fcfc0e4c
437872d4a6ac3214c75916ac1e680c3291c248fb6254b63aa8911c58e6b60611
4abdc5bae3773141e85e6bed6c09953d57aded7ef98b1d304c42807f2229474f
4f4a2fbc3843d7d27f00bc5c89499841d7d4a70a598b251a2b7e289ef7a650ab
5042f25c3eb1530880fa3b05325462c028492caf22141409999cdd7e6364b8ba
512b9275d80d28ad524a3188d16b9ad572d75e460bd64bba6ad04f829bd304af
5214776bf24313e781b1d7f67ed6545c33805a315e0ab2758e0150d722b19322
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5661421bd67e4bc9efd7cc49bf8cee53fc269824e7115d9f391eca4dc235de2d
57b7ef076c579835d62a46128243ef25657202faf26afd79839faaddd8476f6d
608d47bf9be2efe704b7ace0c6adc4e7c724a5aba837f2e9c0b1f63930381ed5
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
683def6071b7d3ac54d26c5acb9b96da0a6b16e6d5a27e4cdfd8672d6ee31499
6b994ed428d03f47e32b40854a65a5ad30094b09d41c269bc21212575a57d0fd
6de9b97d1a499b4926ac3b996463f99ddf9c668bc34ae1209ca783d9fba36419
7bcb931e411106cad7661417bf784f8fef1418d6384af9760cc126b3695f348f
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
80310f70dd69e8b1ba61bd9e10031a2dec0aa7e104556cf4c9947e6944778b48
87770705bd0066b2e84aadaebadd721808d8f900dcaaa9a8d6fe88a740a4ed08
894874788a871c70c3acdded5e7b2de4df381f1a485fcfe57ef85878a9873d4a
8c6c6ecdc6450929c6ddc8c4a65f748d8b1a7169f266c9d6ee106b40e81aeb58
94f721e1645ef65c2acdc9539677671d3984b729b921210ae29dd5d69d527ef8
999090a6a835c9a6664c69ccfac4ce30adaae79107ebc3a0f7a7a8b305030453
a001dd03b53452b4d744b3088484a02357b1f71962acdfa516f13abb09f11243
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a51d166487836c0b3056c89723b3a0913dc5fa1ada3c5bac83d731290801f4e0
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
ab7a73ff3f21b94d8f4e809c519705fd62962e1e474bf4d9586f203672c21ef4
ab8ba165844efd1399f8eef03d6778ce50703eacd7072761a00cfacd7d573f7d
ad5543ce03f625bbdf6ca1882e9dba75e605793290938fb30ff9ae633e9e21ab
ba229aba5ef45945fb3eee772ea4d9927718cac47811ef5422d3e7a21a8ece5d
beeb3447c281af633b86a0b539e6602bc1619aefc06feae27d2f2189abdb0e86
bf7d52f77aad7484b3c43c939c080199a3603f2c733d307b0d886db1a0456048
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c395b5122c45194cd616064e8b5cd68d3fa0f9a8bfe2df8a376ddabdaf5e2f10
ce80ef4cc905954254b96a1e7e8dbf618e134822df41f080d293e4cee18ca7cf
d44f2a872c0a75d52de5e5983410470d747216b81cd6f42e4cd6adb1640fa823
d676bb5720630086fd2a7609cbaba52edba2b808c2f473e84dc2206042c19e4f
d7698d0db9a43d066ff8917b61d0b5e9a5f88312ada14988d8f82fe3dca7286b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5a45eeb77b80a88a46baf0c83dfd88804d482de3e884ce9cf4bef3e1889b497
ed54c622898162bdb56dfb1bf5471c977b401a911a270ce95fd26299e33a6593
ef02cfa21f67f31b6d6431c0f4d4090325f62992742171453a9ac6495311d311
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f20cd896d8adf9abd8428a76eab49474865c782207804b5e5aebd7c70698142c
f25ced7e4b07d9d7c09a5d541a8fa3d6367a8659b6136ef5313d550211743bd9
fc0355aed72233dc3b1a7c5ef3e66a58c9f0c2f060ac60442231ff96824dd563
fc844f0110369415e237bd34c13bf61f0b00a8450d76790941c910b282feb9f2

www.departures.com Open in urlscan Pro 34.207.25.27 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

84 Requests

75 %HTTPS

39 %IPv6

30 Domains

40 Subdomains

22 IPs

6 Countries

1497 kBTransfer

2789 kBSize

43 Cookies

7 Outgoing links

Page URL History

Redirected requests

84 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.departures.com Open in urlscan Pro
34.207.25.27 Public Scan

Screenshot
Live screenshot

Full Image

84
Requests

75 %
HTTPS

39 %
IPv6

30
Domains

40
Subdomains

22
IPs

6
Countries

1497 kB
Transfer

2789 kB
Size

43
Cookies

84 HTTP transactions
0 data transactions