be.secretescapes.com Open in urlscan Pro
54.73.62.134 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://links.secretescapes.com/u/click?_t=0f66786f995d446d8d095a74c1890c97&_m=712980f13b4549389d88f2ff55e4879f&_e=drBi38mQ0mxyw...
Effective URL:
https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&u...
Submission: On February 05 via api (February 5th 2024, 10:49:28 am UTC) from BE — Scanned from DE

Summary HTTP 168 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 48 IPs in 8 countries across 37 domains to perform 168 HTTP transactions. The main IP is 54.73.62.134, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is be.secretescapes.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on January 4th 2024. Valid for: a year.

This is the only time be.secretescapes.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.224.103.67 13.224.103.67	16509 (AMAZON-02) (AMAZON-02)
1 3	54.73.62.134 54.73.62.134	16509 (AMAZON-02) (AMAZON-02)
9	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	13.224.98.155 13.224.98.155	16509 (AMAZON-02) (AMAZON-02)
10	18.165.185.71 18.165.185.71	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
5	2a04:4e42:8d:... 2a04:4e42:8d::720	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
2	88.198.114.6 88.198.114.6	24940 (HETZNER-AS) (HETZNER-AS)
11	2600:9000:25a... 2600:9000:25a2:1c00:16:c2f8:3640:93a1	16509 (AMAZON-02) (AMAZON-02)
12	85.222.144.146 85.222.144.146	14340 (SALESFORCE) (SALESFORCE)
10	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
1	108.138.26.116 108.138.26.116	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	3.19.8.217 3.19.8.217	16509 (AMAZON-02) (AMAZON-02)
4	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:25a... 2600:9000:25a2:de00:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
2	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	89.207.16.75 89.207.16.75	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1	23.212.222.60 23.212.222.60	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:219... 2600:9000:2190:3c00:f:fd8f:b000:93a1	16509 (AMAZON-02) (AMAZON-02)
2	52.215.173.157 52.215.173.157	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:267... 2600:9000:2670:9600:9:9288:3940:21	16509 (AMAZON-02) (AMAZON-02)
2 4	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
2 7	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:93ca:31d8:d86e:38f6	16509 (AMAZON-02) (AMAZON-02)
2	2400:52e0:1e0... 2400:52e0:1e00::1080:1	200325 (BUNNYCDN) (BUNNYCDN)
3	13.32.145.50 13.32.145.50	16509 (AMAZON-02) (AMAZON-02)
1	18.165.183.127 18.165.183.127	16509 (AMAZON-02) (AMAZON-02)
1	34.120.195.249 34.120.195.249	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
8	18.165.183.103 18.165.183.103	16509 (AMAZON-02) (AMAZON-02)
4	54.229.206.70 54.229.206.70	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:25a... 2600:9000:25a2:3a00:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02)
2	35.172.243.12 35.172.243.12	14618 (AMAZON-AES) (AMAZON-AES)
3	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2600:9000:223... 2600:9000:223c:d200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	18.164.52.95 18.164.52.95	16509 (AMAZON-02) (AMAZON-02)
3	3.213.194.67 3.213.194.67	14618 (AMAZON-AES) (AMAZON-AES)
4	34.66.73.214 34.66.73.214	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	151.101.2.137 151.101.2.137	54113 (FASTLY) (FASTLY)
1	162.247.241.14 162.247.241.14	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
1	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
2	160.8.246.31 160.8.246.31	14340 (SALESFORCE) (SALESFORCE)
1	2.19.96.145 2.19.96.145	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	13.48.230.177 13.48.230.177	16509 (AMAZON-02) (AMAZON-02)
168	48

1 13.224.103.67 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-224-103-67.zrh50.r.cloudfront.net

links.secretescapes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.73.62.134 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-73-62-134.eu-west-1.compute.amazonaws.com

be.secretescapes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
2bf9.secretescapes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn-ukwest.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 13.224.98.155 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-98-155.zrh50.r.cloudfront.net

d1x3cbuht6sy0f.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 18.165.185.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-185-71.zrh55.r.cloudfront.net

d1gkiy13jtzlp.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a04:4e42:8d::720 (United States)

ASN54113 (FASTLY, US)

secretescapes-web.imgix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.198.114.6 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: app8.trustyou.com

cdn.trustyou.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:25a2:1c00:16:c2f8:3640:93a1 (United States)

ASN16509 (AMAZON-02, US)

bullfinch.orca-production.escapes.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 85.222.144.146 (Paris, France)

ASN14340 (SALESFORCE, US)
PTR: dcl2-ncg0-cdg3.eu18-cdg.force.com

service.force.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.26.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-26-116.fra56.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

netdna.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.19.8.217 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-19-8-217.us-east-2.compute.amazonaws.com

seal.digicert.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:25a2:de00:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.207.16.75 (Amsterdam, Netherlands) 1 redirects

ASN41041 (VCLK-EU-SE, US)

www.anrdoezrs.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.212.222.60 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-212-222-60.deploy.static.akamaitechnologies.com

www.yceml.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:3c00:f:fd8f:b000:93a1 (United States)

ASN16509 (AMAZON-02, US)

d1l6p2sc9645hc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.215.173.157 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-173-157.eu-west-1.compute.amazonaws.com

collector-488.tvsquared.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2670:9600:9:9288:3940:21 (United States)

ASN16509 (AMAZON-02, US)

d1gjxkdcqpo85.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:93ca:31d8:d86e:38f6 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:52e0:1e00::1080:1 (Germany)

ASN200325 (BUNNYCDN, SI)

survey.survicate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
surveys-static.survicate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.145.50 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-145-50.cdg50.r.cloudfront.net

cdn.heapanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.165.183.127 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-183-127.zrh55.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.195.249 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 249.195.120.34.bc.googleusercontent.com

o286415.ingest.sentry.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 18.165.183.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-183-103.zrh55.r.cloudfront.net

sparrow-production.escapes.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.229.206.70 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-206-70.eu-west-1.compute.amazonaws.com

collector.secretescapes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:25a2:3a00:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02, US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.172.243.12 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-172-243-12.compute-1.amazonaws.com

data.gosquared.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:d200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.164.52.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-52-95.cdg50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.213.194.67 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-194-67.compute-1.amazonaws.com

heapanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.66.73.214 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 214.73.66.34.bc.googleusercontent.com

client-api.auryc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.241.14 (United States)

ASN23467 (NEWRELIC-AS-1, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 160.8.246.31 (London, United Kingdom)

ASN14340 (SALESFORCE, US)
PTR: dcl15-ncg0-cdg3.la3-c1-cdg.salesforceliveagent.com

d.la3-c1-cdg.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.96.145 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-19-96-145.deploy.static.akamaitechnologies.com

c1.sfdcstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.48.230.177 (Stockholm, Sweden)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-48-230-177.eu-north-1.compute.amazonaws.com

d.la1-core1.sfdc-cehfhs.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	cloudfront.net d1x3cbuht6sy0f.cloudfront.net d1gkiy13jtzlp.cloudfront.net d1l6p2sc9645hc.cloudfront.net d1gjxkdcqpo85.cloudfront.net	382 KB
19	escapes.tech bullfinch.orca-production.escapes.tech — Cisco Umbrella Rank: 533896 sparrow-production.escapes.tech — Cisco Umbrella Rank: 361713	582 KB
12	force.com service.force.com — Cisco Umbrella Rank: 3987	42 KB
10	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
10	doubleclick.net 2 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 209 stats.g.doubleclick.net — Cisco Umbrella Rank: 79 googleads.g.doubleclick.net — Cisco Umbrella Rank: 38	172 KB
9	onetrust.com cdn-ukwest.onetrust.com — Cisco Umbrella Rank: 5458 geolocation.onetrust.com — Cisco Umbrella Rank: 567	124 KB
8	secretescapes.com 2 redirects links.secretescapes.com — Cisco Umbrella Rank: 294773 be.secretescapes.com 2bf9.secretescapes.com — Cisco Umbrella Rank: 621400 collector.secretescapes.com — Cisco Umbrella Rank: 339180	73 KB
7	google.de www.google.de — Cisco Umbrella Rank: 6518	1 KB
7	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 2	3 KB
6	heapanalytics.com cdn.heapanalytics.com — Cisco Umbrella Rank: 849 heapanalytics.com — Cisco Umbrella Rank: 762	231 KB
5	imgix.net secretescapes-web.imgix.net — Cisco Umbrella Rank: 308506	163 KB
4	salesforceliveagent.com d.la3-c1-cdg.salesforceliveagent.com — Cisco Umbrella Rank: 86240 d.la1-core1.sfdc-cehfhs.salesforceliveagent.com — Cisco Umbrella Rank: 41654	5 KB
4	auryc.com client-api.auryc.com — Cisco Umbrella Rank: 8930	2 KB
4	bing.com bat.bing.com — Cisco Umbrella Rank: 376	14 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	156 KB
4	branch.io cdn.branch.io — Cisco Umbrella Rank: 1154 api2.branch.io — Cisco Umbrella Rank: 774	23 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	216 B
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 681 script.hotjar.com — Cisco Umbrella Rank: 996	64 KB
2	gosquared.com data.gosquared.com — Cisco Umbrella Rank: 46366	149 B
2	survicate.com survey.survicate.com — Cisco Umbrella Rank: 4844 surveys-static.survicate.com — Cisco Umbrella Rank: 7196	5 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 1364 pixel.quantserve.com — Cisco Umbrella Rank: 1007	10 KB
2	tvsquared.com collector-488.tvsquared.com	9 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 145	4 KB
2	digicert.com seal.digicert.com — Cisco Umbrella Rank: 10960	11 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	241 KB
2	trustyou.com cdn.trustyou.com — Cisco Umbrella Rank: 99110	105 KB
1	sfdcstatic.com c1.sfdcstatic.com — Cisco Umbrella Rank: 27306	34 KB
1	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 110	455 B
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 236	469 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 600	16 KB
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1345	2 KB
1	sentry.io o286415.ingest.sentry.io — Cisco Umbrella Rank: 374359	324 B
1	yceml.net www.yceml.net — Cisco Umbrella Rank: 13942	126 KB
1	anrdoezrs.net 1 redirects www.anrdoezrs.net — Cisco Umbrella Rank: 27163	242 B
1	app.link app.link — Cisco Umbrella Rank: 2508	639 B
1	bootstrapcdn.com netdna.bootstrapcdn.com — Cisco Umbrella Rank: 3034	82 KB
1	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 362	109 KB
168	37

	Domain	Requested by
15	d1x3cbuht6sy0f.cloudfront.net	be.secretescapes.com d1gkiy13jtzlp.cloudfront.net d1x3cbuht6sy0f.cloudfront.net
12	service.force.com	be.secretescapes.com service.force.com
11	bullfinch.orca-production.escapes.tech	be.secretescapes.com bullfinch.orca-production.escapes.tech
10	www.google-analytics.com	be.secretescapes.com www.google-analytics.com
10	d1gkiy13jtzlp.cloudfront.net	be.secretescapes.com
8	sparrow-production.escapes.tech	bullfinch.orca-production.escapes.tech
8	cdn-ukwest.onetrust.com	be.secretescapes.com cdn-ukwest.onetrust.com
7	www.google.de	be.secretescapes.com
7	www.google.com	2 redirects be.secretescapes.com
5	secretescapes-web.imgix.net	be.secretescapes.com
4	client-api.auryc.com	bullfinch.orca-production.escapes.tech
4	collector.secretescapes.com	bullfinch.orca-production.escapes.tech
4	googleads.g.doubleclick.net	2 redirects www.googletagmanager.com
4	bat.bing.com	www.googletagmanager.com bat.bing.com be.secretescapes.com
4	connect.facebook.net	d1gkiy13jtzlp.cloudfront.net be.secretescapes.com connect.facebook.net
3	heapanalytics.com	be.secretescapes.com
3	www.facebook.com	bullfinch.orca-production.escapes.tech be.secretescapes.com
3	api2.branch.io	bullfinch.orca-production.escapes.tech
3	cdn.heapanalytics.com	be.secretescapes.com cdn.heapanalytics.com
3	stats.g.doubleclick.net	www.google-analytics.com
3	securepubads.g.doubleclick.net	be.secretescapes.com securepubads.g.doubleclick.net
2	d.la1-core1.sfdc-cehfhs.salesforceliveagent.com	service.force.com
2	d.la3-c1-cdg.salesforceliveagent.com	service.force.com
2	script.hotjar.com	static.hotjar.com script.hotjar.com
2	data.gosquared.com	d1l6p2sc9645hc.cloudfront.net
2	collector-488.tvsquared.com	be.secretescapes.com
2	www.googleadservices.com	www.googletagmanager.com
2	seal.digicert.com	be.secretescapes.com
2	www.googletagmanager.com	be.secretescapes.com
2	cdn.trustyou.com	be.secretescapes.com
2	be.secretescapes.com	1 redirects
1	c1.sfdcstatic.com
1	pagead2.googlesyndication.com	www.googletagmanager.com
1	bam.nr-data.net	bullfinch.orca-production.escapes.tech
1	js-agent.newrelic.com	be.secretescapes.com
1	pixel.quantserve.com	be.secretescapes.com
1	surveys-static.survicate.com	survey.survicate.com
1	rules.quantcount.com	secure.quantserve.com
1	o286415.ingest.sentry.io	bullfinch.orca-production.escapes.tech
1	static.hotjar.com	be.secretescapes.com
1	survey.survicate.com	be.secretescapes.com
1	secure.quantserve.com	www.googletagmanager.com
1	d1gjxkdcqpo85.cloudfront.net	be.secretescapes.com
1	d1l6p2sc9645hc.cloudfront.net	be.secretescapes.com
1	www.yceml.net	be.secretescapes.com
1	www.anrdoezrs.net	1 redirects
1	app.link	cdn.branch.io
1	2bf9.secretescapes.com	d1gkiy13jtzlp.cloudfront.net
1	geolocation.onetrust.com	cdn-ukwest.onetrust.com
1	netdna.bootstrapcdn.com	d1gkiy13jtzlp.cloudfront.net
1	cdn.branch.io	be.secretescapes.com
1	maps.googleapis.com	be.secretescapes.com
1	links.secretescapes.com	1 redirects
168	53

This site contains links to these domains. Also see Links.

Domain
www.qksrv.net
www.nederlandwereldwijd.nl
diplomatie.belgium.be
careers.secretescapes.com
www.facebook.com
www.twitter.com
nl.secretescapes.com
www.onetrust.com

Subject Issuer	Validity	Valid
*.secretescapes.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-04` - `2025-01-21`	a year	crt.sh
onetrust.com GTS CA 1P5	`2024-01-02` - `2024-04-01`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.imgix.com GlobalSign Atlas R3 DV TLS CA 2023 Q4	`2023-12-07` - `2025-01-07`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.trustyou.com Go Daddy Secure Certificate Authority - G2	`2023-11-16` - `2024-12-17`	a year	crt.sh
*.orca-production.escapes.tech Amazon RSA 2048 M02	`2023-05-07` - `2024-06-03`	a year	crt.sh
*.eu18.force.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-15` - `2024-03-13`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.branch.io Amazon RSA 2048 M01	`2023-09-11` - `2024-10-09`	a year	crt.sh
bootstrapcdn.com GTS CA 1P5	`2024-01-28` - `2024-04-27`	3 months	crt.sh
seal.digicert.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-07` - `2024-06-05`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-14` - `2024-02-12`	3 months	crt.sh
appipv4.link Amazon RSA 2048 M02	`2023-04-25` - `2024-05-23`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-01-21` - `2024-06-27`	5 months	crt.sh
*.tvsquared.com Amazon RSA 2048 M02	`2023-07-02` - `2024-07-30`	a year	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
quantserve.com R3	`2023-12-27` - `2024-03-26`	3 months	crt.sh
*.survicate.com Sectigo RSA Domain Validation Secure Server CA	`2023-09-18` - `2024-08-31`	a year	crt.sh
cdn.heapanalytics.com Amazon RSA 2048 M01	`2023-06-29` - `2024-07-27`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
ingest.sentry.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-02` - `2024-12-02`	a year	crt.sh
sparrow-production.escapes.tech Amazon RSA 2048 M03	`2023-09-18` - `2024-10-16`	a year	crt.sh
collector.secretescapes.com Amazon RSA 2048 M03	`2023-09-12` - `2024-10-10`	a year	crt.sh
gosquared.com Amazon RSA 2048 M03	`2023-09-25` - `2024-10-23`	a year	crt.sh
heapanalytics.com Amazon RSA 2048 M02	`2023-11-09` - `2024-12-08`	a year	crt.sh
*.auryc.com R3	`2023-11-25` - `2024-02-23`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-01-15` - `2025-02-15`	a year	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2024-10-01`	a year	crt.sh
la3-c1-cdg.salesforceliveagent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-11-01` - `2024-10-29`	a year	crt.sh
c1.sfdcstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-26` - `2024-03-24`	a year	crt.sh
la1-core1.sfdc-cehfhs.salesforceliveagent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-06-15` - `2024-06-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Frame ID: F51F6990A96C562A946E5406095F815F
Requests: 155 HTTP requests in this frame

Frame: https://service.force.com/embeddedservice/5.0/esw.html?parent=https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Frame ID: 50EBD9274911A05C028119CC3880F36F
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Tijdloze elegantie in het centrum van Berlijn | Luxe reizen tegen lage prijzen | Secret Escapesfallback16f16b11b111Back ButtonSearch IconFilter Icon

Page URL History Show full URLs

https://links.secretescapes.com/u/click?_t=0f66786f995d446d8d095a74c1890c97&_m=712980f13b4549389d88f2ff55e48... HTTP 303
https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?userId=27996229&time... HTTP 302
https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=tru... Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/clientlibs/

Salesforce Service Cloud (Live chat) Expand

Overall confidence: 100%
Detected patterns

service\.force\.com

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Heap (Analytics) Expand

Overall confidence: 100%
Detected patterns

heap-\d+\.js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Matomo Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

piwik\.js|piwik\.php

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

otSDKStub\.js

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

Page Statistics

168
Requests

97 %
HTTPS

47 %
IPv6

37
Domains

53
Subdomains

48
IPs

8
Countries

2809 kB
Transfer

8495 kB
Size

57
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.qksrv.net/links/7842175/type/am/http://www.google.com/support/accounts/bin/answer.py?&answer=61416
Title: link from Google

Search URL Search Domain Scan URL

URL: https://www.nederlandwereldwijd.nl/reisadvies
Title: Nederland

Search URL Search Domain Scan URL

URL: https://diplomatie.belgium.be/nl/reisadviezen
Title: België

Search URL Search Domain Scan URL

URL: http://careers.secretescapes.com/
Title: Vacatures

Search URL Search Domain Scan URL

URL: http://www.facebook.com/SecretEscapesNLBE

Search URL Search Domain Scan URL

URL: http://www.twitter.com/SecretEscapesBE

Search URL Search Domain Scan URL

URL: https://nl.secretescapes.com/privacy-policy
Title: Privacy- en cookiebeleid

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://links.secretescapes.com/u/click?_t=0f66786f995d446d8d095a74c1890c97&_m=712980f13b4549389d88f2ff55e4879f&_e=drBi38mQ0mxywdfp4npX2-YX2_ocXfTuOk4xs1vICaHaxnrymtDVwz6eGRwAiW65uo8LCkcnEM3TXbOABKGv9RBZsktzDXp38_Ak3gJEl76QV9I-tVNDh2YcKK1nSTxRKdi-aWWCVqJeTQI_LBUKCizTH4ibwRhYd7OV2rV6zsyDzZ9lgMWq6qRfamB1uCrr55vkOdCEQ704-boyLImsuODoNIWoytu2muWP3Ohy7-SeIFr7ETUinFnO_8qHmuEnWNJUKx9kHgbRTzZhEkWTZqYeDO3lusakDqV21lTChEvh_bWx869WMgCQj80s5A7aQhjL30hHkhTVYIi9o6Ad5ap-uhO3GwalNwX1ULAwYquYLU7Z9vVqVIJMhTtxfDn77y882JiuDAhx_jt0k2YeP65sZFQTedNcmf7llAUckM10YE5MySo8Jax_lfYBzv8c8cGioYb0JkjZrCPSDfbg5-fd8Xns-vljxp0dRubZZT6t8yvOEZRtNsRIHl4bgbhku6N5kY4-W4Y8KOJcjL03cdURcF8wtTpZcfXbnU3evyPFz3WZ30zAXA1GLPXjAKr_otf20nYQl1Px1Ls4CnU7qOO-jcEzw1Pwu0HQ6zbyYObjiRF5umfvgDUaSeaN8dCbPuZKWqoWUj4IqskN5BKg39Ohp8iu6WFMn_WSJu9r-cBeK3UaKn-6JIwohaPMHLQi HTTP 303
https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?userId=27996229&timestamp=1707116569144&noPasswordSignIn=true&authHash=9409708fe99d45262eea10b2fa8a42dd15665c0c&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f HTTP 302
https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71

https://www.anrdoezrs.net/am/7842175/include/allCj/generate/onLoad/am.js HTTP 302
https://www.yceml.net/am_gen/7842175/include/allCj/generate/onLoad/am.js

Request Chain 104

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/835782347/?random=756211951&cv=11&fst=1707130161943&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=rSVlCK_Yj3UQy43EjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=Mr3AZem8BYuZ78EP_rmUyAY&sscte=1&crd=CIK9sQI&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr0MQFpb9IU6ZYp_49Zdlky1GLdFduyvTuQ&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0QkRrYmR3Ukx5SjZURm1QR01xS3dpbFgzREdPUFZ1aW1FZFRjcC1iS2l2Y2hDbTFnb0ZZTkEiEwjpnZa3g5SEAxWLzDsCHf4cBWk HTTP 302
https://www.google.com/pagead/1p-conversion/835782347/?random=756211951&cv=11&fst=1707130161943&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=rSVlCK_Yj3UQy43EjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQI&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0QkRrYmR3Ukx5SjZURm1QR01xS3dpbFgzREdPUFZ1aW1FZFRjcC1iS2l2Y2hDbTFnb0ZZTkEiEwjpnZa3g5SEAxWLzDsCHf4cBWk&is_vtc=1&ocp_id=Mr3AZem8BYuZ78EP_rmUyAY&cid=CAQSKQAvHhf_FtH7xWFVdlNGPy5fZWlRzTGTPQwrvCUo_k5oYufaDtFM7L9w&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr8lz6YupTZPqaQXkBUymeuaI7baYK-X5Qw&random=3777811249 HTTP 302
https://www.google.de/pagead/1p-conversion/835782347/?random=756211951&cv=11&fst=1707130161943&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=rSVlCK_Yj3UQy43EjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQI&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0QkRrYmR3Ukx5SjZURm1QR01xS3dpbFgzREdPUFZ1aW1FZFRjcC1iS2l2Y2hDbTFnb0ZZTkEiEwjpnZa3g5SEAxWLzDsCHf4cBWk&is_vtc=1&ocp_id=Mr3AZem8BYuZ78EP_rmUyAY&cid=CAQSKQAvHhf_FtH7xWFVdlNGPy5fZWlRzTGTPQwrvCUo_k5oYufaDtFM7L9w&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr8lz6YupTZPqaQXkBUymeuaI7baYK-X5Qw&random=3777811249&ipr=y

Request Chain 105

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/835771806/?random=1942769393&cv=11&fst=1707130161948&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=Zo3aCIPjp3UQnrvDjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=Mr3AZZe7BdHN78EPgq6G4Ac&sscte=1&crd=CIK9sQI&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr1zqbxak3kA3MbIIaJg_p73CnThAAdd1uQ&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0REd4YVRSbV9RdENxeDFDNWJDSFlHUnRxbkY4alAwOHZkN29mRFJrdHZrbXpEbVlrcFVyTWciEwiXnJa3g5SEAxXR5jsCHQKXAXw HTTP 302
https://www.google.com/pagead/1p-conversion/835771806/?random=1942769393&cv=11&fst=1707130161948&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=Zo3aCIPjp3UQnrvDjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQI&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0REd4YVRSbV9RdENxeDFDNWJDSFlHUnRxbkY4alAwOHZkN29mRFJrdHZrbXpEbVlrcFVyTWciEwiXnJa3g5SEAxXR5jsCHQKXAXw&is_vtc=1&ocp_id=Mr3AZZe7BdHN78EPgq6G4Ac&cid=CAQSKQAvHhf_X7HTapSpSuqvK95DrrOMzZ2PzY4TjdyBj6_LGz1mGYW-kqz3&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr4IAOWSCza06yaU773xyBRAaXS0CJJmTTA&random=2191387264 HTTP 302
https://www.google.de/pagead/1p-conversion/835771806/?random=1942769393&cv=11&fst=1707130161948&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=Zo3aCIPjp3UQnrvDjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQI&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0REd4YVRSbV9RdENxeDFDNWJDSFlHUnRxbkY4alAwOHZkN29mRFJrdHZrbXpEbVlrcFVyTWciEwiXnJa3g5SEAxXR5jsCHQKXAXw&is_vtc=1&ocp_id=Mr3AZZe7BdHN78EPgq6G4Ac&cid=CAQSKQAvHhf_X7HTapSpSuqvK95DrrOMzZ2PzY4TjdyBj6_LGz1mGYW-kqz3&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr4IAOWSCza06yaU773xyBRAaXS0CJJmTTA&random=2191387264&ipr=y

168 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200

Primary Request sale-hotel Show response
be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/
Redirect Chain

https://links.secretescapes.com/u/click?_t=0f66786f995d446d8d095a74c1890c97&_m=712980f13b4549389d88f2ff55e4879f&_e=drBi38mQ0mxywdfp4npX2-YX2_ocXfTuOk4xs1vICaHaxnrymtDVwz6eGRwAiW65uo8LCkcnEM3TXbOABK...
https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?userId=27996229&timestamp=1707116569144&noPasswordSignIn=true&authHash=9409708fe99d45262eea10b2fa8a42dd15665c0c&...
https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_cont...

245 KB
67 KB

1235ms
1235ms

Document
text/html

54.73.62.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.73.62.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-73-62-134.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

5d5a939e07d68b1a73090b4a66812ba68b1040a699b6c3c8b205e9c890aad883

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Language: nl-NL
Content-Type: text/html;charset=UTF-8
Date: Mon, 05 Feb 2024 10:49:21 GMT
P3P: CP="CAO PSA OUR"
Referrer-Policy: same-origin
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Transfer-Encoding: chunked
Vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: master-only
X-XSS-Protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Mon, 05 Feb 2024 10:49:19 GMT
Location: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Referrer-Policy: same-origin
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: master-only
X-XSS-Protection: 1; mode=block

GET
H2 200 OtAutoBlock.js Show response
cdn-ukwest.onetrust.com/consent/0da343ab-b780-42a5-8f93-ef4d5d610b1e/ 6 KB
2 KB 187ms
87ms Script
application/x-javascript 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/consent/0da343ab-b780-42a5-8f93-ef4d5d610b1e/OtAutoBlock.js

Requested by

Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cfeea310c53dd49cef2aa71a7c2bc9b165e4642a19723c415f08c5c8e0cfa9a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: gzip
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 10204
content-md5: 4tKFueATIynMfNEDRupk0g==
content-length: 1960
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 10:32:53 GMT
server: cloudflare
etag: 0x8DA84F2D60C635B
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f6be953e-701e-0066-79e6-1d96c1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 850a96140d179031-FRA

GET
H2 200 otSDKStub.js Show response
cdn-ukwest.onetrust.com/scripttemplates/ 21 KB
7 KB 164ms
64ms Script
application/javascript 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4be1addf4ee8c28eff431ef8bfbc475913c1234f6315c50047bc1eda86de71f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: dulN1EiikhiO8GlkrdtHlg==
age: 10518
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6838
x-ms-lease-status: unlocked
last-modified: Tue, 30 Jan 2024 20:47:02 GMT
server: cloudflare
etag: 0x8DC21D49CF28CFC
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: a38a568f-201e-0018-3f1a-54090e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 850a96140d169031-FRA
expires: Tue, 06 Feb 2024 10:49:21 GMT

GET
H2 200 jsmessages_nl_NL.js Show response
d1x3cbuht6sy0f.cloudfront.net/assets/js/i18n/ 18 KB
7 KB 161ms
47ms Script
application/x-javascript 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/js/i18n/jsmessages_nl_NL.js?t=1
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8793c2e024b1255458ae2560631039c9f4564dc41af0ed58aab909f277042387

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: 4Fd6uMIwW6Ck0vqKgQc424yvX1GfHt2B
content-encoding: gzip
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
date: Mon, 05 Feb 2024 09:53:19 GMT
x-amz-cf-pop: ZRH50-C1
age: 3363
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-meta-md5-hash: ba2f07695b2ab132a674a0602c967301
content-length: 6284
last-modified: Thu, 01 Feb 2024 09:56:19 GMT
server: AmazonS3
etag: "ba2f07695b2ab132a674a0602c967301"
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: max-age=3600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: hoxmQZMDA5vlzYKM9sMOccPH3X2P1gdVF3AVsJAfsefAxPJNENGMiA==
x-amz-meta-last-modified: Thu Feb 01 09:56:18 UTC 2024

GET
H2 200 be.css
d1x3cbuht6sy0f.cloudfront.net/assets/css/i18n/ 2 KB
1 KB 168ms
54ms Stylesheet
text/css 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/css/i18n/be.css
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8e163da28e94bd6324cf834921768618ccc663dd664feb1e7ec40a2a3bd58aac

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: NiiPqQzGrc0IjknClubi_HUGaSwjsBbU
content-encoding: gzip
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
date: Mon, 05 Feb 2024 06:27:20 GMT
last-modified: Wed, 12 Feb 2020 14:22:52 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 15722
etag: W/"0145f8f2be9e515065ff3436c368ed77"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: 4ngSmQ-z8vGfskUfB5sbX5m3w4qm-qZ1v_paM8Uu4pmMLHIqsE0mvA==

GET
H2 200 main-b314e670e7ae4ab6b228a0e905780188.css
d1gkiy13jtzlp.cloudfront.net/assets/ 338 KB
55 KB 266ms
147ms Stylesheet
text/css 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/main-b314e670e7ae4ab6b228a0e905780188.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

1b0adbbb380709fee064bb77ecb836587819f70e7f25ab603d70b179fc03c47b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 15:28:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 6636030
x-cache: Hit from cloudfront
content-length: 55674
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 20 Nov 2023 15:12:41 GMT
server: nginx
etag: "main-b314e670e7ae4ab6b228a0e905780188.css"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
x-amz-cf-id: nBhSpLvXRXrq7iIgdX8dLCSopkQprmFJUtaBrFOIiG3mfsPCVZ4gWw==

GET
H2 200 eur.css
d1x3cbuht6sy0f.cloudfront.net/assets/css/i18n/ 238 B
612 B 162ms
48ms Stylesheet
text/css 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/css/i18n/eur.css
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f0d6e1f670af3e26033d287319c2585f43a562b46f5a9855c26f3faaa79178e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: QdwS8jAycebiggi4L9erMbPY7a1krZ.p
date: Mon, 05 Feb 2024 06:32:31 GMT
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
last-modified: Wed, 12 Feb 2020 14:22:56 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 15843
etag: "a84c96797a2a4c88c1adabeb481e0d0b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 238
x-amz-cf-id: igcj3Q8dGv8CDrqzlrHvS6hHGOXlrmDDDlQKUSSV8H94cBtpeSGF2w==

GET
H2 200 vendorsHeader.min-24d68dd02d71c1cade6220d01f8268a8.js Show response
d1gkiy13jtzlp.cloudfront.net/assets/compiled/ 373 KB
112 KB 178ms
59ms Script
application/javascript 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/compiled/vendorsHeader.min-24d68dd02d71c1cade6220d01f8268a8.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

0f570813f50cf217270b04a64a2efac52d11d14e74688df6116667e5d62a94cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 07 Sep 2023 11:00:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 13045727
x-cache: Hit from cloudfront
content-length: 113636
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 07 Sep 2023 10:44:45 GMT
server: nginx
etag: "compiled/vendorsHeader.min-24d68dd02d71c1cade6220d01f8268a8.js"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-amz-cf-id: cYGyJZW_fVTXy7VgrbLi-RS3fyXudWQFU7PKTaBgQXD37pLK6CksCA==

GET
H2 200 jquery.ui.datepicker-be.js Show response
d1x3cbuht6sy0f.cloudfront.net/assets/js/i18n/ 918 B
1 KB 171ms
58ms Script
application/x-javascript 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/js/i18n/jquery.ui.datepicker-be.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6700222a07bb785e1bcc832bbda73f56f463991ac4d0f26fc3fef30822faca9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 03 Jan 2024 07:16:26 GMT
x-amz-version-id: null
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
last-modified: Fri, 07 Oct 2016 10:55:33 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 2863976
etag: "60b63d90f6eb6ea3334ec75d6a0831ec"
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 918
x-amz-cf-id: gYeEHAtv-owyTFw6dTBYRYuxI6s_NmFAscKIHUR15H2e5rJPlNivhA==

GET
H2 200 jquery-ui-1.8.21.custom-c09cdd7b5aa8c7d09db1bebdf85f006d.css
d1gkiy13jtzlp.cloudfront.net/assets/ui-lightness/ 21 KB
4 KB 165ms
46ms Stylesheet
text/css 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/ui-lightness/jquery-ui-1.8.21.custom-c09cdd7b5aa8c7d09db1bebdf85f006d.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

66aff367a4940439b2a9d6b74fdf195d46370a50882a7ac927031300a29ff07e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 07 Jan 2024 16:12:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 2486240
x-cache: Hit from cloudfront
content-length: 3874
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 04 Jan 2024 16:54:51 GMT
server: nginx
etag: "ui-lightness/jquery-ui-1.8.21.custom-c09cdd7b5aa8c7d09db1bebdf85f006d.css"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
x-amz-cf-id: IxI7fsZoXgW9Wl_ftKVaHckMLXGOgIx14N5zV0my9tBGG4byn-j8qw==

GET
H2 200 fancybox-51bc79d5b1751a0dc63d5630c3a01049.css
d1gkiy13jtzlp.cloudfront.net/assets/ 6 KB
2 KB 166ms
47ms Stylesheet
text/css 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/fancybox-51bc79d5b1751a0dc63d5630c3a01049.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

b63b24c84ad13bbcaecdf53136b9ae7b7062997af7bf725b30681706487a8fd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:24:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 5963118
x-cache: Hit from cloudfront
content-length: 1759
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 28 Nov 2023 10:13:27 GMT
server: nginx
etag: "fancybox-51bc79d5b1751a0dc63d5630c3a01049.css"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
x-amz-cf-id: X8UdUYGCEc34MZDBA4U0yR-UNLsB9vLpcxHQ7wQnW-nnunCy8YLU0g==

GET
H2 200 common.min-2d4e921dbabac8c20e8927b1bdd8ee81.js Show response
d1gkiy13jtzlp.cloudfront.net/assets/compiled/ 26 KB
9 KB 170ms
51ms Script
application/javascript 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/compiled/common.min-2d4e921dbabac8c20e8927b1bdd8ee81.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

69ed29337ff755bfe7e578c418298fba669383ba6b404879579302a96e63a7cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 15:57:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 2141524
x-cache: Hit from cloudfront
content-length: 8406
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 11 Jan 2024 15:45:04 GMT
server: nginx
etag: "compiled/common.min-2d4e921dbabac8c20e8927b1bdd8ee81.js"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-amz-cf-id: WzE7aIIDbsFhauUOLCSooC-BZdIy68O75-r8w5jmtYFHyFM-z-Pfeg==

GET
H2 200 skyscraper-positioning-e05a232ae2ba04c4d5df623c5e327568.js Show response
d1gkiy13jtzlp.cloudfront.net/assets/ 839 B
1011 B 278ms
159ms Script
application/javascript 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/skyscraper-positioning-e05a232ae2ba04c4d5df623c5e327568.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

d635b207ad106de4d149775b4f2def4e1ca5c42d23f18983645a9f4fbc58e232

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 01:23:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 1761974
x-cache: Hit from cloudfront
content-length: 430
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 15 Jan 2024 14:05:45 GMT
server: nginx
etag: "skyscraper-positioning-e05a232ae2ba04c4d5df623c5e327568.js"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-amz-cf-id: YC4qFdsy-kuPLvj-EUyTJxXpKkJ076OSRcO7v65F8CicMGIJIIR_bQ==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 98 KB
29 KB 184ms
82ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03169b1ffe6dbba507a6c0a696dd7157d83149c92f9df45550f7e4424dc842ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29464
x-xss-protection: 0
server: cafe
etag: 12 / 19758 / m202401290101 / config-hash: 8558731290873694684
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 05 Feb 2024 10:49:21 GMT

GET
H2 200 spinner.gif
d1x3cbuht6sy0f.cloudfront.net/assets/images/common/ 6 KB
6 KB 163ms
50ms Image
image/gif 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/images/common/spinner.gif
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e88e6ff41cc33fad7f855856b89723693705aff0611642b164e43b78dbcc93f4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 30 Oct 2023 02:51:22 GMT
x-amz-version-id: null
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
last-modified: Fri, 07 Oct 2016 10:52:23 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 8495880
etag: "c7fb14e8c25e80f02201bcfa2c4726f7"
x-cache: Hit from cloudfront
content-type: image/gif
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5870
x-amz-cf-id: tIFAKfUWCXEfhUgRtxmMa47cnlwToR3VE3A-hN-jDbikAWVAiDLsnw==

GET
H2 200 fullLogin-18d681866d10f41379238dcb067e4335.js Show response
d1gkiy13jtzlp.cloudfront.net/assets/common/ 3 KB
2 KB 117ms
111ms Script
application/javascript 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/common/fullLogin-18d681866d10f41379238dcb067e4335.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

849b8f7edd8e7ffe61b451b0ef2aabbf935c417c22477f0760818c23a41f2ab7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 13:09:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 30058786
x-cache: Hit from cloudfront
content-length: 1377
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 22 Feb 2023 13:00:19 GMT
server: nginx
etag: "common/fullLogin-18d681866d10f41379238dcb067e4335.js"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-amz-cf-id: Zxpet-WgkvgzVerRH__RParGsyy06R4kZOLDpMqSb5PsI4hG6DLkgQ==

GET
H2 200 showHidePassword-6905801722953436f74825a86338c7b8.js Show response
d1gkiy13jtzlp.cloudfront.net/assets/common/ 406 B
862 B 115ms
111ms Script
application/javascript 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/common/showHidePassword-6905801722953436f74825a86338c7b8.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

b53e3612ec0c13865c23840345d1dc4d4d6ed079f1ae1a2d99b1a69800ac5d8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 07 Jan 2024 06:39:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 2520616
x-cache: Hit from cloudfront
content-length: 280
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 04 Jan 2024 16:54:51 GMT
server: nginx
etag: "common/showHidePassword-6905801722953436f74825a86338c7b8.js"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-amz-cf-id: y8N_pk0gGF9R8-82QVi2CCTaYku9zsUx8oo9AhGNbRkEwCQcdzUS3g==

GET
H2 200 autocomplete-0.4.1.js Show response
d1x3cbuht6sy0f.cloudfront.net/assets/js/search/ 26 KB
9 KB 49ms
49ms Script
application/javascript 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/js/search/autocomplete-0.4.1.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7198676c853129c2e028be8f977b5002caf99147b2e8e1f439827625bfcc17e1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: Ej2lGzyg2c6uPeJfYZSHTdabHqLV59R1
content-encoding: gzip
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
date: Mon, 05 Feb 2024 02:59:37 GMT
last-modified: Tue, 15 Feb 2022 15:16:55 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 28185
etag: W/"7a11662904b3f546d146c36096d9fa0c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: HW0YbElZ6kGvUpdApmQF95VZd4JqEBYd9aY_J31Z5gR5GKymhSG0mA==

GET
H2 200 89c49b77_56f4_4eab_a64e_2df37865fc97.jpg
secretescapes-web.imgix.net/hotels/546/ 29 KB
29 KB 236ms
127ms Image
image/avif 2a04:4e42:8d::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secretescapes-web.imgix.net/hotels/546/89c49b77_56f4_4eab_a64e_2df37865fc97.jpg?w=640&h=459&fit=crop&crop=entropy&auto=format,compress

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8d::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

958e8cedb86e865e70954332cc3993dbf6f2738cd75eed224b5b69cbb2caf4fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
age: 1016382
x-cache: HIT, HIT
x-imgix-id: 5259ca2e3a7683cb1eba3b46a418080b4f8f4c4d
cross-origin-resource-policy: cross-origin
content-length: 29301
x-served-by: cache-sjc1000132-SJC, cache-fra-eddf8230117-FRA
x-imgix-render-farm: 01.132136
last-modified: Wed, 24 Jan 2024 16:29:39 GMT
server: imgix
vary: Accept, User-Agent
content-type: image/avif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 a0524f99_92c9_489b_a847_cc3547c9906b.jpg
secretescapes-web.imgix.net/hotels/546/ 60 KB
61 KB 147ms
42ms Image
image/avif 2a04:4e42:8d::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secretescapes-web.imgix.net/hotels/546/a0524f99_92c9_489b_a847_cc3547c9906b.jpg?w=640&h=459&fit=crop&crop=entropy&auto=format,compress

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8d::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

96a7bad920954f1a56feb502bbeea1fca29c5918d4a7d371f541ceb0c5a9c956

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
age: 2065791
x-cache: HIT, HIT
x-imgix-id: 4f9209a365cc87cab688ae33825c0f339b0275df
cross-origin-resource-policy: cross-origin
content-length: 61833
x-served-by: cache-sjc1000136-SJC, cache-fra-eddf8230117-FRA
x-imgix-render-farm: 01.140328
last-modified: Fri, 12 Jan 2024 12:59:30 GMT
server: imgix
vary: Accept, User-Agent
content-type: image/avif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 feae18d0_6ea0_4397_948f_babb3a9c48fd.jpg
secretescapes-web.imgix.net/hotels/546/ 29 KB
29 KB 153ms
49ms Image
image/avif 2a04:4e42:8d::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secretescapes-web.imgix.net/hotels/546/feae18d0_6ea0_4397_948f_babb3a9c48fd.jpg?w=640&h=459&fit=crop&crop=entropy&auto=format,compress

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8d::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

cfb0c6459c4eac17a86b8f68be81c2cab2a9616b30769435725df0ba60bcbe68

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
age: 1224070
x-cache: HIT, HIT
x-imgix-id: cc71b9241909130b75eae562d19d92c9451e1d97
cross-origin-resource-policy: cross-origin
content-length: 29194
x-served-by: cache-sjc1000100-SJC, cache-fra-eddf8230117-FRA
x-imgix-render-farm: 02.131624
last-modified: Mon, 22 Jan 2024 06:48:11 GMT
server: Google Frontend
vary: Accept, User-Agent
content-type: image/avif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 8efaf324_dff6_4ffb_bb22_4625b7515072.jpg
secretescapes-web.imgix.net/hotels/546/ 16 KB
16 KB 241ms
137ms Image
image/avif 2a04:4e42:8d::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secretescapes-web.imgix.net/hotels/546/8efaf324_dff6_4ffb_bb22_4625b7515072.jpg?w=640&h=459&fit=crop&crop=entropy&auto=format,compress

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8d::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

6031b1d51dca8d2985b61d2117e6f8f66e89cc645b6e658748698baf842f3102

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
age: 2766781
x-cache: HIT, HIT
x-imgix-id: 73e10a5fbec587a0c5080616d84a97077d887dc2
cross-origin-resource-policy: cross-origin
content-length: 16546
x-served-by: cache-sjc1000093-SJC, cache-fra-eddf8230117-FRA
x-imgix-render-farm: 01.140328
last-modified: Thu, 04 Jan 2024 10:16:19 GMT
server: imgix
vary: Accept, User-Agent
content-type: image/avif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 54890581_e8e5_4a1e_ba68_ea16a5a82f17.jpg
secretescapes-web.imgix.net/hotels/546/ 28 KB
29 KB 153ms
50ms Image
image/avif 2a04:4e42:8d::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secretescapes-web.imgix.net/hotels/546/54890581_e8e5_4a1e_ba68_ea16a5a82f17.jpg?w=640&h=459&fit=crop&crop=entropy&auto=format,compress

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8d::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

4399506a0eaed1b15507f0815e5a2cbc2e5f1b3972d2a2239104dfceb3add800

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
age: 2764178
x-cache: HIT, HIT
x-imgix-id: 852f120a09496e5e1f361381a341eb927d2f1bb3
cross-origin-resource-policy: cross-origin
content-length: 29062
x-served-by: cache-sjc10046-SJC, cache-fra-eddf8230117-FRA
x-imgix-render-farm: 01.140328
last-modified: Thu, 04 Jan 2024 10:59:43 GMT
server: imgix
vary: Accept, User-Agent
content-type: image/avif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 staticmap
maps.googleapis.com/maps/api/ 108 KB
109 KB 319ms
228ms Image
image/png 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://maps.googleapis.com/maps/api/staticmap?size=640x320&zoom=15&maptype=roadmap&markers=scale:2|icon:http://d1x3cbuht6sy0f.cloudfront.net/assets/images/mobile/map/marker3.png|52.51595515403055,13.388511719949312&scale=2&style=feature:poi|visibility:off&key=AIzaSyA--kiScHQmztfG82zIl0S4oEqrwEMl0hk&signature=0uWEsJDsjfLOp7xalIMhcfuaY9Y=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

e9c5d027bf81d8cd06cbd8b21ff70f91addee2329c0e70c3ce2d47ccd8665fe3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
server: scaffolding on HTTPServer2
vary: Accept-Language
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
server-timing: gfet4t7; dur=187
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110825
x-xss-protection: 0
expires: Tue, 06 Feb 2024 10:49:21 GMT

GET
H/1.1 200
OK meta-review.umd.js Show response
cdn.trustyou.com/v2/hotel/widget-ui/meta-review/ 165 KB
65 KB 129ms
43ms Script
application/javascript 88.198.114.6
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.trustyou.com/v2/hotel/widget-ui/meta-review/meta-review.umd.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 88.198.114.6 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: app8.trustyou.com
Software: Apache /
Resource Hash: e1272c01e01a319c147d2ea1748013b09c189c398fd590034d3f1025fa805371

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 10:49:21 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Apr 2023 14:32:20 GMT
Server: Apache
ETag: "29439-5f8abc6b11708-gzip"
Vary: Accept-Encoding,User-Agent,Origin
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Expires: Wed, 06 Mar 2024 10:49:21 GMT

GET
H/1.1 200
OK trustscore.umd.js Show response
cdn.trustyou.com/v2/hotel/widget-ui/trustscore/ 100 KB
40 KB 128ms
42ms Script
application/javascript 88.198.114.6
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.trustyou.com/v2/hotel/widget-ui/trustscore/trustscore.umd.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 88.198.114.6 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: app8.trustyou.com
Software: Apache /
Resource Hash: a673b1daa1a99ccbfdeac10136efa4ed9c5cbc1531db9b84c74597365f76b00c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 10:49:21 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Apr 2023 14:32:43 GMT
Server: Apache
ETag: "191f4-5f8abc8174dbb-gzip"
Vary: Accept-Encoding,User-Agent,Origin
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 40708
Expires: Wed, 06 Mar 2024 10:49:21 GMT

GET
H2 200 runtime.e7b8692f.js.gz Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 5 KB
3 KB 375ms
215ms Script
text/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/runtime.e7b8692f.js.gz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

bc040dea8e1070e1f9dfe619974d9d805b7cc56121fc3602fda6abc9ebe8c1d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:10:52 GMT
content-encoding: gzip
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
x-amz-version-id: null
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 2809
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:13 GMT
server: AmazonS3
etag: "cf485bddbe001951b6076840a0b00c11"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: text/javascript
access-control-allow-origin: *
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
accept-ranges: bytes
x-amz-cf-id: aAAdjxIz-6fivkMZwMNjqvCaqpKv8djuc0-kwQ-XMS0YqU0_kK3Uqw==

GET
H2 200 vendor.2f3e04b0.js.gz Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 2 MB
521 KB 262ms
102ms Script
text/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

4122aee7c57ab0686985ab920ad3c60b994eadf8e3d12602faa5bb86976a9cf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:10:52 GMT
content-encoding: gzip
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
x-amz-version-id: null
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 532576
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:13 GMT
server: AmazonS3
etag: "27f5552ced42d332ac73e5b5c7e55bc1"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: text/javascript
access-control-allow-origin: *
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
accept-ranges: bytes
x-amz-cf-id: jO-9b3jXHg-KcIvwLT6MvXBDoOcfP0r0fJblkWaROAAe0a6xSJRiZg==

GET
H2 200 main.d5b168af.js.gz Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 36 KB
12 KB 219ms
59ms Script
text/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/main.d5b168af.js.gz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

3838c6daf9173b1ede10b6a01b6bc46ae2d42a33e5f8b1ab3faa9412245d27c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:10:52 GMT
content-encoding: gzip
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
x-amz-version-id: null
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 11819
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:13 GMT
server: AmazonS3
etag: "24e901c2ba0a89801be68de705c6d2de"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: text/javascript
access-control-allow-origin: *
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
accept-ranges: bytes
x-amz-cf-id: Ce9r_WD3Fu-oHGrWrN2gq5KHJsdTPU5Qox1Nb-XMiudfAf1On0Vuqw==

GET
H2 200 SalesPage.0eb45a27.js.gz Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 58 KB
19 KB 227ms
67ms Script
text/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/SalesPage.0eb45a27.js.gz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

6a40be594a03b95b44fbff08cbcc9113fe1dabf9ff2e010d5c78fcc6385f06c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:10:52 GMT
content-encoding: gzip
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
x-amz-version-id: null
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 18460
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:13 GMT
server: AmazonS3
etag: "4ceb14bd80011befebff2fbdfcd64c21"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: text/javascript
access-control-allow-origin: *
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
accept-ranges: bytes
x-amz-cf-id: DpXYfcA-Wh08KT81AJ-yetrxLj_KAQBDmAoapq7PDpe_MfCoOJUTDg==

GET
H2 200 svgxuse.min.js Show response
d1x3cbuht6sy0f.cloudfront.net/icons/ 3 KB
2 KB 48ms
46ms Script
application/javascript 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/icons/svgxuse.min.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b42c7aca00c7adb75fae817fe4b77b44c4fe3a7bbad7b1d03df52dcb080ba528

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 01:15:34 GMT
content-encoding: gzip
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
x-amz-version-id: 8cNdwE0HnXwZnD5eM5COZaGkxY_EoUb1
last-modified: Thu, 14 Jun 2018 12:03:26 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 11007228
etag: W/"358ff853a39c2b43946c56d5c7ef5064"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=31536000
x-amz-cf-id: rd7GDdpFHopqQYx3mKEHW6nElLmFFj9bESF7TLAOaeoifqU5xujFQg==

GET
H/1.1 200
OK esw.min.js Show response
service.force.com/embeddedservice/5.0/ 30 KB
9 KB 209ms
49ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/esw.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

ef4dcc4dab4d780f44939c455d4720cab662b2f5fabc36ebc33a21f4cdbecd4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 09:11:00 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Tue, 04 Jul 2023 00:26:54 GMT
Content-Encoding: gzip
Age: 5901
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 8455
Expires: Tue, 06 Feb 2024 09:11:00 GMT

GET
H2 200 facebook.min-59733e43f58a71067d4d1d7320c47932.js Show response
d1gkiy13jtzlp.cloudfront.net/assets/compiled/ 54 KB
19 KB 52ms
50ms Script
application/javascript 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/compiled/facebook.min-59733e43f58a71067d4d1d7320c47932.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

89b2d81727b4925c50544ce1e4cda18f39f79953e26b81f5360b71929cbd481f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 13:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 939173
x-cache: Hit from cloudfront
content-length: 19235
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 25 Jan 2024 13:45:23 GMT
server: nginx
etag: "compiled/facebook.min-59733e43f58a71067d4d1d7320c47932.js"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-amz-cf-id: D4KM3IKOqMSXomf6uPbPigdNhAtFN84Z2-E8-HgU7R1tpH0SMTOdFQ==

GET
H2 200 footer.min-66f0a7d7fe91bb51df8a9d92cf94d127.js Show response
d1gkiy13jtzlp.cloudfront.net/assets/compiled/ 37 KB
13 KB 56ms
55ms Script
application/javascript 18.165.185.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1gkiy13jtzlp.cloudfront.net/assets/compiled/footer.min-66f0a7d7fe91bb51df8a9d92cf94d127.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.185.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-185-71.zrh55.r.cloudfront.net

Software

nginx /

Resource Hash

99b4172bdc5499ead6638e7e90e52f88fa905993c10712cfba6c021d7215c1f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 09 Feb 2023 15:11:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 b03c46754456cd1729ff37c2faafd4ec.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: ZRH55-P1
age: 31174694
x-cache: Hit from cloudfront
content-length: 12948
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 09 Feb 2023 15:04:09 GMT
server: nginx
etag: "compiled/footer.min-66f0a7d7fe91bb51df8a9d92cf94d127.js"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-amz-cf-id: 17I4APuaVm9wZI8frZCxIjlSTRMMWwimCzsZe-jnyJ1FQh5Nb5zZyA==

GET
H2 200 0da343ab-b780-42a5-8f93-ef4d5d610b1e.json Show response
cdn-ukwest.onetrust.com/consent/0da343ab-b780-42a5-8f93-ef4d5d610b1e/ 3 KB
2 KB 162ms
78ms XHR
application/x-javascript 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/consent/0da343ab-b780-42a5-8f93-ef4d5d610b1e/0da343ab-b780-42a5-8f93-ef4d5d610b1e.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

694b5ce9fa562ced9521e4abd8229b7924c73bbf22290feacecc92ee970c1e9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: gzip
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 79900
content-md5: dGhDguEfm8FQDj2dS/P6cQ==
content-length: 1481
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 10:32:52 GMT
server: cloudflare
etag: 0x8DA84F2D54BBB7F
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: cf0b9b09-d01e-0060-6797-2261b9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 850a96151f621e4f-FRA

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 132ms
42ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 05 Feb 2024 09:48:09 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3672
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 05 Feb 2024 11:48:09 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 357 KB
108 KB 150ms
61ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TRQQ3V

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

00622a3f6b799932f9235d9f517f1dfc8ee1d6a8197413ab3fe80c41b41888df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110598
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 05 Feb 2024 10:49:21 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 548 KB
133 KB 98ms
50ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TDMX64K

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d087ba53e72b1c104402c111bd3f85fe16882ea79bfbff7cfcf17e3acfe94340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135734
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 05 Feb 2024 10:49:21 GMT

GET
H2 200 branch-2.71.0.min.js Show response
cdn.branch.io/ 72 KB
22 KB 142ms
47ms Script
text/javascript 108.138.26.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-2.71.0.min.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.26.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-26-116.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 83cad37f70113f7b8bbb98c2ef8ee949f9a611e402e55ee826aef65130f2ef77

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: aAVxDOAB3ohiDVGoh5zv9KPwyTWvESLe
content-encoding: gzip
via: 1.1 6be461c5a9399007c1540eee90371674.cloudfront.net (CloudFront)
date: Mon, 05 Feb 2024 10:46:21 GMT
last-modified: Thu, 17 Nov 2022 20:07:46 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P7
age: 180
etag: "2a6320386437cc44ae1713f25f6ea30b"
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=300
content-length: 22048
x-amz-cf-id: Sxmh1bNQNTfEz2kZgbTPbTt4_hldBCCwath3NasokRjn7gAqHpHLrg==

GET
H2 200 se-logo-light.svg
d1x3cbuht6sy0f.cloudfront.net/assets/images/logos/ 12 KB
5 KB 50ms
50ms Image
image/svg+xml 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/images/logos/se-logo-light.svg
Requested by: Host: d1gkiy13jtzlp.cloudfront.net
URL: https://d1gkiy13jtzlp.cloudfront.net/assets/main-b314e670e7ae4ab6b228a0e905780188.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 005a2e5a787ce93ce8cba94fe570fb08ad6cd346e3994c5231c8ff768bb449db

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 23:13:22 GMT
content-encoding: gzip
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
x-amz-version-id: F8ld5WefuqRyfWnbjBZ.VTX3a1feL66M
last-modified: Mon, 22 Oct 2018 13:52:03 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 9459360
etag: W/"2099ead13bdb6a36f5cd1767d3125ade"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31536000
x-amz-cf-id: aTZuXYQFI2h14d-M8Lb5BhzR1Oq77dTzslZEhtol-DxRXYo9DC_y3g==

GET
H2 200 be.svg
d1x3cbuht6sy0f.cloudfront.net/assets/images/flags/ 351 B
730 B 51ms
50ms Image
image/svg+xml 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/images/flags/be.svg
Requested by: Host: d1gkiy13jtzlp.cloudfront.net
URL: https://d1gkiy13jtzlp.cloudfront.net/assets/main-b314e670e7ae4ab6b228a0e905780188.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 70071847d81c44d65bf760c7ae7fae26acb83c783debc143504661267b295cff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 06 Jan 2024 04:20:09 GMT
x-amz-version-id: null
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
last-modified: Fri, 06 Jan 2017 15:51:26 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 2615353
etag: "0ccada20152cb89c68bd8cbf74270334"
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 351
x-amz-cf-id: 5-7juPJLkKTNS0vqVd00zzvu0K6xxbXahDxSjjfzv3cZhpw0vVEBpQ==

GET
H2 200 source-serif-pro-v7-latin-regular.woff2
d1x3cbuht6sy0f.cloudfront.net/assets/fonts/ 19 KB
19 KB 201ms
106ms Font
binary/octet-stream 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/fonts/source-serif-pro-v7-latin-regular.woff2
Requested by: Host: d1gkiy13jtzlp.cloudfront.net
URL: https://d1gkiy13jtzlp.cloudfront.net/assets/main-b314e670e7ae4ab6b228a0e905780188.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 362502a1a510ab4f63553dd121e8294072dd692b19115b486ea490ffd9692e15

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 13:42:45 GMT
x-amz-version-id: MAIwi9a1PnFF8BaVGwCre50f.ueZyJOm
via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
age: 421596
x-cache: Hit from cloudfront
content-length: 19128
last-modified: Tue, 17 Mar 2020 12:49:12 GMT
server: AmazonS3
etag: "7421247b709e12de75e7b2b6de88dd19"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
vary: Origin
accept-ranges: bytes
x-amz-cf-id: 8BggBzLPT5k-OCxreyBSEZ2P-1-i-wqKMxrUb9FaP5EFFl9aoEUBnA==

GET
H2 200 source-sans-pro-v13-latin-700.woff2
d1x3cbuht6sy0f.cloudfront.net/assets/fonts/ 15 KB
16 KB 150ms
55ms Font
binary/octet-stream 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/fonts/source-sans-pro-v13-latin-700.woff2
Requested by: Host: d1gkiy13jtzlp.cloudfront.net
URL: https://d1gkiy13jtzlp.cloudfront.net/assets/main-b314e670e7ae4ab6b228a0e905780188.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 08:35:29 GMT
x-amz-version-id: gAV3mLj7iEcsNFkJra1cLltFG3SoLWrT
via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
age: 1822433
x-cache: Hit from cloudfront
content-length: 15764
last-modified: Tue, 17 Mar 2020 12:49:12 GMT
server: AmazonS3
etag: "1a4bcb3ec9c508d478d4dbf6b56f6208"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
vary: Origin
accept-ranges: bytes
x-amz-cf-id: PMyE1SifediehfJi__2XYzVFxjizblsF9T1X6knqDwssqABqdmio-Q==

GET
H2 200 source-sans-pro-v13-latin-regular.woff2
d1x3cbuht6sy0f.cloudfront.net/assets/fonts/ 16 KB
16 KB 157ms
63ms Font
binary/octet-stream 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/fonts/source-sans-pro-v13-latin-regular.woff2
Requested by: Host: d1gkiy13jtzlp.cloudfront.net
URL: https://d1gkiy13jtzlp.cloudfront.net/assets/main-b314e670e7ae4ab6b228a0e905780188.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 10:18:37 GMT
x-amz-version-id: qEa5D8RI249kWtGL9wDOZrsXB2hKNSYh
via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
age: 2161845
x-cache: Hit from cloudfront
content-length: 16112
last-modified: Tue, 17 Mar 2020 12:49:13 GMT
server: AmazonS3
etag: "899c8f78ce650d4009d42443897aa723"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
vary: Origin
accept-ranges: bytes
x-amz-cf-id: QeEOPisR8ph2jAOEY8K5GjXyUVKkc7awP9R5wPjZFJaAoFOtUCnsDg==

GET
H2 200 fontawesome-webfont.woff
netdna.bootstrapcdn.com/font-awesome/4.1.0/fonts/ 82 KB
82 KB 146ms
51ms Font
font/woff 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/4.1.0/fonts/fontawesome-webfont.woff?v=4.1.0

Requested by

Host: d1gkiy13jtzlp.cloudfront.net
URL: https://d1gkiy13jtzlp.cloudfront.net/assets/main-b314e670e7ae4ab6b228a0e905780188.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66db52b456efe7e29cec11fa09421d03cb09e37ed1b567307ec0444fd605ce31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 860
age: 997118
cdn-cachedat: 08/25/2022 04:48:59
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 83760
last-modified: Mon, 25 Jan 2021 22:04:53 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
server: cloudflare
etag: "fdf491ce5ff5b2da02708cd0e9864719"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: bdfba6284be72328ac93552fe6a71545
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 850a9615e8ec2c46-FRA
cdn-requestpullsuccess: True

GET
H2 200 source-serif-pro-v7-latin-700.woff2
d1x3cbuht6sy0f.cloudfront.net/assets/fonts/ 18 KB
19 KB 143ms
97ms Font
binary/octet-stream 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/fonts/source-serif-pro-v7-latin-700.woff2
Requested by: Host: d1gkiy13jtzlp.cloudfront.net
URL: https://d1gkiy13jtzlp.cloudfront.net/assets/main-b314e670e7ae4ab6b228a0e905780188.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e4ea46fe174609ff5f5460eaebd4e1eb98763b1cda636af69238922be0f51d7a

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:57:48 GMT
x-amz-version-id: EX05lrGxSBgUN2pvrpWUCo6eWVhy15p1
via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
age: 1558294
x-cache: Hit from cloudfront
content-length: 18588
last-modified: Tue, 17 Mar 2020 12:49:11 GMT
server: AmazonS3
etag: "44fcb21ca24fef704a61a196cadf6b2e"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
vary: Origin
accept-ranges: bytes
x-amz-cf-id: GhmWywwHZi0KGtiimZfCwK0u-VBm4RMHvB9eTCqrCGXjnuw9EM6lWA==

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
214 B 69ms
59ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 850a9615b8521e4f-FRA
access-control-allow-headers: Content-Type

GET
H/1.1 200
OK seal.min.js Show response
seal.digicert.com/seals/cascade/ 8 KB
8 KB 416ms
133ms Script
text/javascript 3.19.8.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://seal.digicert.com/seals/cascade/seal.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.19.8.217 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-19-8-217.us-east-2.compute.amazonaws.com

Software

nginx /

Resource Hash

81f277888d1ee510668666fb819bcf637e488b613dac15cf78cbe9d1ac41658c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.digicert.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 10:49:21 GMT
Content-Security-Policy: frame-ancestors https://*.digicert.com
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
last-modified: Thu, 01 Feb 2024 21:21:06 GMT
Server: nginx
etag: "1e3d-6105892c7d480"
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript
x-envoy-upstream-service-time: 1
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7741
X-XSS-Protection: 1; mode=block

GET
H2 200 footer-sprite-050315.png
d1x3cbuht6sy0f.cloudfront.net/assets/images/footer/ 25 KB
25 KB 46ms
46ms Image
image/png 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/images/footer/footer-sprite-050315.png
Requested by: Host: d1x3cbuht6sy0f.cloudfront.net
URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/css/i18n/be.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e46f2b4c0e3d15094ecf98ddbeaaf622c36f87f7cd4e34c12f9ac153509dd5e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1x3cbuht6sy0f.cloudfront.net/assets/css/i18n/be.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 09 Jan 2024 01:06:04 GMT
x-amz-version-id: ulz7PfKbu.uqYf2unAZgVLTOnYy0dA3f
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
last-modified: Tue, 01 Mar 2022 15:02:19 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 2367798
etag: "d797f3e3168947e7582d0751e77bf939"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 25124
x-amz-cf-id: FM8iGaUhe5IBpM8UKnt3wRW6nFPdO2Dko_7rLAes1gpAM2qrE640oA==

GET
H2 200 security_seal.png
d1x3cbuht6sy0f.cloudfront.net/assets/images/common/ 5 KB
5 KB 49ms
49ms Image
image/png 13.224.98.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/images/common/security_seal.png
Requested by: Host: d1x3cbuht6sy0f.cloudfront.net
URL: https://d1x3cbuht6sy0f.cloudfront.net/assets/css/i18n/be.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.98.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-98-155.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3c16fc21880b56d5ae8783c46b0b271507904ff42de6f9622ea703f56ad6b44b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1x3cbuht6sy0f.cloudfront.net/assets/css/i18n/be.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:31:30 GMT
x-amz-version-id: kTsgaPs68wJNqXMsw6Mp4MagtXHBdBjL
via: 1.1 25d46f0dbca17b9a78cca036e17d8ad2.cloudfront.net (CloudFront)
last-modified: Tue, 08 Jan 2019 15:46:04 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 8349472
etag: "25173bf613a3d4223f6a173c86fa089e"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5024
x-amz-cf-id: DEWUuAECyOVVLZ5_5B7j__vfOkhY3K9cVLEDX0Av_T8MkY_bqwLaTw==

GET
H2 200 otBannerSdk.js Show response
cdn-ukwest.onetrust.com/scripttemplates/6.26.0/ 319 KB
76 KB 59ms
59ms Script
application/javascript 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/6.26.0/otBannerSdk.js

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

972688e6f6c24d2b23019a796b19f90515ba5f4ff744747c072b79fa44de3432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: fFt4+LicLBj64XIOlrs8+w==
age: 13735
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 77724
x-ms-lease-status: unlocked
last-modified: Tue, 02 Nov 2021 20:13:38 GMT
server: cloudflare
etag: 0x8D99E3D41FDB3D0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 6b0621de-a01e-006f-2a98-178c4f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 850a96161e399031-FRA
expires: Tue, 06 Feb 2024 10:49:21 GMT

GET
H/1.1 200
OK common.min.js Show response
service.force.com/embeddedservice/5.0/utils/ 5 KB
2 KB 49ms
48ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/utils/common.min.js

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/esw.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

7c273510050e27ad1e0a533b0a766c6c597575710d578a104e60d4810e173648

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Sun, 04 Feb 2024 14:12:36 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 17 Feb 2022 23:57:30 GMT
Content-Encoding: gzip
Age: 74205
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 1918
Expires: Mon, 05 Feb 2024 14:12:36 GMT

GET
H/1.1 200 19155 Show response
2bf9.secretescapes.com/t/sale/ 0
0 226ms
93ms Script
text/html 54.73.62.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://2bf9.secretescapes.com/t/sale/19155?callback=jQuery341034353930679163236_1707130161453&td=%7B%22st%22%3A%22ari%22%2C%22u%22%3A%7B%22id%22%3A%2227996229%22%7D%7D&affiliate=be&_=1707130161454
Requested by: Host: d1gkiy13jtzlp.cloudfront.net
URL: https://d1gkiy13jtzlp.cloudfront.net/assets/compiled/vendorsHeader.min-24d68dd02d71c1cade6220d01f8268a8.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.73.62.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-73-62-134.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H2 200 sdk.js Show response
connect.facebook.net/en_GB/ 3 KB
3 KB 128ms
41ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js

Requested by

Host: d1gkiy13jtzlp.cloudfront.net
URL: https://d1gkiy13jtzlp.cloudfront.net/assets/compiled/facebook.min-59733e43f58a71067d4d1d7320c47932.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d8443fb0e33c182aa1be2a92491d392c44ee46f2c1d51ab8d3648a1d25877d90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 05 Feb 2024 10:49:21 GMT
content-md5: L/7ah13bwf+5J0JRyS2weA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
x-fb-debug: guL++yMp+wPivnkfNt3sXnTGAomBcR+kVEujjm8sU+X8DZ0V2xDRcI3gB+l5YQQmiowDw7G+6hNPdEZo2Jdaqw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 5a981326f64dda0624f750e6df889aa6
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "ee7a0dcb63fd3e63b4c3023e2aed7ea9"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
x-frame-options: DENY
timing-allow-origin: *
expires: Mon, 05 Feb 2024 11:03:02 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401290101/ 436 KB
136 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401290101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

208e5d881a92d84ae1c0e296c5bafe669ec7ac8f87ede263ff5a84de441bdb55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 16:59:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64169
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139485
x-xss-protection: 0
server: cafe
etag: 9760076492862216199
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 03 Feb 2025 16:59:52 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 130 B
109 B 156ms
73ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=be.secretescapes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c96d1fb7a6223c5ed92691be302d79356e07d11f5b54f114fe6bb3f697c833d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84
x-xss-protection: 0
expires: Mon, 05 Feb 2024 10:49:21 GMT

GET
H2 200 nl.json Show response
cdn-ukwest.onetrust.com/consent/0da343ab-b780-42a5-8f93-ef4d5d610b1e/6abb1f29-b1f9-4ba0-9747-842c1f07418b/ 75 KB
18 KB 77ms
77ms Fetch
application/x-javascript 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/consent/0da343ab-b780-42a5-8f93-ef4d5d610b1e/6abb1f29-b1f9-4ba0-9747-842c1f07418b/nl.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/6.26.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5caee2da23bdc5b1c7b3858048642b3437d8450933d899f0faa98b0ff7b7cb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: gzip
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 74251
content-md5: YyndbduySQ5hrI6YBrOWdw==
content-length: 17910
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 10:33:00 GMT
server: cloudflare
etag: 0x8DA84F2DA852F3E
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 2a9fc4a3-101e-0032-40da-1c7c4b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 850a9616da3f1e4f-FRA

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
149 B 47ms
47ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1808272072&t=pageview&_s=1&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&ul=en-us&de=UTF-8&dt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAACAAI~&jid=1048720157&gjid=1012987602&cid=1548067295.1707130162&tid=UA-62655480-1&_gid=1404766081.1707130162&_r=1&_slc=1&z=146847259

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://be.secretescapes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 40ms
40ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1808272072&t=event&_s=2&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&ul=en-us&de=UTF-8&dt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=HOTEL&ea=View&el=number19155%2Cformat%20%3A%20Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn&_u=IEBAAAABAAAAACAAI~&jid=&gjid=&cid=1548067295.1707130162&tid=UA-62655480-1&_gid=1404766081.1707130162&z=1045182765

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 19:04:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 56684
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK esw.min.css
service.force.com/embeddedservice/5.0/ 9 KB
4 KB 48ms
48ms Stylesheet
text/css 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/esw.min.css

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/esw.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

721f2d2fe18f13edc2ae51c1918c1b0a2d7b668318c559310ab35fa22363fdad

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 07:50:19 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Fri, 27 Aug 2021 14:11:56 GMT
Content-Encoding: gzip
Age: 10742
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 4027
Expires: Tue, 06 Feb 2024 07:50:19 GMT

GET
H/1.1 200
OK liveagent.esw.min.js Show response
service.force.com/embeddedservice/5.0/client/ 20 KB
6 KB 66ms
48ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/client/liveagent.esw.min.js

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/esw.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

1df96aff7c1a0b4a1f03d51ec741df8d542fcf32eddee1a0295068e4a7f0017b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 09:18:45 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Wed, 17 Aug 2022 20:11:18 GMT
Content-Encoding: gzip
Age: 5436
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 5913
Expires: Tue, 06 Feb 2024 09:18:45 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
351 B 153ms
51ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-62655480-1&cid=1548067295.1707130162&jid=1048720157&gjid=1012987602&_gid=1404766081.1707130162&_u=IEBAAAAAAAAAACAAI~&z=1682711757

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://be.secretescapes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 otCenterRounded.json Show response
cdn-ukwest.onetrust.com/scripttemplates/6.26.0/assets/ 9 KB
3 KB 55ms
54ms Fetch
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/6.26.0/assets/otCenterRounded.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/6.26.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b26a37736a1c5a3e268b492a0b89a278c88208bdf6ea88543c0720c0317854c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: Ies7VXL5Lz4YnYLz8UJcDQ==
age: 74251
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2584
x-ms-lease-status: unlocked
last-modified: Tue, 02 Nov 2021 20:13:26 GMT
server: cloudflare
etag: 0x8D99E3D3A6E4EA9
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 995359c5-101e-001b-6adc-1c0a09000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 850a9617bbb01e4f-FRA
expires: Tue, 06 Feb 2024 10:49:21 GMT

GET
H2 200 otPcCenter.json Show response
cdn-ukwest.onetrust.com/scripttemplates/6.26.0/assets/v2/ 47 KB
11 KB 65ms
65ms Fetch
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/6.26.0/assets/v2/otPcCenter.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/6.26.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e4f02e9d367192c2c79c674f41b7eae83bcfe93c4e6fcfc5e7d1e34cfa2b7d00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Feb 2024 10:49:21 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: Fgv6iMSEkKBzUyiMHYw6Yg==
age: 64223
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 11581
x-ms-lease-status: unlocked
last-modified: Tue, 02 Nov 2021 20:13:26 GMT
server: cloudflare
etag: 0x8D99E3D3ACC4525
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: e423bf98-501e-0017-49e3-26e4f8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 850a9617bbb31e4f-FRA
expires: Tue, 06 Feb 2024 10:49:21 GMT

GET
H2 200 otCommonStyles.css Show response
cdn-ukwest.onetrust.com/scripttemplates/6.26.0/assets/ 20 KB
4 KB 58ms
58ms Fetch
text/css 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/6.26.0/assets/otCommonStyles.css

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/6.26.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 05 Feb 2024 10:49:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
content-md5: Ye6OeZcNyuFoWog7CYs00A==
age: 64223
x-ms-lease-status: unlocked
last-modified: Tue, 02 Nov 2021 20:13:51 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: bef10c9d-401e-0021-2b98-1749aa000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
cf-ray: 850a9617bbb41e4f-FRA
expires: Tue, 06 Feb 2024 10:49:21 GMT

GET
H2 200 _r Show response
app.link/ 91 B
639 B 308ms
197ms Script
text/javascript 2600:9000:25a2:de00:19:9934:6a80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.71.0&branch_key=key_live_agJxFbMNEMMLAiDXWzxvNmbjAvnyl7Dv&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-2.71.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:de00:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

openresty /

Resource Hash

851c91a5015b2ccdaf00a43b728393a5f866aa523ce40b048a394e03f188cb65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 9defe0d67603d45217a1199d0f877384.cloudfront.net (CloudFront)
server: openresty
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
x-amz-cf-pop: ZRH55-P1
etag: W/"5b-l6STRLv+TXHROfkl8RmpBLKNAaw"
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
content-length: 91
x-amz-cf-id: A1z8rhbZRNOFAD_JOFkYNmo2QtSTm1b6VGEjwO1DEOg71JihwrNccw==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 51ms
51ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-62655480-1&cid=1548067295.1707130162&jid=999429485&uid=27996229&gjid=288652637&_gid=1404766081.1707130162&_u=aGDAgAABAAAAAGAAI~&z=1652393105

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://be.secretescapes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 3 B
23 B 47ms
46ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=1808272072&t=pageview&_s=1&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&ul=en-us&de=UTF-8&dt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgEABAAAAAGAAI~&jid=1645254701&gjid=263595097&cid=1548067295.1707130162&uid=27996229&tid=UA-62655480-3&_gid=1404766081.1707130162&_slc=1&gtm=45He41v0n71TRQQ3Vv71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd1=27996229&cd3=be&cd4=text_top_hotelgeheim&cd5=A19155&cd6=HOTEL&cd7=c6d0e6ea3a21ba32eed5f2445dd792152558f72ab33e1a0973dca7f8553ee216&cd8=EMAIL_SEMI_LOGIN&cd10=HOTEL&cd12=Berlin&cd13=Europe&cd14=Germany&cd15=Berlin&cd16=932&cd17=2016-03-19&cd20=ALL&cd22=HOTEL&cd76=Secret%20Escapes%20Provider&z=383029960

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://be.secretescapes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 53ms
49ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-62655480-3&cid=1548067295.1707130162&jid=1645254701&uid=27996229&gjid=263595097&_gid=1404766081.1707130162&_u=aGDAgEABAAAAAGAAI~&z=1769867529

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 05 Feb 2024 10:49:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://be.secretescapes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/835782347/ 3 KB
2 KB 190ms
80ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/835782347/?random=1707130161943&cv=11&fst=1707130161943&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=rSVlCK_Yj3UQy43EjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TRQQ3V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

539d31be34476b9a223e54e1387a469269c96b8506ab42a5eecb9055a08e5e84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1895
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/835771806/ 3 KB
2 KB 186ms
82ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/835771806/?random=1707130161948&cv=11&fst=1707130161948&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=Zo3aCIPjp3UQnrvDjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TRQQ3V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

fc19a08416b2f45f777d461007a538b3f14f1fbf9032933efd38f8e2eba0fc13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1906
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 165ms
65ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TRQQ3V

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Mon, 05 Feb 2024 10:49:21 GMT
last-modified: Fri, 10 Nov 2023 20:09:55 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EE244240866F414BA519E0A413AA0A13 Ref B: FRA31EDGE0607 Ref C: 2024-02-05T10:49:22Z
etag: "80abcdf1114da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13175

GET
H/1.1

200
OK

am.js Show response
www.yceml.net/am_gen/7842175/include/allCj/generate/onLoad/
Redirect Chain

https://www.anrdoezrs.net/am/7842175/include/allCj/generate/onLoad/am.js
https://www.yceml.net/am_gen/7842175/include/allCj/generate/onLoad/am.js

369 KB
126 KB

209ms
60ms

Script
text/javascript

23.212.222.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.yceml.net/am_gen/7842175/include/allCj/generate/onLoad/am.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: HTTP/1.1
Server: 23.212.222.60 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-60.deploy.static.akamaitechnologies.com
Software: Resin/4.0.66 /
Resource Hash: 3c2a0467aeca8bd143140bce67fe6032e1566f883ba0e6e88c72eb844f3f75e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 10:49:22 GMT
Content-Encoding: gzip
Server: Resin/4.0.66
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/javascript; charset=UTF-8
X-VC-HTTPS: On
Cache-Control: max-age=21497
Connection: keep-alive, Transfer-Encoding
Expires: Mon, 05 Feb 2024 16:47:39 GMT

Redirect headers

Location: https://www.yceml.net/am_gen/7842175/include/allCj/generate/onLoad/am.js
Date: Mon, 05 Feb 2024 10:49:22 GMT
X-VC-HTTPS: On
Server: Resin/4.0.66
Content-Length: 110
Content-Type: text/html; charset=utf-8

GET
H2 200 tracker.js Show response
d1l6p2sc9645hc.cloudfront.net/ 10 KB
5 KB 153ms
45ms Script
text/javascript 2600:9000:2190:3c00:f:fd8f:b000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1l6p2sc9645hc.cloudfront.net/tracker.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:3c00:f:fd8f:b000:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2f9b39d4685187f53d059fa79097782292ba1954f9e29d518adee023e86d90c1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 05:28:59 GMT
content-encoding: gzip
via: 1.1 8c175d0adc08dac3750e9201b76886e8.cloudfront.net (CloudFront)
last-modified: Tue, 28 Nov 2023 23:22:39 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
age: 19226
x-amz-server-side-encryption: AES256
etag: W/"4c428f6e61b7c494241fc820f580f70e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript; charset=UTF-8
cache-control: max-age=43200, public
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 1nkO561hjOIrl5cdnqhbWricAelpm_2Bk416EEjYxVvfreQxbTxcJA==

GET
H/1.1 200
OK tv2track.js Show response
collector-488.tvsquared.com/piwik/ 20 KB
9 KB 271ms
59ms Script
application/javascript 52.215.173.157
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-488.tvsquared.com/piwik/tv2track.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.173.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-173-157.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 10:49:22 GMT
Content-Encoding: gzip
Last-Modified: Wed, 01 Nov 2023 11:46:04 GMT
Server: nginx
ETag: "65423a7c-2133"
Content-Type: application/javascript
Cache-Control: max-age=600
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: noindex
Content-Length: 8499
Expires: Mon, 05 Feb 2024 10:59:22 GMT

GET
H2 200 lrsClFmFlrMBHD3Ec8TMi45LjA.js Show response
d1gjxkdcqpo85.cloudfront.net/ 74 KB
26 KB 135ms
45ms Script
application/javascript 2600:9000:2670:9600:9:9288:3940:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1gjxkdcqpo85.cloudfront.net/lrsClFmFlrMBHD3Ec8TMi45LjA.js
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2670:9600:9:9288:3940:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a6d75aad5c009d0bdf36d4c1d68d90e2848460fce782adb137819228842eefe0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 08 Jan 2024 06:45:53 GMT
content-encoding: gzip
via: 1.1 77e414816706879c16a3707f261f0b5a.cloudfront.net (CloudFront)
last-modified: Fri, 04 May 2018 17:32:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P9
age: 2433810
etag: "ca3734b973941d7734d9116b823f868b"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 25747
x-amz-cf-id: yvYGMs6_c3sxQyVXQ6Oy4QbUSMeSG7YKRprWyYflq38VmGC7qsebZw==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
56 KB 43ms
38ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

22cf1baba55eced80d7ebb0de51fc8961757ef581964f8e10ebc8676399eba81

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 05 Feb 2024 10:49:21 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57202
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: yOfJNclGt83cz5jpcLwY8+RuTSPbL8xNT/uZJWOs3WnYlJBHyNo7/3h/cre2j/fX3vWiou4jlex/Sx3zUgiDpg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 40ms
39ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1808272072&t=pageview&_s=1&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&ul=en-us&de=UTF-8&dt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgAABAAAAACAAI~&jid=999429485&gjid=288652637&cid=1548067295.1707130162&uid=27996229&tid=UA-62655480-1&_gid=1404766081.1707130162&gtm=45He41v0n71TRQQ3Vv71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=847283199

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 19:04:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 56684
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 42ms
41ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1808272072&t=event&ni=1&_s=1&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&ul=en-us&de=UTF-8&dt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=signup&ea=undefined&_u=aGHAgEABAAAAAGAAI~&jid=&gjid=&cid=1548067295.1707130162&uid=27996229&tid=UA-62655480-3&_gid=1404766081.1707130162&gtm=45He41v0n71TRQQ3Vv71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd1=27996229&cd3=be&cd4=text_top_hotelgeheim&cd5=A19155&cd6=HOTEL&cd7=c6d0e6ea3a21ba32eed5f2445dd792152558f72ab33e1a0973dca7f8553ee216&cd8=EMAIL_SEMI_LOGIN&cd10=HOTEL&cd12=Berlin&cd13=Europe&cd14=Germany&cd15=Berlin&cd16=932&cd17=2016-03-19&cd20=ALL&cd22=HOTEL&cd76=Secret%20Escapes%20Provider&z=862302327

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 19:04:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 56684
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/963797308/ 3 KB
2 KB 162ms
77ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/963797308/?random=1707130161973&cv=11&fst=1707130161973&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&data=travel_destid%3DA19155%3Btravel_pagetype%3Dother&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TRQQ3V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e827ccf9d252464aa5228e0c980cd971c4bddbd2d79bb4494a340cb58382f648

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1536
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/835782347/ 3 KB
2 KB 139ms
76ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/835782347/?random=1707130161978&cv=11&fst=1707130161978&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&data=travel_destid%3DA19155%3Btravel_pagetype%3Dother&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TRQQ3V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85f11d2681542bc069395bf9b6270308cebf033fefadd4639cbb0ee984ae36f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1537
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1808272072&t=event&ni=1&_s=1&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&ul=en-us&de=UTF-8&dt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=Percentage&el=Baseline&ev=1&_u=aGHAgEABAAAAAGAAI~&jid=&gjid=&cid=1548067295.1707130162&uid=27996229&tid=UA-62655480-3&_gid=1404766081.1707130162&gtm=45He41v0n71TRQQ3Vv71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd1=27996229&cd3=be&cd4=text_top_hotelgeheim&cd5=A19155&cd6=HOTEL&cd7=c6d0e6ea3a21ba32eed5f2445dd792152558f72ab33e1a0973dca7f8553ee216&cd8=EMAIL_SEMI_LOGIN&cd10=HOTEL&cd12=Berlin&cd13=Europe&cd14=Germany&cd15=Berlin&cd16=932&cd17=2016-03-19&cd20=ALL&cd22=HOTEL&cd76=Secret%20Escapes%20Provider&z=1433322473

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 19:04:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 56684
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 154ms
68ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-62655480-1&cid=1548067295.1707130162&jid=1048720157&_u=IEBAAAAAAAAAACAAI~&z=2025560896

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 152ms
66ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-62655480-1&cid=1548067295.1707130162&jid=1048720157&_u=IEBAAAAAAAAAACAAI~&z=2025560896

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 131ms
66ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-62655480-1&cid=1548067295.1707130162&jid=999429485&_u=aGDAgAABAAAAAGAAI~&z=277898952

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 129ms
64ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-62655480-1&cid=1548067295.1707130162&jid=999429485&_u=aGDAgAABAAAAAGAAI~&z=277898952

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 121ms
67ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-62655480-3&cid=1548067295.1707130162&jid=1645254701&_u=aGDAgEABAAAAAGAAI~&z=1948887333

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 120ms
63ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-62655480-3&cid=1548067295.1707130162&jid=1645254701&_u=aGDAgEABAAAAAGAAI~&z=1948887333

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 142ms
44ms Script
application/javascript 2620:116:800d:21:93ca:31d8:d86e:38f6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDMX64K
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:93ca:31d8:d86e:38f6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 45a4c240a17a4d5f925ef0e125b86d882c6ad7549028d9cbf6f4f06fd1dd897d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
content-encoding: gzip
etag: "bvEECQq4Zy6gU9J/qv1O6Q=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Mon, 12 Feb 2024 10:49:22 GMT

GET
H2 200 web_surveys.js Show response
survey.survicate.com/workspaces/84664d39e5f5898e52040198647d54cf/ 3 KB
3 KB 150ms
47ms Script
application/javascript 2400:52e0:1e00::1080:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://survey.survicate.com/workspaces/84664d39e5f5898e52040198647d54cf/web_surveys.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1080 /

Resource Hash

b4258708953843a87a8c843b678174120dc2e6f932cab6714a65607ef7cbe35c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' https://surveys-static.survicate.com; connect-src https://respondent.survicate.com 'self'; img-src https://*; font-src https://surveys-static.survicate.com https://use.typekit.net https://fonts.gstatic.com; report-to csp-endpoint-survey;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
x-amz-version-id: q3V7AjAqceQrnIFQC2z.yAlJsV3qLJ7m
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cdn-edgestorageid: 1081
content-security-policy: default-src 'self' 'unsafe-inline' https://surveys-static.survicate.com; connect-src https://respondent.survicate.com 'self'; img-src https://*; font-src https://surveys-static.survicate.com https://use.typekit.net https://fonts.gstatic.com; report-to csp-endpoint-survey;
x-amz-request-id: 5QRRJR1JD5XQVVVC
cdn-cachedat: 02/01/2024 19:20:19
cdn-pullzone: 1158558
x-amz-id-2: UTYD24c98j7WLae9/Z+wW9t3RdXbTasC7BexuNIp8aTBmKNj4RVRN9MSd00W1yXrf1g0gBfZsuw=
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 01 Feb 2024 19:20:19 GMT
server: BunnyCDN-DE1-1080
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"84809e79619f7cce93f422242814e9b7"
vary: Accept-Encoding, Accept-Encoding
report-to: { "group": "csp-endpoint-survey", "max_age": 10886400, "endpoints": [{ "url": "https://panel-api.survicate.com/_/report_csp/survey" }] }
content-type: application/javascript
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 039640c0-4b09-428d-a0ae-513ccdd44502
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: max-age=10
cdn-requestid: 9060a68f73223e7f08ca574cfa41a358
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 heap-1008163987.js Show response
cdn.heapanalytics.com/js/ 120 KB
39 KB 172ms
57ms Script
application/javascript 13.32.145.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.heapanalytics.com/js/heap-1008163987.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.145.50 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-145-50.cdg50.r.cloudfront.net

Software

nginx / Express

Resource Hash

bbfb9a0b9b17db4c1345f22ee840d0e79b683ba3af2e72fa7f32348852e9f9b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:48:05 GMT
content-encoding: br
via: 1.1 e4c24b48777e46bf299a44e5b6560a32.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
x-amz-cf-pop: CDG50-C2
age: 77
x-powered-by: Express
etag: W/"1dfd1-RPfTCyRS/XwCDOkFrvR27xwpjr8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=120
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: n-PeAaonOltOhLBvO5qfvCRt4gaBUUpy_aE7a6U89S5vxuiOskFTBA==

GET
H2 200 hotjar-5644.js Show response
static.hotjar.com/c/ 36 KB
8 KB 157ms
51ms Script
application/javascript 18.165.183.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-5644.js?sv=6

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.165.183.127 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-165-183-127.zrh55.r.cloudfront.net

Software

Resource Hash

24acee9de6bc85e44a740bad4cb8eea53625382f00a54bfa4299301e27d8a83e

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Mon, 05 Feb 2024 10:48:58 GMT
via: 1.1 a9717fb92179a05f5da85fabc586e750.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
age: 28
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/62294cec55671f6b2a7a2d169fdbac4b
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: P_EMxB4MUm416MaTI0pT0ym_DhADZECdoUe8rVa7Q2Nr91oxFgdeAw==

GET
H3 200 sdk.js Show response
connect.facebook.net/en_GB/ 297 KB
85 KB 80ms
40ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js?hash=8790f0f94f60cbdc825f471d79a6d92d

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a6396c87237142727a6c8ba8425dcbb0beeccf4a3104f48262d1fb55ae522904

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 05 Feb 2024 10:49:22 GMT
content-md5: 53wKpcy19NxU/NWW6uDY9Q==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87015
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
x-fb-debug: hjhFGY8WEzW7ZwaVjIw/jFRpnt7z0SPDHTciru2HardvnuiDtB7bnhe+ypFvdrL/6VFdipzm93rPsNt/MFhAPA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 59df2793959e56a41297f79045cb9500
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "946a2b26d6c5586cc673d17c631adaeb"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Tue, 04 Feb 2025 09:23:12 GMT

POST
H2 200 / Show response
o286415.ingest.sentry.io/api/4505029713592320/envelope/ 2 B
324 B 136ms
43ms Fetch
application/json 34.120.195.249
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://o286415.ingest.sentry.io/api/4505029713592320/envelope/?sentry_key=19a92092c86c417c969042d6e511e5bc&sentry_version=7&sentry_client=sentry.javascript.react%2F7.92.0

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.195.249 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

249.195.120.34.bc.googleusercontent.com

Software

nginx /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://be.secretescapes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
server: nginx
vary: origin,access-control-request-method,access-control-request-headers
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

GET
H2 200 898.824f72d0.js Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 12 KB
5 KB 58ms
57ms Script
application/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/898.824f72d0.js

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/runtime.e7b8692f.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

28f2f1e071c298cc73af71d94709e5fd979345e7ab434da3e9961e8ad3f914ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:10:54 GMT
x-amz-version-id: null
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:10 GMT
server: AmazonS3
etag: W/"16532738df46681a053792330508a0f0"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
x-amz-cf-id: qD-QUgFGgF6OOCSprzeeQYiLX09io_Pheh1l2M5wDe6w8R-HWk6Ebw==

GET
H2 200 OffersAvailability.1bad1d4f.js Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 12 KB
5 KB 55ms
55ms Script
application/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/OffersAvailability.1bad1d4f.js

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/runtime.e7b8692f.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

7c7905fa4092da87b39e2aa1c7d3f696ebf7e7fa804b8c3e3181db748adff895

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:10:54 GMT
x-amz-version-id: null
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2309
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:10 GMT
server: AmazonS3
etag: W/"37694272096fba7e7a542ea539f99890"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
x-amz-cf-id: YGfJ2IYJxwHNdF_VvnA2c0qUq-XKFVtxPyLkxZTvuC0ydeA46061cQ==

GET
H2 200 931.afea2d6c.js Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 1017 B
1 KB 52ms
51ms Script
application/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/931.afea2d6c.js

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/runtime.e7b8692f.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

8323bfef9e28b0e6c295cfa977198ae73a723cc5cc8d11644b7fdc3f08b9ce62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:10:57 GMT
x-amz-version-id: null
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2306
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:10 GMT
server: AmazonS3
etag: W/"30453d7fef8f577b745e18b1d99b67c0"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
x-amz-cf-id: eWV4VnLI5NojyEG46_5Jxmxqg61JYsstBbRrddY8rFC4CkCLRBFSMw==

GET
H2 200 3965.70f5b14b.js Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 1 KB
1 KB 62ms
62ms Script
application/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/3965.70f5b14b.js

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/runtime.e7b8692f.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

00b9242470bf0345e92739305b95d0ecd502bea9b2fb2b01d94f115f7aa2b231

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:12:57 GMT
x-amz-version-id: null
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2186
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:10 GMT
server: AmazonS3
etag: W/"bf3815aac4bb1f018e7ca99e7f498b10"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
x-amz-cf-id: E9TgE0r63b2WecKQKibd6jD5DSTTZ9CifuShf0ycgYuRn0gG0mp6tw==

GET
H2 200 4505.8eb86123.js Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 1 KB
1 KB 58ms
58ms Script
application/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/4505.8eb86123.js

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/runtime.e7b8692f.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

ace874eec4f30ab747a05ee3ef7a9acfbfb93c0501824bddd8e20da97fc8f601

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:15:15 GMT
x-amz-version-id: null
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2048
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:10 GMT
server: AmazonS3
etag: W/"2d37ae4188dd764e743e352345c9ffea"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
x-amz-cf-id: kceWn12-IrydQFpDbYyxQ0KMaTQF8EEfTe6tYrKXIJJnXHeB9aSzLg==

GET
H2 200 4202.b7d55a06.js Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 2 KB
2 KB 53ms
53ms Script
application/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/4202.b7d55a06.js

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/runtime.e7b8692f.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

06c4be36a5fdfe10ebe883037bfe1556508ba6840e09414c81d7d87609de5dd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:14:33 GMT
x-amz-version-id: null
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2090
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:10 GMT
server: AmazonS3
etag: W/"1bfec7a9ad3ffb67264ea5bd6dde914b"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
x-amz-cf-id: Y8inznW9hK91cWhS8XDsyLt8MDc34uQ5LevqG0sQJBE5ESLQxfQ95g==

GET
H2 200 982.38b6035a.js Show response
bullfinch.orca-production.escapes.tech/0.276.0/ 1 KB
1 KB 54ms
52ms Script
application/javascript 2600:9000:25a2:1c00:16:c2f8:3640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bullfinch.orca-production.escapes.tech/0.276.0/982.38b6035a.js

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/runtime.e7b8692f.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:1c00:16:c2f8:3640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

bea9f9f409351db609486cf6524ca1d4ac9d6ce5a4fbbb79e0482e7c44b574a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:12:57 GMT
x-amz-version-id: null
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 2177a1d449a3e8dc7269040f15d81cb0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
x-amz-cf-pop: ZRH55-P1
age: 2186
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Feb 2024 10:09:10 GMT
server: AmazonS3
etag: W/"8afe45766bc83e7abb255d6d00c61253"
access-control-max-age: 0
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options: SAMEORIGIN
x-amz-cf-id: PxDTQSUyDvJ_PHfDCgQMXqAabcfJfCm0ZPxeD0xxoFycOMwxLM6ENA==

GET
H2 200 graphql Show response
sparrow-production.escapes.tech/ 4 KB
2 KB 49ms
49ms Fetch
application/json 18.165.183.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sparrow-production.escapes.tech/graphql?operationName=Advertisements&variables=%7B%22affiliate%22%3A%22be%22%2C%22mobile%22%3Afalse%2C%22page%22%3A%22offers%22%7D&extensions=%7B%22persistedQuery%22%3A%7B%22version%22%3A1%2C%22sha256Hash%22%3A%22b9a5c3f2a76a0de3a1b15fd21e23f6800865176856a163ada794a436997423df%22%7D%7D
Requested by: Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.183.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-183-103.zrh55.r.cloudfront.net
Software: / Express
Resource Hash: 87d6787adaaa25a669cc55cff0acb5f51588a8c7482fd68192f20940117db52a

Request headers

accept: */*
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: application/json

Response headers

date: Mon, 05 Feb 2024 10:49:12 GMT
content-encoding: gzip
via: 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
age: 248
x-powered-by: Express
x-amzn-requestid: 8157661f-1095-45f8-b7c5-72fd0b28dcd9
x-cache: Hit from cloudfront
x-amz-apigw-id: Sp2EgFczDoEEmeQ=
content-length: 1013
x-amzn-trace-id: Root=1-65c09d4f-42682c0d52288ef164efa696;Parent=73bcadd278a9ecf9;Sampled=0;lineage=2859168a:0
etag: W/"11d6-kNpupQpsWlcwy3AF7Hone6GEfjc"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=480, public
x-amz-cf-id: PVtf3hWHMHgOwSjlNcZMjJwAGHt9j77yZJavvz42hHWoZlnWJgnMaA==

OPTIONS
H2 200 graphql
sparrow-production.escapes.tech/ Frame 0
0 159ms
45ms Preflight
application/json 18.165.183.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sparrow-production.escapes.tech/graphql?operationName=Advertisements&variables=%7B%22affiliate%22%3A%22be%22%2C%22mobile%22%3Afalse%2C%22page%22%3A%22offers%22%7D&extensions=%7B%22persistedQuery%22%3A%7B%22version%22%3A1%2C%22sha256Hash%22%3A%22b9a5c3f2a76a0de3a1b15fd21e23f6800865176856a163ada794a436997423df%22%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.183.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-183-103.zrh55.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://be.secretescapes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,v4-jwt-token,User-Agent
access-control-allow-methods: OPTIONS,DELETE,GET,POST
access-control-allow-origin: *
access-control-max-age: 600
age: 576
content-length: 0
content-type: application/json
date: Mon, 05 Feb 2024 10:39:46 GMT
via: 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront)
x-amz-apigw-id: SqImAFLIDoEEWlg=
x-amz-cf-id: yRa7uHnNXfUDPEGGn827f5_yC-gGr_qnyMfc3gi88VVvxV0zPPSBgg==
x-amz-cf-pop: ZRH55-P1
x-amzn-requestid: 16232190-ec37-432e-a695-4fcad5538d9a
x-cache: Hit from cloudfront

GET
H2 200 graphql Show response
sparrow-production.escapes.tech/ 26 B
558 B 117ms
117ms Fetch
application/json 18.165.183.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sparrow-production.escapes.tech/graphql?operationName=getFavourites&variables=%7B%22userId%22%3A%2227996229%22%7D&extensions=%7B%22persistedQuery%22%3A%7B%22version%22%3A1%2C%22sha256Hash%22%3A%223ef41fd36f29c76f11b279908b348011f30bf019cf43e5e84ea73a0cc744fc2e%22%7D%7D
Requested by: Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.183.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-183-103.zrh55.r.cloudfront.net
Software: / Express
Resource Hash: 8c7580a1ae7f5cfe72bb6fbaa401f4fde96b023d65607ec8019ea1f44731ef28

Request headers

accept: */*
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: application/json

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
via: 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 26
x-amz-cf-pop: ZRH55-P1
x-amzn-requestid: 86912e50-de43-4683-9b96-a58ef6119e67
x-powered-by: Express
x-cache: Miss from cloudfront
x-amz-apigw-id: SqJ_7HQSjoEEswA=
content-length: 26
etag: W/"1a-Qjt7J/sgNKFAR5pFkQTpmuPZROE"
x-amzn-trace-id: Root=1-65c0bd32-472a02674f2e219f1e7f3205;Parent=548b254959b0fc9a;Sampled=0;lineage=2859168a:0
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=10, private
x-amz-cf-id: kIJiZbnBXs1bJf2BhHgHGZ-JFlaIkj2Tu7pK1rUy8jOXQ8ND5oDO8A==

OPTIONS
H2 200 graphql
sparrow-production.escapes.tech/ Frame 0
0 158ms
45ms Preflight
application/json 18.165.183.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sparrow-production.escapes.tech/graphql?operationName=getFavourites&variables=%7B%22userId%22%3A%2227996229%22%7D&extensions=%7B%22persistedQuery%22%3A%7B%22version%22%3A1%2C%22sha256Hash%22%3A%223ef41fd36f29c76f11b279908b348011f30bf019cf43e5e84ea73a0cc744fc2e%22%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.183.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-183-103.zrh55.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://be.secretescapes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,v4-jwt-token,User-Agent
access-control-allow-methods: OPTIONS,DELETE,GET,POST
access-control-allow-origin: *
access-control-max-age: 600
age: 368
content-length: 0
content-type: application/json
date: Mon, 05 Feb 2024 10:43:14 GMT
via: 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront)
x-amz-apigw-id: SqJGaFNZjoEEWgA=
x-amz-cf-id: ClrDS4W99k6dHWwvpHYBsTv5Urj6rRAqV1ufVWnGeXqDw8uY7LgvUw==
x-amz-cf-pop: ZRH55-P1
x-amzn-requestid: 302c68ba-f38f-4fd6-9964-5489087fdb90
x-cache: Hit from cloudfront

GET
H2

200

/
www.google.de/pagead/1p-conversion/835782347/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/835782347/?random=756211951&cv=11&fst=1707130161943&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=syph...
https://www.google.com/pagead/1p-conversion/835782347/?random=756211951&cv=11&fst=1707130161943&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h...
https://www.google.de/pagead/1p-conversion/835782347/?random=756211951&cv=11&fst=1707130161943&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=...

42 B
108 B

58ms
58ms

Image
image/gif

2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/835782347/?random=756211951&cv=11&fst=1707130161943&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=rSVlCK_Yj3UQy43EjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQI&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0QkRrYmR3Ukx5SjZURm1QR01xS3dpbFgzREdPUFZ1aW1FZFRjcC1iS2l2Y2hDbTFnb0ZZTkEiEwjpnZa3g5SEAxWLzDsCHf4cBWk&is_vtc=1&ocp_id=Mr3AZem8BYuZ78EP_rmUyAY&cid=CAQSKQAvHhf_FtH7xWFVdlNGPy5fZWlRzTGTPQwrvCUo_k5oYufaDtFM7L9w&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr8lz6YupTZPqaQXkBUymeuaI7baYK-X5Qw&random=3777811249&ipr=y

Requested by

Protocol

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/835782347/?random=756211951&cv=11&fst=1707130161943&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=rSVlCK_Yj3UQy43EjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQI&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0QkRrYmR3Ukx5SjZURm1QR01xS3dpbFgzREdPUFZ1aW1FZFRjcC1iS2l2Y2hDbTFnb0ZZTkEiEwjpnZa3g5SEAxWLzDsCHf4cBWk&is_vtc=1&ocp_id=Mr3AZem8BYuZ78EP_rmUyAY&cid=CAQSKQAvHhf_FtH7xWFVdlNGPy5fZWlRzTGTPQwrvCUo_k5oYufaDtFM7L9w&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr8lz6YupTZPqaQXkBUymeuaI7baYK-X5Qw&random=3777811249&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-conversion/835771806/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/835771806/?random=1942769393&cv=11&fst=1707130161948&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=syp...
https://www.google.com/pagead/1p-conversion/835771806/?random=1942769393&cv=11&fst=1707130161948&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_...
https://www.google.de/pagead/1p-conversion/835771806/?random=1942769393&cv=11&fst=1707130161948&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h...

42 B
108 B

59ms
58ms

Image
image/gif

2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/835771806/?random=1942769393&cv=11&fst=1707130161948&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=Zo3aCIPjp3UQnrvDjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQI&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0REd4YVRSbV9RdENxeDFDNWJDSFlHUnRxbkY4alAwOHZkN29mRFJrdHZrbXpEbVlrcFVyTWciEwiXnJa3g5SEAxXR5jsCHQKXAXw&is_vtc=1&ocp_id=Mr3AZZe7BdHN78EPgq6G4Ac&cid=CAQSKQAvHhf_X7HTapSpSuqvK95DrrOMzZ2PzY4TjdyBj6_LGz1mGYW-kqz3&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr4IAOWSCza06yaU773xyBRAaXS0CJJmTTA&random=2191387264&ipr=y

Requested by

Protocol

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/835771806/?random=1942769393&cv=11&fst=1707130161948&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&label=Zo3aCIPjp3UQnrvDjgM&hn=www.googleadservices.com&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&value=0&npa=0&pscdl=noapi&auid=67609605.1707130162&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQI&pscrd=EkxDaEVJZ0t1Q3JnWVE1ZWotdUtiVWxNSDJBUklrQUZLSW82QlMwLUpMd0V4cjZFZ09GT0FzQThqNFVPR09DY21tVENYU0owVGF4ZkM1GldDaEVJZ0t1Q3JnWVFzZURXdWUzUDVOXzVBUklzQUxsSkQ0REd4YVRSbV9RdENxeDFDNWJDSFlHUnRxbkY4alAwOHZkN29mRFJrdHZrbXpEbVlrcFVyTWciEwiXnJa3g5SEAxXR5jsCHQKXAXw&is_vtc=1&ocp_id=Mr3AZZe7BdHN78EPgq6G4Ac&cid=CAQSKQAvHhf_X7HTapSpSuqvK95DrrOMzZ2PzY4TjdyBj6_LGz1mGYW-kqz3&eitems=ChAIgKuCrgYQ1M_J3drP3IQhEh0AnTytr4IAOWSCza06yaU773xyBRAaXS0CJJmTTA&random=2191387264&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/835782347/ 42 B
108 B 57ms
56ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/835782347/?random=1707130161978&cv=11&fst=1707127200000&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&npa=0&data=travel_destid%3DA19155%3Btravel_pagetype%3Dother&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_NkDKDhjvktduGlSR6xkLteN8i7gTig&random=2048217486&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/835782347/ 42 B
108 B 58ms
57ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/835782347/?random=1707130161978&cv=11&fst=1707127200000&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&npa=0&data=travel_destid%3DA19155%3Btravel_pagetype%3Dother&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_NkDKDhjvktduGlSR6xkLteN8i7gTig&random=2048217486&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/963797308/ 42 B
154 B 56ms
55ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/963797308/?random=1707130161973&cv=11&fst=1707127200000&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&npa=0&data=travel_destid%3DA19155%3Btravel_pagetype%3Dother&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_-UNSSJN3zsvRK7CM3L97Xs3st1MVaA&random=1408748398&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/963797308/ 42 B
154 B 53ms
52ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/963797308/?random=1707130161973&cv=11&fst=1707127200000&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71123195za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&frm=0&tiba=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&npa=0&data=travel_destid%3DA19155%3Btravel_pagetype%3Dother&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_-UNSSJN3zsvRK7CM3L97Xs3st1MVaA&random=1408748398&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 tp2
collector.secretescapes.com/com.snowplowanalytics.snowplow/ Frame 0
0 205ms
62ms Preflight 54.229.206.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.secretescapes.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.206.70 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-206-70.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://be.secretescapes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://be.secretescapes.com
access-control-max-age: 600
content-length: 0
date: Mon, 05 Feb 2024 10:49:22 GMT
server: nginx

POST
H2 200 tp2 Show response
collector.secretescapes.com/com.snowplowanalytics.snowplow/ 2 B
334 B 172ms
58ms XHR
text/plain 54.229.206.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.secretescapes.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.206.70 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-206-70.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://be.secretescapes.com
date: Mon, 05 Feb 2024 10:49:22 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

POST
H2 200 open Show response
api2.branch.io/v1/ 279 B
654 B 453ms
345ms XHR
application/json 2600:9000:25a2:3a00:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/open

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:3a00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

663d4916c87ca09caf5dc6f20ac57e5e455a4a223381d5fec9df61e3f1e8f851

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cb0d3a2bdc5300e2d139e111e94efe5a.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-branch-request-id: c54d127e-1ed4-485d-b0fb-1b4ee516cbdf-2024020510
content-length: 279
x-amz-cf-id: -L2k1ozR3fFjpJquzT1pIodnQQQEx0O57W8OpBfRrSpdx7RNEGvGJw==

GET
H3 200 490917821102742 Show response
connect.facebook.net/signals/config/ 53 KB
11 KB 41ms
41ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/490917821102742?v=2.9.144&r=stable&domain=be.secretescapes.com&hme=44ba03e7b4a66084f0064fdada9e7a7b89f6f2cf807a204d10c6509aeae35209&ex_m=62%2C105%2C93%2C97%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C148%2C151%2C162%2C158%2C159%2C161%2C25%2C89%2C45%2C68%2C160%2C143%2C146%2C155%2C156%2C163%2C114%2C13%2C43%2C167%2C166%2C116%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C94%2C96%2C31%2C95%2C26%2C22%2C144%2C147%2C123%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C92%2C38%2C70%2C60%2C98%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C99

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ce78923b92f4f90b5b9e2de878b7bf61f89b575ebefb42f93ea30f55f6599c37

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 05 Feb 2024 10:49:22 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 11059
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: 3c4tfndFTiI93Po+Tw5eshslrtC1DBsIvPRs9PPdGoIeK+Yiod78e7AiXS8DkefBRjtEupK5HYJ2jCFjOE5B0w==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 4011258.js Show response
bat.bing.com/p/action/ 0
117 B 66ms
66ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/4011258.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Mon, 05 Feb 2024 10:49:21 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F707F824EEDE4D88AF3B26F70B100CE2 Ref B: FRA31EDGE0607 Ref C: 2024-02-05T10:49:22Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
286 B 148ms
148ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=4011258&tm=gtm002&Ver=2&mid=409c98a4-7c5f-45e4-a0b1-87d126b0fe51&sid=38901920c41411eea636dd42c9878f5d&vid=38902170c41411ee9041ef748341b4eb&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&kw=Secret%20Escapes,%20luxe%20reizen,%20weekendje%20weg,%20exclusieve%20aanbiedingen,%20korte%20vakanties,%20ski%C3%ABn,%20cruises,%20strandvakanties,%20hotels,%20boetiekhotels&p=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&r=&lt=2281&evt=pageLoad&sv=1&rn=901740

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Feb 2024 10:49:21 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: ABA9848EF00C4CB7A151C340A1A2B346 Ref B: FRA31EDGE0607 Ref C: 2024-02-05T10:49:22Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pv Show response
data.gosquared.com/ 6 B
74 B 402ms
124ms Script
text/javascript 35.172.243.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://data.gosquared.com/pv?cs=UTF-8&cd=24&la=en-US&sw=1600&sh=1200&dp=1&tp=0&pu=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&pt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&ri=0&ru=-&re=0&vi=1&pv=1&lv=0&vw=1600&vh=1200&dw=1600&dh=2664&st=0&sl=0&tz=-60&rc=1&cb=0&a=GSN-598443-L&id=43a4c8b1f43001be5c95a5931e138f37&tv=6.7.1940
Requested by: Host: d1l6p2sc9645hc.cloudfront.net
URL: https://d1l6p2sc9645hc.cloudfront.net/tracker.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.243.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-243-12.compute-1.amazonaws.com
Software: /
Resource Hash: 2516ffceaee624e95516f2caa7b8f25100993d94230e624c8ee7858a8552bcc9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
content-length: 6
content-type: text/javascript

GET
H2 200 pv Show response
data.gosquared.com/ 6 B
75 B 401ms
123ms Script
text/javascript 35.172.243.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://data.gosquared.com/pv?cs=UTF-8&cd=24&la=en-US&sw=1600&sh=1200&dp=1&tp=0&pu=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&pt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&ri=0&ru=-&re=0&vi=1&pv=1&lv=0&vw=1600&vh=1200&dw=1600&dh=2664&st=0&sl=0&tz=-60&rc=1&cb=1&a=GSN-165617-W&id=4dc80ac3deeed4429a39ce76d9c7b3ab&tv=6.7.1940
Requested by: Host: d1l6p2sc9645hc.cloudfront.net
URL: https://d1l6p2sc9645hc.cloudfront.net/tracker.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.243.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-243-12.compute-1.amazonaws.com
Software: /
Resource Hash: eb2ad463e0fd390d63acc0e4e0c064cd787cab3ee5711fc9e6e203ad1429d4c0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
content-length: 6
content-type: text/javascript

GET
H2 204 0
bat.bing.com/action/ 0
230 B 124ms
124ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=4011258&tm=gtm002&Ver=2&mid=409c98a4-7c5f-45e4-a0b1-87d126b0fe51&sid=38901920c41411eea636dd42c9878f5d&vid=38902170c41411ee9041ef748341b4eb&vids=0&msclkid=N&ec=user&el=member&tpp=1&ea=user-id-status&en=Y&p=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel&sw=1600&sh=1200&sc=24&evt=custom&rn=428036

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Feb 2024 10:49:21 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8A1FB5CEB5CA4BA2AA16F3C798D8927C Ref B: FRA31EDGE0607 Ref C: 2024-02-05T10:49:22Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 240ms
148ms Fetch
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=118512178228091&input_token&origin=1&redirect_uri=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&sdk=joey&wants_cookie_data=true

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=()
strict-transport-security: max-age=15552000; preload
date: Mon, 05 Feb 2024 10:49:22 GMT
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
reporting-endpoints: coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
pragma: no-cache
x-fb-debug: UiE0Sr2/fmiaRvxO6gVrlsY79ysitQR3QJqFSWq/38eh3SBO5hCTpuXdWHdTJdCFGJV0JeAlrjVNIBCkUM1GIg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://be.secretescapes.com
origin-agent-cluster: ?0
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self)
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK piwik.php
collector-488.tvsquared.com/piwik/ 42 B
276 B 59ms
59ms Image
image/gif 52.215.173.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collector-488.tvsquared.com/piwik/piwik.php?action_name=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&idsite=TV-541818-1&rec=1&r=330530&h=11&m=49&s=22&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&_id=1788de0a25c5e924&_idts=1707130162&_idvc=0&_idn=1&_viewts=&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=1293
Requested by: Host: be.secretescapes.com
URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.173.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-173-157.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

P3p: CP='OTI DSP COR NID STP UNI OTPa OUR'
Date: Mon, 05 Feb 2024 10:49:22 GMT
Server: nginx
Connection: keep-alive
Request-Id: 061e609f-3995-4004-8d97-e6e0ee6e9311
Content-Length: 42
Content-Type: image/gif

GET
H2 200 graphql Show response
sparrow-production.escapes.tech/ 12 KB
3 KB 228ms
228ms Fetch
application/json 18.165.183.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sparrow-production.escapes.tech/graphql?operationName=getOffers&variables=%7B%22saleId%22%3A%22A19155%22%2C%22affiliate%22%3A%22be%22%2C%22territory%22%3A%22BE%22%2C%22flightsEnabled%22%3Afalse%7D&extensions=%7B%22persistedQuery%22%3A%7B%22version%22%3A1%2C%22sha256Hash%22%3A%22a8765ce73b144a227a8638066b1c219bf96a15094b0780a4065aeaa4adb8112b%22%7D%7D
Requested by: Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.183.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-183-103.zrh55.r.cloudfront.net
Software: / Express
Resource Hash: 4958637042aaa610e9281e81da05cb0ac6481e9af9d3a93282fb686496c289d8

Request headers

accept: */*
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: application/json

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
content-encoding: gzip
via: 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-powered-by: Express
x-amzn-requestid: 70d893b9-6ae9-457f-b937-38bc66184020
x-cache: RefreshHit from cloudfront
x-amz-apigw-id: SpqoUHfQDoEEqeg=
content-length: 2597
x-amzn-trace-id: Root=1-65c08b01-3c92322310eda5814ed6b244;Parent=38ecc94e9409df6b;Sampled=0;lineage=2859168a:0
etag: W/"2f6b-yBoiOim4vaHLn6MQ3zvVsReDVM4"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=480, public
x-amz-cf-id: y8m0togIuHTnp5MW28_8BPs0Jlmh5qJMa2mIKQF6iO5U8pt6usbJZA==

OPTIONS
H2 200 graphql
sparrow-production.escapes.tech/ Frame 0
0 94ms
82ms Preflight
application/json 18.165.183.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sparrow-production.escapes.tech/graphql?operationName=getOffers&variables=%7B%22saleId%22%3A%22A19155%22%2C%22affiliate%22%3A%22be%22%2C%22territory%22%3A%22BE%22%2C%22flightsEnabled%22%3Afalse%7D&extensions=%7B%22persistedQuery%22%3A%7B%22version%22%3A1%2C%22sha256Hash%22%3A%22a8765ce73b144a227a8638066b1c219bf96a15094b0780a4065aeaa4adb8112b%22%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.183.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-183-103.zrh55.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://be.secretescapes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,v4-jwt-token,User-Agent
access-control-allow-methods: OPTIONS,DELETE,GET,POST
access-control-allow-origin: *
access-control-max-age: 600
content-length: 0
content-type: application/json
date: Mon, 05 Feb 2024 10:49:22 GMT
via: 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront)
x-amz-apigw-id: SqJ_6FX1DoEEEDQ=
x-amz-cf-id: -lcibLlMH9bZE0s17PAN2WDR-SvSo5Q2dVfxaconzaZ8IQfFnf6kow==
x-amz-cf-pop: ZRH55-P1
x-amzn-requestid: 820bcaa4-0b8b-427b-a9ea-9bf7b0abbd4c
x-cache: Miss from cloudfront

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 84ms
41ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=490917821102742&ev=PageView&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&rl=&if=false&ts=1707130162322&sw=1600&sh=1200&ud[em]=a2ebcbfc6335453debb8af8681813ba1ab8f36e175c5f5551173ce254d768a27&v=2.9.144&r=stable&ec=0&o=4126&fbp=fb.1.1707130162321.758894193&ler=empty&cdl=API_unavailable&it=1707130162237&coo=false&exp=e1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 05 Feb 2024 10:49:22 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 84ms
41ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=490917821102742&ev=ViewContent&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&rl=&if=false&ts=1707130162323&cd[content_ids]=%5B%22A19155%22%5D&cd[content_type]=destination&cd[city]=Berlin&cd[region]=Berlin&cd[country]=Germany&sw=1600&sh=1200&ud[em]=a2ebcbfc6335453debb8af8681813ba1ab8f36e175c5f5551173ce254d768a27&v=2.9.144&r=stable&ec=1&o=4126&fbp=fb.1.1707130162321.758894193&ler=empty&cdl=API_unavailable&it=1707130162237&coo=false&exp=e1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 05 Feb 2024 10:49:22 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 rules-p-d4P3FpSypJrlA.js Show response
rules.quantcount.com/ 4 KB
2 KB 142ms
40ms Script
application/javascript 2600:9000:223c:d200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-d4P3FpSypJrlA.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:d200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4dc5765cdda9b83636c0fbdbdff1eeeeb758f9e9d1e9d9f5a536cf6e5aa04a8a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:45:36 GMT
content-encoding: gzip
via: 1.1 22993faf725ff29c940e58cb14ddf668.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 227
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
last-modified: Fri, 27 Apr 2018 19:56:32 GMT
server: AmazonS3
etag: W/"e237b135726b9c91da47b9291d494f1a"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-id: vgQf8S5020zddobMoyXIl5oRWwiiy9u22DZAwJGK9hrK5JhbaO06fg==

GET
H2 200 fonts.css
surveys-static.survicate.com/fonts/ 10 KB
2 KB 74ms
40ms Stylesheet
text/css 2400:52e0:1e00::1080:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL

https://surveys-static.survicate.com/fonts/fonts.css

Requested by

Host: survey.survicate.com
URL: https://survey.survicate.com/workspaces/84664d39e5f5898e52040198647d54cf/web_surveys.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),

Reverse DNS

Software

BunnyCDN-DE1-1080 /

Resource Hash

bacc23ae416ef150be09288d366d689a7678849b04094552e67d8e2a032ad5a0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
x-amz-version-id: null
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cdn-edgestorageid: 1082
content-security-policy: default-src 'self'
x-amz-request-id: 3RMP7AJA27HB68V3
cdn-cachedat: 01/24/2024 11:53:05
cdn-pullzone: 1133799
x-amz-id-2: WrZjnOrPu8JOVOi2e0wBGd1FxV4H1gxGxoQMzVmbn3w5lgdoe8eMYxisL6Jt9dfn5ssFCdemBR0=
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 13 Apr 2022 12:02:06 GMT
server: BunnyCDN-DE1-1080
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"175a0d0343589473e72c6e512936d749"
vary: Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 039640c0-4b09-428d-a0ae-513ccdd44502
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=604800
cdn-requestid: 8c26a433a8ce538a047352f60bb3356e
cdn-requestcountrycode: DE
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 modules.fd7a1c20a85f7a95e5ff.js Show response
script.hotjar.com/ 218 KB
55 KB 156ms
55ms Script
application/javascript 18.164.52.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.fd7a1c20a85f7a95e5ff.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-5644.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.52.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-52-95.cdg50.r.cloudfront.net

Software

Resource Hash

135cc2fb726f9d5ba840faf6e0ff280e2bd7b6b28a2736bd6092c807cfbea88c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Fri, 02 Feb 2024 12:16:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 a798024c3ebeca4899e61296c596f4e0.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P4
age: 253996
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55316
last-modified: Fri, 02 Feb 2024 12:16:01 GMT
etag: "253d3ab37754a78a185ec9d668fb77c9"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: A4WlSf0lpBd4tr-ceVZ6onSF_77RpVU4iwKsoRG8WRJ7h6X2pp4v_g==

GET
H2 200 container.js Show response
cdn.heapanalytics.com/js/replay/8161-Main-prod-heap/ 11 KB
6 KB 50ms
49ms Script
application/javascript 13.32.145.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.heapanalytics.com/js/replay/8161-Main-prod-heap/container.js
Requested by: Host: cdn.heapanalytics.com
URL: https://cdn.heapanalytics.com/js/heap-1008163987.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.145.50 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-145-50.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c196145c1b7fc92ddc164e1a0346a1c8f33aace392a999bf002587942b19c512

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: EB95pbdqBhGtqifSHlp_PG5FzFCeZAVh
content-encoding: gzip
via: 1.1 e4c24b48777e46bf299a44e5b6560a32.cloudfront.net (CloudFront)
date: Mon, 05 Feb 2024 08:02:56 GMT
x-amz-cf-pop: CDG50-C2
age: 9989
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 5571
last-modified: Thu, 18 Jan 2024 17:06:04 GMT
server: AmazonS3
etag: "8b94c9b0877a56c34acdbafa4b407ec1"
content-type: application/javascript
cache-control: public,max-age=86400
accept-ranges: bytes
x-amz-cf-id: WWqv6sf7sJjNvFjQHbJiTJQPepaAFAFey72-9NPMSZ_ovkh7Vybvdg==

GET
H2 200 identify_v3
heapanalytics.com/api/ 37 B
260 B 386ms
125ms Image
image/gif 3.213.194.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heapanalytics.com/api/identify_v3?a=1008163987&u=8766851942116486&v=2574704996119002&s=8003330660837559&i=27996229&b=web&tv=4.0&z=0&st=1707130162465

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.194.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-194-67.compute-1.amazonaws.com

Software

nginx /

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
etag: W/"25-4iFqfptz9csCeTUceM5hwzR1zqc"
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
H2 200 add_user_properties_v3
heapanalytics.com/api/ 37 B
261 B 385ms
124ms Image
image/gif 3.213.194.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heapanalytics.com/api/add_user_properties_v3?a=1008163987&u=8766851942116486&v=2574704996119002&s=8003330660837559&i=27996229&b=web&tv=4.0&_FeatureFlags=homepage.recentlyViewed%3Bsearch.otherMatches.upcoming%3Bsearch.otherMatches.recommendation%3Bhomepage.information.banner.catalogue%3Bsearch.source.kingfisher%3BconsentManagement.enabled%3Bbullfinch.salepage.mobile.enabled%3Bbullfinch.offerspage.enabled%3Bsearch.sortby%3Bbullfinch.calendarpage.enabled%3Bbullfinch.salepage.desktop.enabled%3Bsale.reviews.enabled%3Bodm.sales.bullfinch%3Breviews%3Bcancellation.survey.enabled%3Bself.serve.rebooking.enabled%3Bcancellation.rebooking%3Bhomepage.topDestinations%3Bhomepage.collectionPanels%3Bdata.test%3Bhide.promotional.badge.control%3Babtest.presearchtoggle.control&_Territory=BE&st=1707130162465

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.194.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-194-67.compute-1.amazonaws.com

Software

nginx /

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
etag: W/"25-4iFqfptz9csCeTUceM5hwzR1zqc"
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
H2 200 pixel;r=1710768137;source=gtm;rf=0;a=p-d4P3FpSypJrlA;url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demai...
pixel.quantserve.com/ 35 B
456 B 73ms
43ms Image
image/gif 2620:116:800d:21:93ca:31d8:d86e:38f6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1710768137;source=gtm;rf=0;a=p-d4P3FpSypJrlA;url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f;uht=2;fpan=1;fpa=P0-1640983530-1707130162325;pbc=;ns=0;ce=1;qjs=1;qv=b70d35e8-20231208114759;cm=;gdpr=0;ref=;d=secretescapes.com;dst=1;et=1707130162470;tzo=-60;ogl=title.Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%2Cdescription.Verblijf%20in%20een%20statig%20hotel%20in%20het%20centrum%20van%20Berlijn%252C%20met%20optionele%20suite%252C%20in%2Cimage.https%3A%2F%2Fsecretescapes-web%252Eimgix%252Enet%2Fhotels%2F546%2F89c49b77_56f4_4eab_a64e_2df37865f%2Ctype.null%3Adeal%2Csite_name.;ses=fee5d614-e2e0-4f0b-b13f-9f9d4708809b;mdl=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:93ca:31d8:d86e:38f6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:22 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"filters":[],"trigger_data":"1"}]}
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 releasesettings Show response
client-api.auryc.com/ 2 B
169 B 151ms
151ms XHR
application/json 34.66.73.214
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://client-api.auryc.com/releasesettings?lib=Web

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.66.73.214 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

214.73.66.34.bc.googleusercontent.com

Software

istio-envoy /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

x-authorized-identity: 8161-Main-prod-heap
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
x-authorized-token: a9c6c4ae7b2635a1b1a21c0f65618c03

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 05 Feb 2024 10:49:22 GMT
server: istio-envoy
vary: accept-encoding,origin,access-control-request-headers,access-control-request-method,accept-encoding
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: https://be.secretescapes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
x-xss-protection: 1; mode=block
expires: 0

OPTIONS
H2 200 releasesettings
client-api.auryc.com/ Frame 0
0 471ms
150ms Preflight 34.66.73.214
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://client-api.auryc.com/releasesettings?lib=Web

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.66.73.214 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

214.73.66.34.bc.googleusercontent.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: x-authorized-identity,x-authorized-token
Access-Control-Request-Method: GET
Origin: https://be.secretescapes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: x-authorized-identity, x-authorized-token
access-control-allow-methods: OPTIONS,HEAD,GET,PUT,POST,DELETE,PATCH
access-control-allow-origin: https://be.secretescapes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
date: Mon, 05 Feb 2024 10:49:22 GMT
expires: 0
pragma: no-cache
server: istio-envoy
strict-transport-security: max-age=31536000 ; includeSubDomains
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-content-type-options: nosniff
x-envoy-upstream-service-time: 1
x-frame-options: DENY
x-xss-protection: 1; mode=block

OPTIONS
H2 200 tp2
collector.secretescapes.com/com.snowplowanalytics.snowplow/ Frame 0
0 58ms
58ms Preflight 54.229.206.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.secretescapes.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.206.70 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-206-70.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://be.secretescapes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://be.secretescapes.com
access-control-max-age: 600
content-length: 0
date: Mon, 05 Feb 2024 10:49:22 GMT
server: nginx

POST
H2 200 tp2 Show response
collector.secretescapes.com/com.snowplowanalytics.snowplow/ 2 B
333 B 58ms
58ms XHR
text/plain 54.229.206.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.secretescapes.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.206.70 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-206-70.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://be.secretescapes.com
date: Mon, 05 Feb 2024 10:49:22 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

GET
H2 200 browser-perf.8417c6bba72228fa2e29.js Show response
script.hotjar.com/ 5 KB
2 KB 48ms
47ms Script
application/javascript 18.164.52.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js

Requested by

Host: script.hotjar.com
URL: https://script.hotjar.com/modules.fd7a1c20a85f7a95e5ff.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.52.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-52-95.cdg50.r.cloudfront.net

Software

Resource Hash

70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 14:32:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 a798024c3ebeca4899e61296c596f4e0.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P4
age: 1023435
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 1782
last-modified: Wed, 24 Jan 2024 14:31:37 GMT
etag: "b83b61bc5871e9a23a0434e2c539f4f3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: UDwxYdsy_YoSfDDykNe6UVEMxPjOu8uZE8pFfeiXFxPPNBiKZ_c9lg==

POST
H2 200 custom Show response
api2.branch.io/v2/event/ 88 B
442 B 194ms
194ms XHR
application/json 2600:9000:25a2:3a00:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v2/event/custom

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:3a00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

90bd352fbed38b00ff4ca1ce047e70778fc4880a61adf35fd6074f5186cf0927

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 05 Feb 2024 10:49:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cb0d3a2bdc5300e2d139e111e94efe5a.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-branch-request-id: 3b492ad0-0f38-472e-a255-61cc0b929854-2024020510
content-length: 88
x-amz-cf-id: qKl14a5piw9hE6ZZa9kaqWHLsT4-wOJ7MXk3o1iajRatgG7XBDcUEg==

GET
H2 200 graphql Show response
sparrow-production.escapes.tech/ 142 KB
5 KB 349ms
349ms Fetch
application/json 18.165.183.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sparrow-production.escapes.tech/graphql?operationName=getCalendar&variables=%7B%22offerId%22%3A%22A24474%22%2C%22saleId%22%3A%22A19155%22%2C%22affiliate%22%3A%22be%22%2C%22territory%22%3A%22BE%22%2C%22period%22%3A3%2C%22rooms%22%3A1%7D&extensions=%7B%22persistedQuery%22%3A%7B%22version%22%3A1%2C%22sha256Hash%22%3A%22b56637ded6e6db86c76e367f1f7eb76bc077d5b409390b5f22657ad9a979de52%22%7D%7D
Requested by: Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.183.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-183-103.zrh55.r.cloudfront.net
Software: / Express
Resource Hash: 16163147b981591aaf106d436fd9e919d12be6211180288cd9e7d57e5838a87f

Request headers

accept: */*
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: application/json

Response headers

date: Mon, 05 Feb 2024 10:49:23 GMT
content-encoding: gzip
via: 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-powered-by: Express
x-amzn-requestid: 995a492a-8748-4633-950c-ed19afac92bb
x-cache: RefreshHit from cloudfront
x-amz-apigw-id: SpqoYF0qDoEEnBw=
content-length: 4304
x-amzn-trace-id: Root=1-65c08b02-2aef5b8b25bae8e332b9a9af;Parent=5d87d68dde512912;Sampled=0;lineage=2859168a:0
etag: W/"23665-Th9MPZKV1B7xkZ0rNzNvO76kgrc"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=480, public
x-amz-cf-id: 4OGiyIGxxH7zjDPWgOAu2nku8ikY2sNbULhFMCdGL7n8nh5l_x-dRQ==

OPTIONS
H2 200 graphql
sparrow-production.escapes.tech/ Frame 0
0 83ms
83ms Preflight
application/json 18.165.183.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sparrow-production.escapes.tech/graphql?operationName=getCalendar&variables=%7B%22offerId%22%3A%22A24474%22%2C%22saleId%22%3A%22A19155%22%2C%22affiliate%22%3A%22be%22%2C%22territory%22%3A%22BE%22%2C%22period%22%3A3%2C%22rooms%22%3A1%7D&extensions=%7B%22persistedQuery%22%3A%7B%22version%22%3A1%2C%22sha256Hash%22%3A%22b56637ded6e6db86c76e367f1f7eb76bc077d5b409390b5f22657ad9a979de52%22%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.183.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-183-103.zrh55.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://be.secretescapes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,v4-jwt-token,User-Agent
access-control-allow-methods: OPTIONS,DELETE,GET,POST
access-control-allow-origin: *
access-control-max-age: 600
content-length: 0
content-type: application/json
date: Mon, 05 Feb 2024 10:49:22 GMT
via: 1.1 841da31399fe7f7e7065c840a22fae0a.cloudfront.net (CloudFront)
x-amz-apigw-id: SqJ_-EltjoEEL2g=
x-amz-cf-id: Ru2baRUpf6BAHmEiN8myKRix0loZcZjCcxH8MnyQ3tzrT6Q3HpU6tA==
x-amz-cf-pop: ZRH55-P1
x-amzn-requestid: 7a22e844-1b0c-48e9-b850-40e656672853
x-cache: Miss from cloudfront

GET
H2 200 nr-rum-1.248.0.min.js Show response
js-agent.newrelic.com/ 44 KB
16 KB 136ms
40ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-rum-1.248.0.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

fe2c8e1464e377e0e004cae5ca02498a306b7090feddbd3abe14d088c5a7bc19

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: 5pOats3JozwL.Cq.YDQ1.AKeG91t1nFP
content-encoding: br
via: 1.1 varnish
date: Mon, 05 Feb 2024 10:49:22 GMT
strict-transport-security: max-age=300
x-amz-request-id: TBHMWPYHAWQAJ6A6
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 15747
x-amz-id-2: YtjwXG79yRYl2ilrW6iA589IoH5c+XYKWMwYqTKmWpAjBYwavHb3l2MIZfoqfSNdh/HgujSnX2A=
x-served-by: cache-fra-etou8220099-FRA
last-modified: Thu, 16 Nov 2023 17:54:54 GMT
server: AmazonS3
x-timer: S1707130163.964227,VS0,VE0
etag: "ee8c8948e29e77d6bade8edf829b4863"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 44

GET
H/1.1 200
OK esw.html Show response
service.force.com/embeddedservice/5.0/ Frame 50EB 379 B
1 KB 284ms
283ms Document
text/html 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/esw.html?parent=https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/esw.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

f0fd989d3d400af9d0e449aecf31cef85e4ed7394306b79f8d8fde69bc907750

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: public,max-age=86400
Content-Encoding: gzip
Content-Security-Policy: upgrade-insecure-requests
Content-Type: text/html;charset=UTF-8
Date: Mon, 05 Feb 2024 10:49:23 GMT
Expires: Tue, 06 Feb 2024 10:49:23 GMT
Last-Modified: Thu, 14 Sep 2023 00:07:46 GMT
Referrer-Policy: origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: none

GET
H/1.1 200
OK /
seal.digicert.com/seals/cascade/ 2 KB
3 KB 132ms
132ms Image
image/png 3.19.8.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://seal.digicert.com/seals/cascade/?tag=27VndfNB&referer=be.secretescapes.com&format=png&lang=nl&an=min

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.19.8.217 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-19-8-217.us-east-2.compute.amazonaws.com

Software

nginx /

Resource Hash

bd9d68d5f1fd010ffa592493f6993df3f33b9965574d3fe530cc1a5729375955

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.digicert.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 10:49:22 GMT
Content-Security-Policy: frame-ancestors https://*.digicert.com
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
last-modified: Mon, 05 Feb 2024 00:00:00 +0000
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
cache-control: max-age=86400
x-envoy-upstream-service-time: 31
Connection: keep-alive
Content-Length: 2486
X-XSS-Protection: 1; mode=block
expires: Tue, 06 Feb 2024 06:53:42 +0000

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
435 B 232ms
232ms XHR
application/json 2600:9000:25a2:3a00:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/pageview

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:25a2:3a00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Express

Resource Hash

a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 05 Feb 2024 10:49:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cb0d3a2bdc5300e2d139e111e94efe5a.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH55-P1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-branch-request-id: 95b7daa44ce94902b845a3b19853bc3d-2024020510
content-length: 28
x-amz-cf-id: WCZ05r3AuxOSvOLldxzzXPbngC5EOGzC0FhyA1CTsJU_P36ixIIuog==

POST
H/1.1 200
OK d3aee08e2d Show response
bam.nr-data.net/1/ 40 B
469 B 799ms
681ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/d3aee08e2d?a=1028806195&sa=1&v=1.248.0&t=Unnamed%20Transaction&rst=3591&ck=0&s=70e1eed6b68416be&ref=https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel&be=1735&fe=1737&dc=546&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1707130159415,%22n%22:0,%22f%22:500,%22dn%22:500,%22dne%22:500,%22c%22:500,%22s%22:500,%22ce%22:500,%22rq%22:501,%22rp%22:1735,%22rpe%22:1794,%22di%22:2278,%22ds%22:2278,%22de%22:2281,%22dc%22:3437,%22l%22:3438,%22le%22:3472%7D,%22navigation%22:%7B%7D%7D&fp=2067&fcp=2067
Requested by: Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 05 Feb 2024 10:49:23 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://be.secretescapes.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
CF-Ray: 850a961f9c4a2675-TXL
Content-Length: 40

POST
H2 200 landing
pagead2.googlesyndication.com/pagead/ 42 B
455 B 171ms
75ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/landing?gcs=G100&gcd=11p1p1l1l5&rnd=1181390374.1707130163&url=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel&dma_cps=sypham&dma=1&npa=0&gtm=45He41v0n81TDMX64Kv863412107za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TDMX64K

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:23 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1808272072&t=pageview&_s=1&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&ul=en-us&de=UTF-8&dt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGHAgEABAAAAAGAAIk~&cid=1306387403.1707130163&uid=27996229&tid=UA-62655480-3&_gid=1199376679.1707130163&gtm=45He41v0n81TDMX64Kv863412107za200&gcd=11p1p1l1l5&dma_cps=sypham&dma=1&cd1=27996229&cd3=be&cd4=text_top_hotelgeheim&cd5=A19155&cd6=HOTEL&cd11=c6d0e6ea3a21ba32eed5f2445dd792152558f72ab33e1a0973dca7f8553ee216&cd12=EMAIL_SEMI_LOGIN&cd14=HOTEL&cd15=UNKNOWN&cd20=DESKTOP&cd21=Berlin&cd22=Germany&cd76=Secret%20Escapes%20Provider&cd24=Berlin&cd25=Germany&cd26=Europe&cd27=Berlin&cd37=HOTEL&cd38=A19155&cd39=2016-03-19&cd40=932&cd44=ALL&cd54=0&cd56=gtm.js&cd67=Y&cd69=noPasswordSignIn%2Cutm_medium%2Cutm_source%2Cutm_campaign%2Cutm_platform%2Cutm_content%2CcopyVersion%2CmessageId&cd70=%22%22&cd73=HOTEL&cm3=1&gcs=G100&z=1262938141

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 19:04:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 56686
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 41ms
41ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1808272072&t=event&ni=1&_s=1&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&ul=en-us&de=UTF-8&dt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=saleCity&ea=Berlin&el=%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel&_u=aGHAgEABAAAAAGAAIk~&cid=504389512.1707130163&uid=27996229&tid=UA-62655480-3&_gid=750090057.1707130163&gtm=45He41v0n81TDMX64Kv863412107za200&gcd=11p1p1l1l5&dma_cps=sypham&dma=1&cd1=27996229&cd3=be&cd4=text_top_hotelgeheim&cd5=A19155&cd6=HOTEL&cd11=c6d0e6ea3a21ba32eed5f2445dd792152558f72ab33e1a0973dca7f8553ee216&cd12=EMAIL_SEMI_LOGIN&cd14=HOTEL&cd15=UNKNOWN&cd20=DESKTOP&cd21=Berlin&cd22=Germany&cd76=Secret%20Escapes%20Provider&cd24=Berlin&cd25=Germany&cd26=Europe&cd27=Berlin&cd37=HOTEL&cd38=A19155&cd39=2016-03-19&cd40=932&cd44=ALL&cd54=0&cd56=gtm.js&cd67=Y&cd73=HOTEL&cm3=1&gcs=G100&z=1768593166

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 19:04:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 56686
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 42ms
42ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1808272072&t=event&ni=0&_s=1&dl=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&ul=en-us&de=UTF-8&dt=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=content%20rendered&ea=offer%20page&el=offer&_u=aGHAgEABAAAAAGAAIk~&cid=691213202.1707130163&uid=27996229&tid=UA-62655480-3&_gid=1349949704.1707130163&gtm=45He41v0n81TDMX64Kv863412107za200&gcd=11p1p1l1l5&dma_cps=sypham&dma=1&cd1=27996229&cd3=be&cd4=text_top_hotelgeheim&cd5=A19155&cd6=HOTEL&cd11=c6d0e6ea3a21ba32eed5f2445dd792152558f72ab33e1a0973dca7f8553ee216&cd12=EMAIL_SEMI_LOGIN&cd14=HOTEL&cd15=UNKNOWN&cd20=DESKTOP&cd21=Berlin&cd22=Germany&cd76=Secret%20Escapes%20Provider&cd24=Berlin&cd25=Germany&cd26=Europe&cd27=Berlin&cd37=HOTEL&cd38=A19155&cd39=2016-03-19&cd40=932&cd44=ALL&cd54=0&cd56=contentRendered&cd67=Y&cd73=HOTEL&cm3=1&cm6=1&gcs=G100&z=341943186

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 19:04:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 56686
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 auryc.lib.js Show response
cdn.heapanalytics.com/js/replay/libs/latest/ 695 KB
186 KB 48ms
48ms Script
application/javascript 13.32.145.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.heapanalytics.com/js/replay/libs/latest/auryc.lib.js
Requested by: Host: cdn.heapanalytics.com
URL: https://cdn.heapanalytics.com/js/replay/8161-Main-prod-heap/container.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 13.32.145.50 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-145-50.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b104e242e4b08e9fce2257dd5a4058cd724a4eaccf1f6948f533978f4596caa7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: 3xT__n1Of3jdUG8BrQAjsFjINlVilZjL
content-encoding: gzip
via: 1.1 a7bbe4a11b741d7b36ce930a7be4fa36.cloudfront.net (CloudFront)
date: Mon, 05 Feb 2024 04:12:05 GMT
age: 23839
x-amz-cf-pop: CDG50-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 189792
last-modified: Tue, 12 Dec 2023 20:14:10 GMT
server: AmazonS3
etag: "08107d4bf0deecbe08dbfbfdf7afda33"
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: EOgWhgxsreW4wubMmwOULuq3X2lfMOlXZqWnW0vtmS-eB7RYIPxq_g==

GET
H/1.1 200
OK eswFrame.min.js Show response
service.force.com/embeddedservice/5.0/ Frame 50EB 5 KB
2 KB 51ms
51ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/eswFrame.min.js

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/esw.html?parent=https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

0284b82fc74f4fd666a234fc2df3c7be10d49e40d9f5d238594f69b63c5d794d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://service.force.com/embeddedservice/5.0/esw.html?parent=https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 07:31:00 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 06 Oct 2022 23:37:30 GMT
Content-Encoding: gzip
Age: 11903
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 2002
Expires: Tue, 06 Feb 2024 07:31:00 GMT

GET
H2 200 siteconfig Show response
client-api.auryc.com/ 3 KB
1 KB 150ms
150ms XHR
application/json 34.66.73.214
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://client-api.auryc.com/siteconfig?lib=web

Requested by

Host: bullfinch.orca-production.escapes.tech
URL: https://bullfinch.orca-production.escapes.tech/0.276.0/vendor.2f3e04b0.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.66.73.214 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

214.73.66.34.bc.googleusercontent.com

Software

istio-envoy /

Resource Hash

f64a07c1285bce1ed91c20e74c222603820c0aa479b7fa6564ebfb82f0b442f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

x-authorized-identity: 8161-Main-prod-heap
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
x-authorized-token: a9c6c4ae7b2635a1b1a21c0f65618c03
Content-Type: application/json

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 05 Feb 2024 10:49:23 GMT
server: istio-envoy
vary: accept-encoding,origin,access-control-request-headers,access-control-request-method,accept-encoding
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: https://be.secretescapes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
x-xss-protection: 1; mode=block
expires: 0

OPTIONS
H2 200 siteconfig
client-api.auryc.com/ Frame 0
0 159ms
158ms Preflight 34.66.73.214
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://client-api.auryc.com/siteconfig?lib=web

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.66.73.214 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

214.73.66.34.bc.googleusercontent.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-authorized-identity,x-authorized-token
Access-Control-Request-Method: GET
Origin: https://be.secretescapes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type, x-authorized-identity, x-authorized-token
access-control-allow-methods: OPTIONS,HEAD,GET,PUT,POST,DELETE,PATCH
access-control-allow-origin: https://be.secretescapes.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
date: Mon, 05 Feb 2024 10:49:23 GMT
expires: 0
pragma: no-cache
server: istio-envoy
strict-transport-security: max-age=31536000 ; includeSubDomains
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-content-type-options: nosniff
x-envoy-upstream-service-time: 0
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK session.esw.min.js Show response
service.force.com/embeddedservice/5.0/frame/ Frame 50EB 2 KB
1 KB 48ms
48ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/frame/session.esw.min.js

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/eswFrame.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

f2863821119660d61dea8c3d9024b49b3cf368a87f54fada27a95379f20ce92b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://service.force.com/embeddedservice/5.0/esw.html?parent=https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 07:31:01 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Wed, 17 Aug 2022 20:10:20 GMT
Content-Encoding: gzip
Age: 11902
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 882
Expires: Tue, 06 Feb 2024 07:31:01 GMT

GET
H/1.1 200
OK broadcast.esw.min.js Show response
service.force.com/embeddedservice/5.0/frame/ Frame 50EB 2 KB
1 KB 49ms
48ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/frame/broadcast.esw.min.js

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/eswFrame.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

ecb244f676677252c58d2eccb58f1b0b87b5dd6baab45d29d46dba74c823b7f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://service.force.com/embeddedservice/5.0/esw.html?parent=https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 09:11:13 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Thu, 18 Feb 2021 00:07:24 GMT
Content-Encoding: gzip
Age: 5890
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 779
Expires: Tue, 06 Feb 2024 09:11:13 GMT

GET
H/1.1 200
OK chasitor.esw.min.js Show response
service.force.com/embeddedservice/5.0/frame/ Frame 50EB 23 KB
6 KB 48ms
48ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/frame/chasitor.esw.min.js

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/eswFrame.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

2b18192a287debcac96ef5cf0ffc45f720594a3c52a9c06a4478117871b21208

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://service.force.com/embeddedservice/5.0/esw.html?parent=https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 10:08:02 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Wed, 01 Feb 2023 22:50:32 GMT
Content-Encoding: gzip
Age: 2481
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 5265
Expires: Tue, 06 Feb 2024 10:08:02 GMT

GET
H/1.1 200
OK EmbeddedServiceConfig.jsonp Show response
d.la3-c1-cdg.salesforceliveagent.com/chat/rest/EmbeddedService/ 174 B
564 B 272ms
53ms Script
text/javascript 160.8.246.31
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la3-c1-cdg.salesforceliveagent.com/chat/rest/EmbeddedService/EmbeddedServiceConfig.jsonp?Settings.prefix=EmbeddedService&org_id=00Dw0000000mXA9&EmbeddedServiceConfig.configName=Einstein_Chat_Bot_BE&callback=embedded_svc.liveAgentAPI.handleChatSettings&version=48&EmbeddedServiceConfig.language=nl

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/utils/common.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

160.8.246.31 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl15-ncg0-cdg3.la3-c1-cdg.salesforceliveagent.com

Software

Resource Hash

00f993fa8da962e101c466681a2a88164bc3e6531bd854d6dddabae661bf3c38

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H/1.1 200
OK invite.esw.min.js Show response
service.force.com/embeddedservice/5.0/client/ 19 KB
5 KB 49ms
48ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/client/invite.esw.min.js

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/esw.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

11b97392fe91256a463d66e0a68f1ed068dd3ba2200289fa89e0afb2b0558b12

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Sun, 04 Feb 2024 13:15:56 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Fri, 24 Sep 2021 16:25:36 GMT
Content-Encoding: gzip
Age: 77607
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 4540
Expires: Mon, 05 Feb 2024 13:15:56 GMT

GET
DATA 200
OK truncated
/ 3 KB
3 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 10a396cf83a1f0fa5ae02c199215e1b8e32fdb313f3d5e24c3e61a56f01e3eb5

Request headers

Referer: https://service.force.com/
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H2 200 SalesforceSans-Regular.woff
c1.sfdcstatic.com/etc/clientlibs/sfdc-aem-master/clientlibs_base/fonts/ 34 KB
34 KB 215ms
50ms Font
font/woff 2.19.96.145
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.sfdcstatic.com/etc/clientlibs/sfdc-aem-master/clientlibs_base/fonts/SalesforceSans-Regular.woff

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.96.145 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-96-145.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

61b1f95fd4b77f7674f18aca5e867efb6e1ca58026ae61cc43f0f7b86d05743d

Security Headers

Name	Value
Strict-Transport-Security	maxage=16070400; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://be.secretescapes.com/
Origin: https://be.secretescapes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: maxage=16070400; includeSubdomains; preload, max-age=31536000; includeSubDomains
date: Mon, 05 Feb 2024 10:49:23 GMT
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 01 Feb 2024 09:10:45 GMT
server: Apache
x-frame-options: SAMEORIGIN
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2592000, s-maxage=10
accept-ranges: bytes
content-length: 34888
expires: Wed, 06 Mar 2024 10:49:23 GMT

GET
H/1.1 200
OK filetransfer.esw.min.js Show response
service.force.com/embeddedservice/5.0/frame/ Frame 50EB 473 B
711 B 48ms
48ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/frame/filetransfer.esw.min.js

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/eswFrame.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

34172e3b2c0f93498a2730933bc90740b38178cf10bd81b3164289d0445644a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://service.force.com/embeddedservice/5.0/esw.html?parent=https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 05 Feb 2024 10:27:52 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Tue, 18 Aug 2020 17:12:46 GMT
Content-Encoding: gzip
Age: 1291
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 231
Expires: Tue, 06 Feb 2024 10:27:52 GMT

GET
H/1.1 200
OK Settings.jsonp Show response
d.la3-c1-cdg.salesforceliveagent.com/chat/rest/Visitor/ 177 B
564 B 220ms
51ms Script
text/javascript 160.8.246.31
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la3-c1-cdg.salesforceliveagent.com/chat/rest/Visitor/Settings.jsonp?Settings.prefix=Visitor&Settings.buttonIds=[57369000000kVhA]&Settings.updateBreadcrumb=1&callback=embedded_svc.liveAgentAPI.connection.handlePing&deployment_id=57269000000TYqn&org_id=00Dw0000000mXA9&version=48

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/client/liveagent.esw.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

160.8.246.31 London, United Kingdom, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl15-ncg0-cdg3.la3-c1-cdg.salesforceliveagent.com

Software

Resource Hash

90ee0ccf6d335dcf9e4e65b163d938d71574d6804a9d99325abfc4967b57273f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H/1.1 200
OK inert.min.js Show response
service.force.com/embeddedservice/5.0/utils/ 8 KB
3 KB 48ms
48ms Script
application/x-javascript 85.222.144.146
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://service.force.com/embeddedservice/5.0/utils/inert.min.js

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/esw.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

85.222.144.146 Paris, France, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl2-ncg0-cdg3.eu18-cdg.force.com

Software

Resource Hash

12834f596f899e7e17cc2a4a76a1ee77ea0f1ebbfb61e8a33dafe426327c71a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Sun, 04 Feb 2024 13:15:56 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin
Last-Modified: Tue, 18 Aug 2020 17:12:46 GMT
Content-Encoding: gzip
Age: 77607
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=86400
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 2469
Expires: Mon, 05 Feb 2024 13:15:56 GMT

GET
BLOB 200
OK 60171df7-845b-4595-8583-285ad925de14
https://be.secretescapes.com/ 85 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://be.secretescapes.com/60171df7-845b-4595-8583-285ad925de14
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b272e43c528bdb75ea6aacc0fdd09ce62573a3849869f7ea80d532de6a8c57d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Length: 85
Content-Type: application/javascript

GET
H/1.1 200
OK EmbeddedServiceConfig.jsonp Show response
d.la1-core1.sfdc-cehfhs.salesforceliveagent.com/chat/rest/EmbeddedService/ 16 KB
4 KB 189ms
60ms Script
text/javascript 13.48.230.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la1-core1.sfdc-cehfhs.salesforceliveagent.com/chat/rest/EmbeddedService/EmbeddedServiceConfig.jsonp?Settings.prefix=EmbeddedService&org_id=00Dw0000000mXA9&EmbeddedServiceConfig.configName=Einstein_Chat_Bot_BE&callback=embedded_svc.liveAgentAPI.handleChatSettings&version=48&EmbeddedServiceConfig.language=nl

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/utils/common.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.48.230.177 Stockholm, Sweden, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-48-230-177.eu-north-1.compute.amazonaws.com

Software

envoy /

Resource Hash

d14060b7a4a59f2830244a1d1a995d2e57178b6a78530551dd8f5541e219782a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: envoy
transfer-encoding: chunked
content-type: text/javascript
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
x-envoy-upstream-service-time: 12
expires: -1

GET
H/1.1 200
OK Settings.jsonp Show response
d.la1-core1.sfdc-cehfhs.salesforceliveagent.com/chat/rest/Visitor/ 351 B
645 B 185ms
55ms Script
text/javascript 13.48.230.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la1-core1.sfdc-cehfhs.salesforceliveagent.com/chat/rest/Visitor/Settings.jsonp?Settings.prefix=Visitor&Settings.buttonIds=[57369000000kVhA]&Settings.updateBreadcrumb=1&callback=embedded_svc.liveAgentAPI.connection.handlePing&deployment_id=57269000000TYqn&org_id=00Dw0000000mXA9&version=48

Requested by

Host: service.force.com
URL: https://service.force.com/embeddedservice/5.0/client/liveagent.esw.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.48.230.177 Stockholm, Sweden, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-48-230-177.eu-north-1.compute.amazonaws.com

Software

envoy /

Resource Hash

5728495d2601a39470dc2b0a733da95310262d18ace8fec85a21c39a42abcc09

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: envoy
transfer-encoding: chunked
content-type: text/javascript
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5
expires: -1

GET
H2 200 h
heapanalytics.com/ 37 B
260 B 124ms
124ms Image
image/gif 3.213.194.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heapanalytics.com/h?a=1008163987&u=8766851942116486&v=2574704996119002&s=8003330660837559&b=web&tv=4.0&z=0&h=%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel&q=%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&d=be.secretescapes.com&t=Tijdloze%20elegantie%20in%20het%20centrum%20van%20Berlijn%20%7C%20Luxe%20reizen%20tegen%20lage%20prijzen%20%7C%20Secret%20Escapes&us=newsletter&um=email&uc=SEGMENT_CORE_BE_ACT_01M&ua=6703117&k=Top%20Level%20Nav%20Impression%20Flag&k=true&k=Country%20(dataLayer)&k=BE&ts=1707130162463&sch=1200&scw=1600&st=1707130163664

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.194.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-194-67.compute-1.amazonaws.com

Software

nginx /

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Feb 2024 10:49:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
etag: W/"25-4iFqfptz9csCeTUceM5hwzR1zqc"
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
BLOB 200
OK e2be4827-235a-456f-9658-af4b0a443c7e
https://be.secretescapes.com/ 85 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://be.secretescapes.com/e2be4827-235a-456f-9658-af4b0a443c7e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b272e43c528bdb75ea6aacc0fdd09ce62573a3849869f7ea80d532de6a8c57d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Length: 85
Content-Type: application/javascript

Verdicts & Comments Add Verdict or Comment

154 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

57 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.secretescapes.com/	1970-01-20 18:13:36	Name: iterableEmailCampaignId Value: 6703117
.secretescapes.com/	1970-01-20 18:13:36	Name: iterableTemplateId Value: 8970886
.secretescapes.com/	1970-01-20 18:13:36	Name: iterableMessageId Value: 712980f13b4549389d88f2ff55e4879f
.secretescapes.com/	1970-01-21 02:57:46	Name: iterableEndUserId Value: rinashertogen%40hotmail.com
links.secretescapes.com/	1969-12-31 23:59:59	Name: XSRF-TOKEN Value: 3ed8b507d1f25a411fe2006c9ac58c55498f4a77-1707130159612-a7aeb9c73d0bb40d44ec8ce3
be.secretescapes.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 582483885E40123C0AB2A8159CD03D0F
be.secretescapes.com/	1970-01-21 02:58:07	Name: rememberMe Value: 71DdP21ovyeYK_R0z8zgZoXsxZCMxV52MRSAG8ZO4mf397WSeHUjtG0Lz-uJxZICw9_AC2Z9Lj0gsFeVp6gxKzxcgSjFLahiJvX124BBZBfqIk4fK2Mx1ezSNfUjUJhk
.secretescapes.com/	1970-01-20 18:32:19	Name: auth_at Value: be.secretescapes.com
be.secretescapes.com/	1970-01-21 02:57:46	Name: seuid Value: 27996229
be.secretescapes.com/	1970-01-21 02:57:46	Name: userLoginType Value: EMAIL_SEMI_LOGIN
be.secretescapes.com/	1970-01-20 22:31:22	Name: ubid Value: db9ead2c-e19c-4b18-bcb3-17279aa01ebc
be.secretescapes.com/	1970-01-21 02:57:46	Name: semi_login Value: MLU8XxYKPVv88OCRmRQ_Ug
be.secretescapes.com/	1970-01-20 18:22:14	Name: AWSALBTG Value: ryCvAajp9KBx6pLGCM4PFn8sTmUdcXe9V/nSPS5UXmn8SN64LdSyLYNlLszg9COjnXgETHzXkPtluiDgTxEfpLMdY7REtrHqfVsaJyRT9vsDz+fcYrr2CCh7DRzOhLebMn+P5zFlPyBF/lDySLwq7tW0sN0Sn6hGY/9hDkPbPJ71
be.secretescapes.com/	1970-01-20 18:22:14	Name: AWSALBTGCORS Value: ryCvAajp9KBx6pLGCM4PFn8sTmUdcXe9V/nSPS5UXmn8SN64LdSyLYNlLszg9COjnXgETHzXkPtluiDgTxEfpLMdY7REtrHqfVsaJyRT9vsDz+fcYrr2CCh7DRzOhLebMn+P5zFlPyBF/lDySLwq7tW0sN0Sn6hGY/9hDkPbPJ71
be.secretescapes.com/	1970-01-20 18:22:14	Name: AWSALB Value: odJSknw9aeyUPp79LqwbUyiy1Lp1153bVgDQzNheFiepplriwWAKCkYQZD1VRrhtv8U9Guvu2jd/R2Zsik3XYIiBNtrc5oLQLFYwNTIyxN/+VcOw24Jq51NZ1HlA
be.secretescapes.com/	1970-01-20 18:22:14	Name: AWSALBCORS Value: odJSknw9aeyUPp79LqwbUyiy1Lp1153bVgDQzNheFiepplriwWAKCkYQZD1VRrhtv8U9Guvu2jd/R2Zsik3XYIiBNtrc5oLQLFYwNTIyxN/+VcOw24Jq51NZ1HlA
be.secretescapes.com/	1970-01-21 03:48:10	Name: tracker.id Value: 95e31e644c8eeedb36a9e89c0b8a0266
.be.secretescapes.com/	1970-01-21 03:48:10	Name: _ga Value: GA1.3.1548067295.1707130162
.be.secretescapes.com/	1970-01-20 18:13:36	Name: _gid Value: GA1.3.1404766081.1707130162
.be.secretescapes.com/	1970-01-20 18:12:10	Name: _gat Value: 1
.secretescapes.com/	1970-01-20 20:21:46	Name: _gcl_au Value: 1.1.67609605.1707130162
.be.secretescapes.com/	1970-01-20 18:12:10	Name: _dc_gtm_UA-62655480-1 Value: 1
.secretescapes.com/	1970-01-21 03:48:10	Name: _ga Value: GA1.2.1548067295.1707130162
.secretescapes.com/	1970-01-20 18:13:36	Name: _gid Value: GA1.2.1404766081.1707130162
.secretescapes.com/	1970-01-20 18:12:10	Name: _dc_gtm_UA-62655480-3 Value: 1
2bf9.secretescapes.com/	1970-01-20 18:22:14	Name: AWSALBTG Value: 5+yIRTexzLQeJlZ751gRsXrKgxe97DRcrS2AOTxA3JaHolEWHGSmcmwTxk0V2wFWWkVeof9Y9xqZLjuGo1YPVwQWhOCkb9t5rhd34+ayjOvlNshjitIavmpB5vi+t4voJT2I2til4tjZnFM+cMwLYVZ+llE176pC6r8iEI0bRn7a
2bf9.secretescapes.com/	1970-01-20 18:22:14	Name: AWSALBTGCORS Value: 5+yIRTexzLQeJlZ751gRsXrKgxe97DRcrS2AOTxA3JaHolEWHGSmcmwTxk0V2wFWWkVeof9Y9xqZLjuGo1YPVwQWhOCkb9t5rhd34+ayjOvlNshjitIavmpB5vi+t4voJT2I2til4tjZnFM+cMwLYVZ+llE176pC6r8iEI0bRn7a
2bf9.secretescapes.com/	1970-01-20 18:22:14	Name: AWSALB Value: btdyK/YY3aq/WWrK/UGEv/SO+BNmz3cx7JH8rpy96MkN68TqhhkQAOwqq4rTaQ2gLVQCaMMe6dn09kXVV52w+veGN7lLx138M0RfvshrMCGK8YVFx7NoGuVxVEKt
2bf9.secretescapes.com/	1970-01-20 18:22:14	Name: AWSALBCORS Value: btdyK/YY3aq/WWrK/UGEv/SO+BNmz3cx7JH8rpy96MkN68TqhhkQAOwqq4rTaQ2gLVQCaMMe6dn09kXVV52w+veGN7lLx138M0RfvshrMCGK8YVFx7NoGuVxVEKt
2bf9.secretescapes.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 89B8539636D6B04BEDFAF409C13B5466
be.secretescapes.com/	1970-01-20 18:12:11	Name: PersistedCookieAffiliateParam Value: be
.be.secretescapes.com/	1970-01-21 02:57:46	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Mon+Feb+05+2024+11%3A49%3A22+GMT%2B0100+(Central+European+Standard+Time)&version=6.26.0&isIABGlobal=false&hosts=&consentId=f08a1a95-7c44-42fd-a1d4-19bd7463f808&interactionCount=0&landingPath=https%3A%2F%2Fbe.secretescapes.com%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
.app.link/	1970-01-21 02:57:46	Name: _s Value: Mnejmc691zQ18OjRgyap7aSsoA3LZkXNvWm2cPvZ42ixQZY17%2B0%2F5d6yIRT1%2Fk%2Bq
be.secretescapes.com/	1970-01-20 18:12:11	Name: _sp_ses.54f3 Value: *
be.secretescapes.com/	1970-01-21 03:48:10	Name: _sp_id.54f3 Value: 6372ad8b-fe87-484d-a653-acf7fb94ec37.1707130162.1.1707130162.1707130162.827275c0-92eb-4f90-9496-032b945d3e6b
be.secretescapes.com/	1970-01-21 03:48:10	Name: gs_v_GSN-598443-L Value:
be.secretescapes.com/	1970-01-21 03:48:10	Name: gs_u_GSN-598443-L Value: 43a4c8b1f43001be5c95a5931e138f37:2567:5000:1707130162248
be.secretescapes.com/	1970-01-21 03:48:10	Name: gs_v_GSN-165617-W Value:
be.secretescapes.com/	1970-01-21 03:48:10	Name: gs_u_GSN-165617-W Value: 4dc80ac3deeed4429a39ce76d9c7b3ab:2567:5000:1707130162250
.secretescapes.com/	1970-01-20 18:13:36	Name: _uetsid Value: 38901920c41411eea636dd42c9878f5d
.secretescapes.com/	1970-01-21 03:33:46	Name: _uetvid Value: 38902170c41411ee9041ef748341b4eb
.doubleclick.net/	1970-01-21 03:33:46	Name: IDE Value: AHWqTUlagpqgFbmuLb33YeUy0DHAdYChqNA4wBjugmSpvExJorNwgkFFJuLseGJB
be.secretescapes.com/	1970-01-21 03:48:10	Name: _tq_id.TV-541818-1.54f3 Value: 1788de0a25c5e924.1707130162.0.1707130162..
.secretescapes.com/	1970-01-20 20:21:46	Name: _fbp Value: fb.1.1707130162321.758894193
.bing.com/	1970-01-21 03:33:46	Name: MUID Value: 00E23BE09CE562170E132FFC9D6E63A4
.secretescapes.com/	1970-01-21 03:40:07	Name: _hp2_id.1008163987 Value: %7B%22userId%22%3A%228766851942116486%22%2C%22pageviewId%22%3A%222574704996119002%22%2C%22sessionId%22%3A%228003330660837559%22%2C%22identity%22%3A%2227996229%22%2C%22trackerVersion%22%3A%224.0%22%2C%22identityField%22%3Anull%2C%22isIdentified%22%3A1%7D
.quantserve.com/	1970-01-21 03:42:24	Name: mc Value: 65c0bd32-7e5f9-fffb9-89dab
.secretescapes.com/	1970-01-21 03:36:38	Name: __qca Value: P0-1640983530-1707130162325
.secretescapes.com/	1970-01-21 02:57:46	Name: sp Value: ab2fcb2d-5876-42de-86d5-87f129dc575c
.secretescapes.com/	1970-01-21 02:57:46	Name: _hjSessionUser_5644 Value: eyJpZCI6ImFmOWU4Y2QzLWJiMWQtNWMxMi1iYjgxLTFmMTQzZDcyYTdhOCIsImNyZWF0ZWQiOjE3MDcxMzAxNjI2NjIsImV4aXN0aW5nIjpmYWxzZX0=
.secretescapes.com/	1970-01-20 18:12:11	Name: _hjSession_5644 Value: eyJpZCI6IjhkMmQ1ODY0LWRkYjUtNGUyMC05ZWQ2LTk1NDQ2ZTkyMzdjOSIsImMiOjE3MDcxMzAxNjI2NjMsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
service.force.com/	1970-01-21 02:57:46	Name: CookieConsentPolicy Value: 0:0
service.force.com/	1970-01-21 02:57:46	Name: LSKey-c$CookieConsentPolicy Value: 0:0
.force.com/	1970-01-21 02:57:46	Name: BrowserId_sec Value: OQ64y8QUEe6S2CkOo0mLtg
.secretescapes.com/	1970-01-21 03:48:10	Name: userty.core.p.560214 Value: __2VySWQiOiI2NDk2N2VjYjQ0Njk2ODc3MjhhNGQ1MjFhNTBiNjU4NiJ9eyJ1c
.secretescapes.com/	1969-12-31 23:59:59	Name: userty.core.s.560214 Value: __SI6MTcwNzEzMTk2MzYyMCwic2lkIjoiMWNkMDA2OWI4MWU2NTE0MTFiN2MxNjdlYzdkZjBhMWMiLCJzdCI6MTcwNzEzMDE2MzYyMCwicHYiOjEsInJlYWR5Ijp0cnVlLCJ3cyI6IntcIndcIjoxNjAwLFwiaFwiOjEyMDB9In0=eyJzZ
.secretescapes.com/	1970-01-20 18:12:11	Name: _hp2_ses_props.1008163987 Value: %7B%22us%22%3A%22newsletter%22%2C%22um%22%3A%22email%22%2C%22uc%22%3A%22SEGMENT_CORE_BE_ACT_01M%22%2C%22ua%22%3A%226703117%22%2C%22ts%22%3A1707130162463%2C%22d%22%3A%22be.secretescapes.com%22%2C%22h%22%3A%22%2Fthe-westin-grand-berlin-berlijn-duitsland-be%2Fsale-hotel%22%2C%22q%22%3A%22%3FnoPasswordSignIn%3Dtrue%26utm_medium%3Demail%26utm_source%3Dnewsletter%26utm_campaign%3D6703117%26utm_platform%3DITERABLE%26utm_content%3DSEGMENT_CORE_BE_ACT_01M%26copyVersion%3DathenaMonday_10%26messageId%3D712980f13b4549389d88f2ff55e4879f%22%7D

37 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/490917821102742?v=2.9.144&r=stable&domain=be.secretescapes.com&hme=44ba03e7b4a66084f0064fdada9e7a7b89f6f2cf807a204d10c6509aeae35209&ex_m=62%2C105%2C93%2C97%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C148%2C151%2C162%2C158%2C159%2C161%2C25%2C89%2C45%2C68%2C160%2C143%2C146%2C155%2C156%2C163%2C114%2C13%2C43%2C167%2C166%2C116%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C94%2C96%2C31%2C95%2C26%2C22%2C144%2C147%2C123%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C92%2C38%2C70%2C60%2C98%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C99(Line 95) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://be.secretescapes.com/the-westin-grand-berlin-berlijn-duitsland-be/sale-hotel?noPasswordSignIn=true&utm_medium=email&utm_source=newsletter&utm_campaign=6703117&utm_platform=ITERABLE&utm_content=SEGMENT_CORE_BE_ACT_01M&copyVersion=athenaMonday_10&messageId=712980f13b4549389d88f2ff55e4879f Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2bf9.secretescapes.com
api2.branch.io
app.link
bam.nr-data.net
bat.bing.com
be.secretescapes.com
bullfinch.orca-production.escapes.tech
c1.sfdcstatic.com
cdn-ukwest.onetrust.com
cdn.branch.io
cdn.heapanalytics.com
cdn.trustyou.com
client-api.auryc.com
collector-488.tvsquared.com
collector.secretescapes.com
connect.facebook.net
d.la1-core1.sfdc-cehfhs.salesforceliveagent.com
d.la3-c1-cdg.salesforceliveagent.com
d1gjxkdcqpo85.cloudfront.net
d1gkiy13jtzlp.cloudfront.net
d1l6p2sc9645hc.cloudfront.net
d1x3cbuht6sy0f.cloudfront.net
data.gosquared.com
geolocation.onetrust.com
googleads.g.doubleclick.net
heapanalytics.com
js-agent.newrelic.com
links.secretescapes.com
maps.googleapis.com
netdna.bootstrapcdn.com
o286415.ingest.sentry.io
pagead2.googlesyndication.com
pixel.quantserve.com
rules.quantcount.com
script.hotjar.com
seal.digicert.com
secretescapes-web.imgix.net
secure.quantserve.com
securepubads.g.doubleclick.net
service.force.com
sparrow-production.escapes.tech
static.hotjar.com
stats.g.doubleclick.net
survey.survicate.com
surveys-static.survicate.com
www.anrdoezrs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.yceml.net
108.138.26.116
13.224.103.67
13.224.98.155
13.32.145.50
13.48.230.177
142.250.186.34
151.101.2.137
160.8.246.31
162.247.241.14
18.164.52.95
18.165.183.103
18.165.183.127
18.165.185.71
2.19.96.145
23.212.222.60
2400:52e0:1e00::1080:1
2600:9000:2190:3c00:f:fd8f:b000:93a1
2600:9000:223c:d200:6:44e3:f8c0:93a1
2600:9000:25a2:1c00:16:c2f8:3640:93a1
2600:9000:25a2:3a00:11:f728:3040:93a1
2600:9000:25a2:de00:19:9934:6a80:93a1
2600:9000:2670:9600:9:9288:3940:21
2606:4700:4400::6812:2089
2606:4700::6812:bcf
2620:116:800d:21:93ca:31d8:d86e:38f6
2620:1ec:c11::200
2a00:1450:4001:806::2004
2a00:1450:4001:80f::200a
2a00:1450:4001:811::2008
2a00:1450:4001:812::2002
2a00:1450:4001:829::2002
2a00:1450:4001:829::2003
2a00:1450:4001:829::200e
2a00:1450:4001:82b::2002
2a00:1450:400c:c00::9a
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
2a04:4e42:8d::720
3.19.8.217
3.213.194.67
34.120.195.249
34.66.73.214
35.172.243.12
52.215.173.157
54.229.206.70
54.73.62.134
85.222.144.146
88.198.114.6
89.207.16.75
005a2e5a787ce93ce8cba94fe570fb08ad6cd346e3994c5231c8ff768bb449db
00622a3f6b799932f9235d9f517f1dfc8ee1d6a8197413ab3fe80c41b41888df
00b9242470bf0345e92739305b95d0ecd502bea9b2fb2b01d94f115f7aa2b231
00f993fa8da962e101c466681a2a88164bc3e6531bd854d6dddabae661bf3c38
0284b82fc74f4fd666a234fc2df3c7be10d49e40d9f5d238594f69b63c5d794d
03169b1ffe6dbba507a6c0a696dd7157d83149c92f9df45550f7e4424dc842ac
06c4be36a5fdfe10ebe883037bfe1556508ba6840e09414c81d7d87609de5dd8
0c96d1fb7a6223c5ed92691be302d79356e07d11f5b54f114fe6bb3f697c833d
0f570813f50cf217270b04a64a2efac52d11d14e74688df6116667e5d62a94cc
10a396cf83a1f0fa5ae02c199215e1b8e32fdb313f3d5e24c3e61a56f01e3eb5
11b97392fe91256a463d66e0a68f1ed068dd3ba2200289fa89e0afb2b0558b12
12834f596f899e7e17cc2a4a76a1ee77ea0f1ebbfb61e8a33dafe426327c71a3
135cc2fb726f9d5ba840faf6e0ff280e2bd7b6b28a2736bd6092c807cfbea88c
16163147b981591aaf106d436fd9e919d12be6211180288cd9e7d57e5838a87f
1b0adbbb380709fee064bb77ecb836587819f70e7f25ab603d70b179fc03c47b
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1df96aff7c1a0b4a1f03d51ec741df8d542fcf32eddee1a0295068e4a7f0017b
208e5d881a92d84ae1c0e296c5bafe669ec7ac8f87ede263ff5a84de441bdb55
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
22cf1baba55eced80d7ebb0de51fc8961757ef581964f8e10ebc8676399eba81
24acee9de6bc85e44a740bad4cb8eea53625382f00a54bfa4299301e27d8a83e
24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03
2516ffceaee624e95516f2caa7b8f25100993d94230e624c8ee7858a8552bcc9
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
28f2f1e071c298cc73af71d94709e5fd979345e7ab434da3e9961e8ad3f914ce
2b18192a287debcac96ef5cf0ffc45f720594a3c52a9c06a4478117871b21208
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
2f9b39d4685187f53d059fa79097782292ba1954f9e29d518adee023e86d90c1
34172e3b2c0f93498a2730933bc90740b38178cf10bd81b3164289d0445644a9
362502a1a510ab4f63553dd121e8294072dd692b19115b486ea490ffd9692e15
3838c6daf9173b1ede10b6a01b6bc46ae2d42a33e5f8b1ab3faa9412245d27c6
3b272e43c528bdb75ea6aacc0fdd09ce62573a3849869f7ea80d532de6a8c57d
3c16fc21880b56d5ae8783c46b0b271507904ff42de6f9622ea703f56ad6b44b
3c2a0467aeca8bd143140bce67fe6032e1566f883ba0e6e88c72eb844f3f75e5
4122aee7c57ab0686985ab920ad3c60b994eadf8e3d12602faa5bb86976a9cf9
4399506a0eaed1b15507f0815e5a2cbc2e5f1b3972d2a2239104dfceb3add800
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45a4c240a17a4d5f925ef0e125b86d882c6ad7549028d9cbf6f4f06fd1dd897d
4958637042aaa610e9281e81da05cb0ac6481e9af9d3a93282fb686496c289d8
4be1addf4ee8c28eff431ef8bfbc475913c1234f6315c50047bc1eda86de71f3
4dc5765cdda9b83636c0fbdbdff1eeeeb758f9e9d1e9d9f5a536cf6e5aa04a8a
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
539d31be34476b9a223e54e1387a469269c96b8506ab42a5eecb9055a08e5e84
5728495d2601a39470dc2b0a733da95310262d18ace8fec85a21c39a42abcc09
5d5a939e07d68b1a73090b4a66812ba68b1040a699b6c3c8b205e9c890aad883
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
6031b1d51dca8d2985b61d2117e6f8f66e89cc645b6e658748698baf842f3102
61b1f95fd4b77f7674f18aca5e867efb6e1ca58026ae61cc43f0f7b86d05743d
663d4916c87ca09caf5dc6f20ac57e5e455a4a223381d5fec9df61e3f1e8f851
66aff367a4940439b2a9d6b74fdf195d46370a50882a7ac927031300a29ff07e
66db52b456efe7e29cec11fa09421d03cb09e37ed1b567307ec0444fd605ce31
694b5ce9fa562ced9521e4abd8229b7924c73bbf22290feacecc92ee970c1e9d
69ed29337ff755bfe7e578c418298fba669383ba6b404879579302a96e63a7cd
6a40be594a03b95b44fbff08cbcc9113fe1dabf9ff2e010d5c78fcc6385f06c5
70071847d81c44d65bf760c7ae7fae26acb83c783debc143504661267b295cff
70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf
7198676c853129c2e028be8f977b5002caf99147b2e8e1f439827625bfcc17e1
721f2d2fe18f13edc2ae51c1918c1b0a2d7b668318c559310ab35fa22363fdad
7c273510050e27ad1e0a533b0a766c6c597575710d578a104e60d4810e173648
7c7905fa4092da87b39e2aa1c7d3f696ebf7e7fa804b8c3e3181db748adff895
81f277888d1ee510668666fb819bcf637e488b613dac15cf78cbe9d1ac41658c
8323bfef9e28b0e6c295cfa977198ae73a723cc5cc8d11644b7fdc3f08b9ce62
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83cad37f70113f7b8bbb98c2ef8ee949f9a611e402e55ee826aef65130f2ef77
849b8f7edd8e7ffe61b451b0ef2aabbf935c417c22477f0760818c23a41f2ab7
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
851c91a5015b2ccdaf00a43b728393a5f866aa523ce40b048a394e03f188cb65
85f11d2681542bc069395bf9b6270308cebf033fefadd4639cbb0ee984ae36f4
8793c2e024b1255458ae2560631039c9f4564dc41af0ed58aab909f277042387
87d6787adaaa25a669cc55cff0acb5f51588a8c7482fd68192f20940117db52a
89b2d81727b4925c50544ce1e4cda18f39f79953e26b81f5360b71929cbd481f
8c7580a1ae7f5cfe72bb6fbaa401f4fde96b023d65607ec8019ea1f44731ef28
8e163da28e94bd6324cf834921768618ccc663dd664feb1e7ec40a2a3bd58aac
90bd352fbed38b00ff4ca1ce047e70778fc4880a61adf35fd6074f5186cf0927
90ee0ccf6d335dcf9e4e65b163d938d71574d6804a9d99325abfc4967b57273f
958e8cedb86e865e70954332cc3993dbf6f2738cd75eed224b5b69cbb2caf4fc
96a7bad920954f1a56feb502bbeea1fca29c5918d4a7d371f541ceb0c5a9c956
972688e6f6c24d2b23019a796b19f90515ba5f4ff744747c072b79fa44de3432
99b4172bdc5499ead6638e7e90e52f88fa905993c10712cfba6c021d7215c1f8
9e46f2b4c0e3d15094ecf98ddbeaaf622c36f87f7cd4e34c12f9ac153509dd5e
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4
a6396c87237142727a6c8ba8425dcbb0beeccf4a3104f48262d1fb55ae522904
a673b1daa1a99ccbfdeac10136efa4ed9c5cbc1531db9b84c74597365f76b00c
a6d75aad5c009d0bdf36d4c1d68d90e2848460fce782adb137819228842eefe0
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
ace874eec4f30ab747a05ee3ef7a9acfbfb93c0501824bddd8e20da97fc8f601
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b104e242e4b08e9fce2257dd5a4058cd724a4eaccf1f6948f533978f4596caa7
b26a37736a1c5a3e268b492a0b89a278c88208bdf6ea88543c0720c0317854c8
b4258708953843a87a8c843b678174120dc2e6f932cab6714a65607ef7cbe35c
b42c7aca00c7adb75fae817fe4b77b44c4fe3a7bbad7b1d03df52dcb080ba528
b53e3612ec0c13865c23840345d1dc4d4d6ed079f1ae1a2d99b1a69800ac5d8e
b63b24c84ad13bbcaecdf53136b9ae7b7062997af7bf725b30681706487a8fd3
bacc23ae416ef150be09288d366d689a7678849b04094552e67d8e2a032ad5a0
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbfb9a0b9b17db4c1345f22ee840d0e79b683ba3af2e72fa7f32348852e9f9b6
bc040dea8e1070e1f9dfe619974d9d805b7cc56121fc3602fda6abc9ebe8c1d1
bd9d68d5f1fd010ffa592493f6993df3f33b9965574d3fe530cc1a5729375955
bea9f9f409351db609486cf6524ca1d4ac9d6ce5a4fbbb79e0482e7c44b574a8
c196145c1b7fc92ddc164e1a0346a1c8f33aace392a999bf002587942b19c512
c6700222a07bb785e1bcc832bbda73f56f463991ac4d0f26fc3fef30822faca9
c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f
ce78923b92f4f90b5b9e2de878b7bf61f89b575ebefb42f93ea30f55f6599c37
cfb0c6459c4eac17a86b8f68be81c2cab2a9616b30769435725df0ba60bcbe68
cfeea310c53dd49cef2aa71a7c2bc9b165e4642a19723c415f08c5c8e0cfa9a6
d087ba53e72b1c104402c111bd3f85fe16882ea79bfbff7cfcf17e3acfe94340
d14060b7a4a59f2830244a1d1a995d2e57178b6a78530551dd8f5541e219782a
d635b207ad106de4d149775b4f2def4e1ca5c42d23f18983645a9f4fbc58e232
d8443fb0e33c182aa1be2a92491d392c44ee46f2c1d51ab8d3648a1d25877d90
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e1272c01e01a319c147d2ea1748013b09c189c398fd590034d3f1025fa805371
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4ea46fe174609ff5f5460eaebd4e1eb98763b1cda636af69238922be0f51d7a
e4f02e9d367192c2c79c674f41b7eae83bcfe93c4e6fcfc5e7d1e34cfa2b7d00
e5caee2da23bdc5b1c7b3858048642b3437d8450933d899f0faa98b0ff7b7cb9
e827ccf9d252464aa5228e0c980cd971c4bddbd2d79bb4494a340cb58382f648
e88e6ff41cc33fad7f855856b89723693705aff0611642b164e43b78dbcc93f4
e9c5d027bf81d8cd06cbd8b21ff70f91addee2329c0e70c3ce2d47ccd8665fe3
eb2ad463e0fd390d63acc0e4e0c064cd787cab3ee5711fc9e6e203ad1429d4c0
ecb244f676677252c58d2eccb58f1b0b87b5dd6baab45d29d46dba74c823b7f2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef4dcc4dab4d780f44939c455d4720cab662b2f5fabc36ebc33a21f4cdbecd4e
f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660
f0d6e1f670af3e26033d287319c2585f43a562b46f5a9855c26f3faaa79178e5
f0fd989d3d400af9d0e449aecf31cef85e4ed7394306b79f8d8fde69bc907750
f2863821119660d61dea8c3d9024b49b3cf368a87f54fada27a95379f20ce92b
f64a07c1285bce1ed91c20e74c222603820c0aa479b7fa6564ebfb82f0b442f8
fc19a08416b2f45f777d461007a538b3f14f1fbf9032933efd38f8e2eba0fc13
fe2c8e1464e377e0e004cae5ca02498a306b7090feddbd3abe14d088c5a7bc19

be.secretescapes.com Open in urlscan Pro 54.73.62.134 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

168 Requests

97 %HTTPS

47 %IPv6

37 Domains

53 Subdomains

48 IPs

8 Countries

2809 kBTransfer

8495 kBSize

57 Cookies

8 Outgoing links

Page URL History

Redirected requests

168 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

be.secretescapes.com Open in urlscan Pro
54.73.62.134 Public Scan

Screenshot
Live screenshot

Full Image

168
Requests

97 %
HTTPS

47 %
IPv6

37
Domains

53
Subdomains

48
IPs

8
Countries

2809 kB
Transfer

8495 kB
Size

57
Cookies

168 HTTP transactions
1 data transactions