urlscan.io logo urlscan.io
SecurityTrails logo

www.castlehotsprings.com Open in urlscan Pro
34.224.19.33  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://castlehotsprings.com/
Effective URL: https://www.castlehotsprings.com/
Submission: On February 16 via api from CH — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 39 IPs in 3 countries across 38 domains to perform 89 HTTP transactions. The main IP is 34.224.19.33, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.castlehotsprings.com.
TLS certificate: Issued by Amazon on August 27th 2021. Valid for: a year.
This is the only time www.castlehotsprings.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 34.230.184.69 14618 (AMAZON-AES)
7 34.224.19.33 14618 (AMAZON-AES)
7 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
5 52.217.175.24 16509 (AMAZON-02)
9 2a00:1450:400... 15169 (GOOGLE)
3 104.17.209.240 13335 (CLOUDFLAR...)
5 2a00:1450:400... ()
1 2a00:1450:400... ()
4 2a00:1450:400... ()
1 4 2620:1ec:c11:... ()
4 2606:4700::68... ()
1 2600:9000:223... ()
2 2a03:2880:f02... ()
2 2600:9000:225... ()
2 2a00:1450:400... ()
2 6 193.0.160.128 ()
1 2a00:1450:400... ()
1 2a00:1450:400... ()
2 44.241.33.207 ()
2 2a03:2880:f12... ()
3 20.85.30.134 ()
1 2 52.142.114.2 ()
3 3 142.250.181.226 ()
1 2 37.252.172.249 ()
1 2 104.111.215.191 ()
1 69.173.144.139 ()
1 2 52.19.204.92 ()
1 3.122.214.165 ()
1 104.107.160.24 ()
1 3.120.63.34 ()
1 1 13.32.121.105 ()
1 3 35.244.174.68 ()
1 3.229.229.140 ()
1 2 72.247.225.98 ()
1 2 185.94.180.125 ()
1 2600:1f18:612... ()
1 3.9.96.172 ()
1 54.76.155.32 ()
1 2 35.211.178.172 ()
2 2 151.101.194.49 ()
89 39
1    34.230.184.69 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-230-184-69.compute-1.amazonaws.com
castlehotsprings.com
7    34.224.19.33 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-224-19-33.compute-1.amazonaws.com
www.castlehotsprings.com
7    2606:4700::6810:9540 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.cookielaw.org
2    2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700:10::6814:b944 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
5    52.217.175.24 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
9    2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
3    104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)
zn78tbmxiy2tfhadv-screenpilot.siteintercept.qualtrics.com
siteintercept.qualtrics.com
5    2a00:1450:4001:82b::2004 (None, )

ASN- ()
www.google.com
1    2a00:1450:4001:831::2008 (None, )

ASN- ()
www.googletagmanager.com
4    2a00:1450:4001:827::2003 (None, )

ASN- ()
www.gstatic.com
4    2620:1ec:c11::200 (None, )

ASN- ()
bat.bing.com
c.bing.com
4    2606:4700::6813:9308 (None, )

ASN- ()
script.crazyegg.com
1    2600:9000:223c:4800:1:76cf:fe80:93a1 (None, )

ASN- ()
c1.rfihub.net
2    2a03:2880:f02d:100:face:b00c:0:3 (None, )

ASN- ()
connect.facebook.net
2    2600:9000:2251:1400:16:3eaa:9140:93a1 (None, )

ASN- ()
assets.navisperformance.com
2    2a00:1450:4001:808::200e (None, )

ASN- ()
www.google-analytics.com
6    193.0.160.128 (None, )

ASN- ()
20827576p.rfihub.com
a.rfihub.com
p.rfihub.com
1    2a00:1450:400c:c06::9b (None, )

ASN- ()
stats.g.doubleclick.net
1    2a00:1450:4001:829::2003 (None, )

ASN- ()
www.google.de
2    44.241.33.207 (None, )

ASN- ()
fusion-api.navisperformance.com
2    2a03:2880:f12d:181:face:b00c:0:25de (None, )

ASN- ()
www.facebook.com
3    20.85.30.134 (None, )

ASN- ()
j.clarity.ms
2    52.142.114.2 (None, )

ASN- ()
c.clarity.ms
3    142.250.181.226 (None, )

ASN- ()
cm.g.doubleclick.net
2    37.252.172.249 (None, )

ASN- ()
ib.adnxs.com
2    104.111.215.191 (None, )

ASN- ()
stags.bluekai.com
x.dlx.addthis.com
1    69.173.144.139 (None, )

ASN- ()
pixel.rubiconproject.com
2    52.19.204.92 (None, )

ASN- ()
dpm.demdex.net
1    3.122.214.165 (None, )

ASN- ()
ps.eyeota.net
1    104.107.160.24 (None, )

ASN- ()
contextual.media.net
1    3.120.63.34 (None, )

ASN- ()
bs.serving-sys.com
1    13.32.121.105 (None, )

ASN- ()
live.rezync.com
3    35.244.174.68 (None, )

ASN- ()
idsync.rlcdn.com
1    3.229.229.140 (None, )

ASN- ()
bpi.rtactivate.com
2    72.247.225.98 (None, )

ASN- ()
dsum-sec.casalemedia.com
2    185.94.180.125 (None, )

ASN- ()
sync.search.spotxchange.com
1    2600:1f18:612b:4264:3ca:5412:4ba5:20da (None, )

ASN- ()
partners.tremorhub.com
1    3.9.96.172 (None, )

ASN- ()
aa.agkn.com
1    54.76.155.32 (None, )

ASN- ()
beacon.krxd.net
2    35.211.178.172 (None, )

ASN- ()
x.bidswitch.net
2    151.101.194.49 (None, )

ASN- ()
sync-tm.everesttech.net
Apex Domain
Subdomains		 Transfer
13 gstatic.com
fonts.gstatic.com
www.gstatic.com
542 KB
8 castlehotsprings.com
castlehotsprings.com
www.castlehotsprings.com
582 KB
7 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 443
115 KB
6 rfihub.com
20827576p.rfihub.com
a.rfihub.com
p.rfihub.com
9 KB
5 clarity.ms
j.clarity.ms
c.clarity.ms
24 KB
5 google.com
www.google.com
41 KB
5 amazonaws.com
s3.amazonaws.com
1 MB
4 doubleclick.net
stats.g.doubleclick.net
cm.g.doubleclick.net
1 KB
4 navisperformance.com
assets.navisperformance.com
fusion-api.navisperformance.com
14 KB
4 crazyegg.com
script.crazyegg.com
29 KB
4 bing.com
bat.bing.com
c.bing.com
13 KB
3 rlcdn.com
idsync.rlcdn.com
1010 B
3 qualtrics.com
zn78tbmxiy2tfhadv-screenpilot.siteintercept.qualtrics.com
siteintercept.qualtrics.com — Cisco Umbrella Rank: 1020
22 KB
2 everesttech.net
sync-tm.everesttech.net
607 B
2 bidswitch.net
x.bidswitch.net
1 KB
2 spotxchange.com
sync.search.spotxchange.com
1 KB
2 casalemedia.com
dsum-sec.casalemedia.com
2 KB
2 demdex.net
dpm.demdex.net
2 KB
2 adnxs.com
ib.adnxs.com
2 KB
2 facebook.com
www.facebook.com
425 B
2 google-analytics.com
www.google-analytics.com
20 KB
2 facebook.net
connect.facebook.net
114 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35
4 KB
1 krxd.net
beacon.krxd.net
337 B
1 agkn.com
aa.agkn.com
238 B
1 tremorhub.com
partners.tremorhub.com
183 B
1 addthis.com
x.dlx.addthis.com
191 B
1 rtactivate.com
bpi.rtactivate.com
109 B
1 rezync.com
live.rezync.com
786 B
1 serving-sys.com
bs.serving-sys.com
105 B
1 media.net
contextual.media.net
614 B
1 eyeota.net
ps.eyeota.net
344 B
1 rubiconproject.com
pixel.rubiconproject.com
239 B
1 bluekai.com
stags.bluekai.com
676 B
1 google.de
www.google.de
501 B
1 rfihub.net
c1.rfihub.net
6 KB
1 googletagmanager.com
www.googletagmanager.com
74 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 709
457 B
89 38
Domain Requested by
9 fonts.gstatic.com fonts.googleapis.com
www.google.com
7 cdn.cookielaw.org www.castlehotsprings.com
cdn.cookielaw.org
7 www.castlehotsprings.com www.castlehotsprings.com
5 www.google.com www.castlehotsprings.com
www.gstatic.com
www.google.com
5 s3.amazonaws.com www.castlehotsprings.com
4 p.rfihub.com 2 redirects
4 script.crazyegg.com www.googletagmanager.com
script.crazyegg.com
4 www.gstatic.com www.google.com
www.gstatic.com
3 idsync.rlcdn.com 1 redirects
3 cm.g.doubleclick.net 3 redirects
3 j.clarity.ms bat.bing.com
j.clarity.ms
3 bat.bing.com www.googletagmanager.com
bat.bing.com
2 sync-tm.everesttech.net 2 redirects
2 x.bidswitch.net 1 redirects
2 sync.search.spotxchange.com 1 redirects
2 dsum-sec.casalemedia.com 1 redirects
2 dpm.demdex.net 1 redirects
2 ib.adnxs.com 1 redirects
2 c.clarity.ms 1 redirects
2 www.facebook.com
2 fusion-api.navisperformance.com assets.navisperformance.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 assets.navisperformance.com www.castlehotsprings.com
assets.navisperformance.com
2 connect.facebook.net www.castlehotsprings.com
connect.facebook.net
2 siteintercept.qualtrics.com zn78tbmxiy2tfhadv-screenpilot.siteintercept.qualtrics.com
siteintercept.qualtrics.com
2 fonts.googleapis.com www.castlehotsprings.com
1 beacon.krxd.net
1 aa.agkn.com
1 partners.tremorhub.com
1 x.dlx.addthis.com
1 bpi.rtactivate.com
1 live.rezync.com 1 redirects
1 bs.serving-sys.com
1 contextual.media.net
1 ps.eyeota.net
1 pixel.rubiconproject.com
1 stags.bluekai.com 1 redirects
1 a.rfihub.com
1 c.bing.com 1 redirects
1 www.google.de
1 stats.g.doubleclick.net www.google-analytics.com
1 20827576p.rfihub.com c1.rfihub.net
1 c1.rfihub.net www.castlehotsprings.com
1 www.googletagmanager.com www.castlehotsprings.com
1 zn78tbmxiy2tfhadv-screenpilot.siteintercept.qualtrics.com www.castlehotsprings.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 castlehotsprings.com 1 redirects
89 47
Subject Issuer Validity Valid
castlehotsprings.com
Amazon		 2021-08-27 -
2022-09-25		 a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3		 2021-06-01 -
2022-05-31		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-01-17 -
2022-04-11		 3 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3		 2022-01-12 -
2023-01-12		 a year crt.sh
s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2021-06-23 -
2022-07-24		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2022-01-17 -
2022-04-11		 3 months crt.sh
*.qualtrics.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-24 -
2022-09-24		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-01-17 -
2022-04-11		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-02-07 -
2022-05-02		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-01-17 -
2022-04-11		 3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 01		 2021-12-22 -
2022-06-22		 6 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-05-09 -
2022-05-08		 a year crt.sh
*.rfihub.net
Amazon		 2021-12-29 -
2023-01-27		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-11-25 -
2022-02-23		 3 months crt.sh
*.navisperformance.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-04-27 -
2022-05-23		 a year crt.sh
*.rfihub.com
Sectigo RSA Domain Validation Secure Server CA		 2020-06-18 -
2022-06-18		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-01-17 -
2022-04-11		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-01-17 -
2022-04-11		 3 months crt.sh
a.clarity.ms
Microsoft RSA TLS CA 01		 2021-07-27 -
2022-07-27		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-30 -
2022-04-04		 a year crt.sh
*.media.net
DigiCert SHA2 Secure Server CA		 2021-04-12 -
2022-04-20		 a year crt.sh
bs.serving-sys.com
Amazon		 2021-05-10 -
2022-06-08		 a year crt.sh
rtactivate.com
Amazon		 2021-05-13 -
2022-06-11		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
odc-pixel-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2021-11-24 -
2022-04-26		 5 months crt.sh
*.tremorhub.com
Amazon		 2021-06-27 -
2022-07-26		 a year crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2020-07-25 -
2022-09-18		 2 years crt.sh
beacon.krxd.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-03 -
2022-11-02		 a year crt.sh

This page contains 4 frames:

Primary Page: https://www.castlehotsprings.com/
Frame ID: 2E4F29103EBA210C92ED2177C2EA97EE
Requests: 71 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&co=aHR0cHM6Ly93d3cuY2FzdGxlaG90c3ByaW5ncy5jb206NDQz&hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ&size=invisible&cb=wlvgh3oq0p30
Frame ID: A247096BAC32D18CDB747EC9F5175B57
Requests: 8 HTTP requests in this frame

Frame: https://20827576p.rfihub.com/ca.html?ver=9&rb=39961&ca=20827576&_o=39961&_t=20827576&pe=https%3A%2F%2Fwww.castlehotsprings.com%2F&pf=&ra=05202067078941841
Frame ID: 419696A014719227E8EC12B7B82608AF
Requests: 20 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 1FD9811335AB92EC937D8434B80E305D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Welcome to Castle Hot Springs | Arizona Luxury ResortBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

  1. http://castlehotsprings.com/ HTTP 301
    https://www.castlehotsprings.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • script\.crazyegg\.com/pages/scripts/\d+/\d+\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • serving-sys\.com/
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

89
Requests

87 %
HTTPS

40 %
IPv6

38
Domains

47
Subdomains

39
IPs

3
Countries

2835 kB
Transfer

6019 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://castlehotsprings.com/ HTTP 301
    https://www.castlehotsprings.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?CtsSyncId=DAD831BABF8B4EDA81146EB5CF2D0B86&RedC=c.clarity.ms&MXFR=2166791E5E8F6B230C8168535A8F653E HTTP 302
  • https://c.clarity.ms/c.gif?CtsSyncId=DAD831BABF8B4EDA81146EB5CF2D0B86&MUID=025B7FBDFA6A611F278A6EF0FBB860BA
Request Chain 73
  • https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTEzMTA3NzcyMDY2MDEyOTAxMw==&forward= HTTP 302
  • https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTEzMTA3NzcyMDY2MDEyOTAxMw==&forward=&google_tc= HTTP 302
  • https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESECVTQs-42zxCf9Fjvq_4u2c&google_cver=1
Request Chain 74
  • https://ib.adnxs.com/setuid?entity=18&code=5131077720660129013 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D5131077720660129013
Request Chain 75
  • https://stags.bluekai.com/site/4722?id=5131077720660129013&redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fbk_uuid%3D%24_BK_UUID%26forward%3D HTTP 302
  • https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
Request Chain 77
  • https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5131077720660129013&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5131077720660129013&redir=
Request Chain 78
  • https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
  • https://ps.eyeota.net/match?uid=5131077720660129013&bid=omt9pi0
Request Chain 81
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5131077720660129013&referrer=https%3A%2F%2Fwww.castlehotsprings.com%2F HTTP 302
  • https://p.rfihub.com/cm?pub=39342&in=0&userid=6eb43f00-33ca-49c8-a8ed-5fcd4fe28b2f%3A1645031110.24&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D6eb43f00-33ca-49c8-a8ed-5fcd4fe28b2f%253A1645031110.24 HTTP 302
  • https://idsync.rlcdn.com/501709.gif?partner_uid=6eb43f00-33ca-49c8-a8ed-5fcd4fe28b2f%3A1645031110.24 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEL2jVEuwc6iw4kuPnflPPi8&google_cver=1
Request Chain 83
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5131077720660129013&forward= HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5131077720660129013&forward=&C=1
Request Chain 86
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5131077720660129013&img=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5131077720660129013&img=1&__user_check__=1&sync_id=993fb028-8f4a-11ec-a4ff-10b91cd50206
Request Chain 90
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=5131077720660129013&expires=30 HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5131077720660129013&expires=30
Request Chain 91
  • https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=Yg0uxgAGsVB-SQBB HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=21653&userid=Yg0uxgAGsVB-SQBB&_test=Yg0uxgAGsVB-SQBB

89 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.castlehotsprings.com/
Redirect Chain
  • http://castlehotsprings.com/
  • https://www.castlehotsprings.com/
1 MB
186 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.19.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-224-19-33.compute-1.amazonaws.com
Software
nginx / PHP/7.4.3
Resource Hash
533a9c2a5cede315eb2fff0e36c82e55c5709d0885ece44a86107ef58df2375b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Wed, 16 Feb 2022 17:05:03 GMT
content-type
text/html; charset=UTF-8
server
nginx
x-powered-by
PHP/7.4.3
link
<https://www.castlehotsprings.com/wp-json/>; rel="https://api.w.org/" <https://www.castlehotsprings.com/>; rel=shortlink
vary
Accept-Encoding
content-encoding
gzip

Redirect headers

Server
nginx
Date
Wed, 16 Feb 2022 17:05:02 GMT
Content-Type
text/html; charset=iso-8859-1
Content-Length
327
Connection
keep-alive
Location
https://www.castlehotsprings.com/
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
134482ec36c8980c2c7a3f2454c76546abcd612c9ae596d011251a7cd1d0fcbb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Feb 2022 17:05:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
zadN1tnUFXNBOXe6vsJdDg==
age
8177
vary
Accept-Encoding
content-length
6456
x-ms-lease-status
unlocked
last-modified
Wed, 16 Feb 2022 14:19:43 GMT
server
cloudflare
etag
0x8D9F15760A3EA92
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
c1e1c68e-b01e-00cc-5244-23bc53000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6de85bce9fa6f923-MXP
css
fonts.googleapis.com/ 		79 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Petit+Formal+Script%7CPlayfair+Display%3A400%2C700%7CMontserrat%3A300%2C500%2C600%2C800%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CMontserrat%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
9ff4de814c70b7af99aceffe43d1800a4b6f1aa90ab7ce31ed31c00b3ca57f90
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 16 Feb 2022 17:05:03 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 16 Feb 2022 17:05:03 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 16 Feb 2022 17:05:03 GMT
dashicons.min.css
www.castlehotsprings.com/wp-includes/css/ 		46 KB
28 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.castlehotsprings.com/wp-includes/css/dashicons.min.css
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.19.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-224-19-33.compute-1.amazonaws.com
Software
nginx /
Resource Hash
18aa66c192cbef43a61b1398c292ae5c6c1d40d679428ee998b1c6bfaf61d75a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:03 GMT
content-encoding
gzip
last-modified
Thu, 12 Nov 2020 12:03:35 GMT
server
nginx
etag
"b9c6-5b3e7b39113c0-gzip"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
28481
expires
Thu, 16 Feb 2023 17:05:03 GMT
autoptimize_2328c3aae34c7ddae85f5897c39bbd4e.js
www.castlehotsprings.com/wp-content/cache/autoptimize/js/ 		645 KB
170 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.castlehotsprings.com/wp-content/cache/autoptimize/js/autoptimize_2328c3aae34c7ddae85f5897c39bbd4e.js
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.19.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-224-19-33.compute-1.amazonaws.com
Software
nginx /
Resource Hash
737beff8087eb07be7bb901785cc1bad100c6aac415eb129e8424d94dd89490d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:03 GMT
content-encoding
gzip
last-modified
Thu, 27 Jan 2022 15:41:05 GMT
server
nginx
etag
"a149c-5d6922574c6fb-gzip"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=30672000
accept-ranges
bytes
expires
Mon, 06 Feb 2023 17:05:03 GMT
css
fonts.googleapis.com/ 		20 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400italic,400,600italic,600|Montserrat:400,700&display=swap
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4d7dd58a837ee0b61b8b69e8aaf538ae109ec48807d54e527fc9728e3e0527f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 16 Feb 2022 17:05:03 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 16 Feb 2022 17:05:03 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 16 Feb 2022 17:05:03 GMT
257d34cd-fc96-408e-9692-5ff58828510a.json
cdn.cookielaw.org/consent/257d34cd-fc96-408e-9692-5ff58828510a/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/257d34cd-fc96-408e-9692-5ff58828510a/257d34cd-fc96-408e-9692-5ff58828510a.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
923d2891646bf945550890db729f1e91de25e10d44da68c0ec4c1461cd93e56e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Feb 2022 17:05:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
content-md5
iafW2nJzFxM2TDA1z7aYag==
vary
Accept-Encoding
content-length
1355
x-ms-lease-status
unlocked
last-modified
Thu, 27 Jan 2022 17:25:42 GMT
server
cloudflare
etag
0x8D9E1BA0BC98557
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
92fc73ef-401e-005a-1aad-22de67000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6de85bcf2f990e1e-MXP
expires
Wed, 16 Feb 2022 21:05:03 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		182 B
457 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.castlehotsprings.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:04 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6de85bd03ce20f6e-MXP
access-control-allow-headers
Content-Type
truncated
/ 		82 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7e41ca21e421f129d3881e345f990027b66c0ab3c5580e549575f9393d117cbd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
701ce714253c2c6dc6c5d3d19a9cc8522fe426280400d21ce1a1dfdfb7396cf7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
logo-3.svg
s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2021/01/11013609/ 		7 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2021/01/11013609/logo-3.svg
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.175.24 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
701ce714253c2c6dc6c5d3d19a9cc8522fe426280400d21ce1a1dfdfb7396cf7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:05 GMT
Content-Encoding
gzip
Last-Modified
Mon, 11 Jan 2021 08:36:11 GMT
Server
AmazonS3
x-amz-request-id
KKDCJZT8WXCGGH0Y
ETag
"6c13280cfdd8b71e17a59501862d7471"
Content-Type
image/svg+xml
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Length
3170
x-amz-id-2
+m6V8mZisocpCXWuNpjLC8rVdxvQJWXtdDQJAwxlEcLzwYw35HHGPLogusICqgfHp7jkuVlDyv8=
Expires
Tue, 11 Jan 2022 08:36:10 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400italic,400,600italic,600|Montserrat:400,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 00:14:34 GMT
x-content-type-options
nosniff
age
60630
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44656
x-xss-protection
0
last-modified
Thu, 28 Oct 2021 00:30:43 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 16 Feb 2023 00:14:34 GMT
metropolis-medium-webfont.woff2
www.castlehotsprings.com/wp-content/themes/camyno-child/fonts/metropolis/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.castlehotsprings.com/wp-content/themes/camyno-child/fonts/metropolis/metropolis-medium-webfont.woff2
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.19.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-224-19-33.compute-1.amazonaws.com
Software
nginx /
Resource Hash
7b044cb4d18d5e4838323e019603bae878043d3ad9c3228e9312dc359a2a86b0

Request headers

Referer
https://www.castlehotsprings.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:04 GMT
last-modified
Thu, 12 Nov 2020 12:03:29 GMT
server
nginx
etag
"3b10-5b3e7b3358640"
content-type
font/woff2
cache-control
max-age=31536000
accept-ranges
bytes
content-length
15120
expires
Thu, 16 Feb 2023 17:05:04 GMT
theme-icons.woff
www.castlehotsprings.com/wp-content/themes/camyno/assets/font/ 		102 KB
103 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.castlehotsprings.com/wp-content/themes/camyno/assets/font/theme-icons.woff?14452142
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.19.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-224-19-33.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e9a8d4e0b7326da6e4b9cd66c1298222e619909afb9acf75d62245da979915b7

Request headers

Referer
https://www.castlehotsprings.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:04 GMT
last-modified
Thu, 12 Nov 2020 12:03:29 GMT
server
nginx
etag
"1994c-5b3e7b3358640"
content-type
font/woff
cache-control
max-age=31536000
accept-ranges
bytes
content-length
104780
expires
Thu, 16 Feb 2023 17:05:04 GMT
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
78cad699eb81d74876ec2984ed96e693267d5cc99644fda4de977da6de1c237c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		69 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
945c82ffd2df26ef6ef8a227e1ceb6c37e48062f66921867d3c8e3788bd4bc9d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
186760d0c61c24ba02aa6f2a7e7215b128648caadc0a30419808461054977942

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		69 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eda63d887350cf17e48c7777bd8bc8f36e88d2e900a2cabb12c692c921ff628b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d15cd8460171bcc77be7b2e35f104c81ab4ad051f1477ef7a06064405f58d0cf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4fb964155d4de85031dbb9bbec2e3c3089829c15bc8ec88336884854bf5c024c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
843d5ebf4904a4d7cf46275c48fc52fa4bbea6b0f9291fd3efdf13572c1fc32f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
2021_TL_WBA_SIMPLE_BLACK-WINNER-1-ONLY-copy-150x150.png.webp
s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2021/09/14163858/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2021/09/14163858/2021_TL_WBA_SIMPLE_BLACK-WINNER-1-ONLY-copy-150x150.png.webp
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.175.24 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
321954a54fea26ec3f073b7efa01bfe5f1bd1fbc1e021016ff0d0a8d71132259

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:05 GMT
Last-Modified
Tue, 14 Sep 2021 22:39:02 GMT
Server
AmazonS3
x-amz-request-id
KKD3V3DQKXVS4MGE
ETag
"2861459040518231ca76eda9c039eaf9"
Content-Type
image/webp
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Length
5278
x-amz-id-2
ze4BswkYQdO8Vuu8Tqvi2Al9UGgfRfpRk8/64/0loccNUIExk17Tx/tEHXUzDJQ2PUnJnXZmwB0=
Expires
Wed, 14 Sep 2022 22:39:01 GMT
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v23/ 		30 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v23/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Petit+Formal+Script%7CPlayfair+Display%3A400%2C700%7CMontserrat%3A300%2C500%2C600%2C800%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CMontserrat%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c8f7c04f8d691138d54380550d91349271ca19cfc0f3f6666c401cfa892a12f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 08:55:44 GMT
x-content-type-options
nosniff
age
29360
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30876
x-xss-protection
0
last-modified
Thu, 03 Feb 2022 00:11:59 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 16 Feb 2023 08:55:44 GMT
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Petit+Formal+Script%7CPlayfair+Display%3A400%2C700%7CMontserrat%3A300%2C500%2C600%2C800%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CMontserrat%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 11:22:37 GMT
x-content-type-options
nosniff
age
20547
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15732
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:20 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 16 Feb 2023 11:22:37 GMT
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v27/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v27/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400italic,400,600italic,600|Montserrat:400,700&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f57a038a716263766ff4d7f7d8a6ea13b22701ae6fc91e8b1b52fd8784844d23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 11:03:59 GMT
x-content-type-options
nosniff
age
108065
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47836
x-xss-protection
0
last-modified
Thu, 28 Oct 2021 00:32:23 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 15 Feb 2023 11:03:59 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Petit+Formal+Script%7CPlayfair+Display%3A400%2C700%7CMontserrat%3A300%2C500%2C600%2C800%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CMontserrat%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 18:59:49 GMT
x-content-type-options
nosniff
age
79515
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 15 Feb 2023 18:59:49 GMT
eicons.woff2
www.castlehotsprings.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/ 		79 KB
80 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.castlehotsprings.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.7.0
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.19.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-224-19-33.compute-1.amazonaws.com
Software
nginx /
Resource Hash
48d9d46f411b69048e67189844d87d4a4ed54b73298efb16c1109fdd5f8cd257

Request headers

Referer
https://www.castlehotsprings.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:04 GMT
last-modified
Thu, 12 Nov 2020 12:03:28 GMT
server
nginx
etag
"13d48-5b3e7b3264400"
content-type
font/woff2
cache-control
max-age=31536000
accept-ranges
bytes
content-length
81224
expires
Thu, 16 Feb 2023 17:05:04 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Petit+Formal+Script%7CPlayfair+Display%3A400%2C700%7CMontserrat%3A300%2C500%2C600%2C800%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CMontserrat%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 20:07:55 GMT
x-content-type-options
nosniff
age
75429
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 15 Feb 2023 20:07:55 GMT
nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2
fonts.gstatic.com/s/playfairdisplay/v28/ 		35 KB
35 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/playfairdisplay/v28/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Petit+Formal+Script%7CPlayfair+Display%3A400%2C700%7CMontserrat%3A300%2C500%2C600%2C800%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CMontserrat%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aaab4ae2a2dfdfa746dd72cead3ebc53cb1b10081ebb32e755f98efebaeab965
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 23:53:05 GMT
x-content-type-options
nosniff
age
148319
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35948
x-xss-protection
0
last-modified
Thu, 03 Feb 2022 00:38:38 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 14 Feb 2023 23:53:05 GMT
refill
www.castlehotsprings.com/wp-json/contact-form-7/v1/contact-forms/552/ 		2 B
323 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.castlehotsprings.com/wp-json/contact-form-7/v1/contact-forms/552/refill
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.224.19.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-224-19-33.compute-1.amazonaws.com
Software
nginx / PHP/7.4.3
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.castlehotsprings.com/
X-Requested-With
XMLHttpRequest
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:04 GMT
x-content-type-options
nosniff
server
nginx
link
<https://www.castlehotsprings.com/wp-json/>; rel="https://api.w.org/"
x-powered-by
PHP/7.4.3
vary
Origin
content-type
application/json; charset=UTF-8
allow
GET
x-robots-tag
noindex
access-control-allow-headers
Authorization, Content-Type
content-length
2
access-control-expose-headers
X-WP-Total, X-WP-TotalPages
home-page-hero-small.jpg
s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2020/08/28134304/ 		332 KB
332 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2020/08/28134304/home-page-hero-small.jpg
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.175.24 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
2673d07a19ade0a8eef50fde4c7769dea476e646fcf705d0f1e5692c914ac9b7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:05 GMT
Last-Modified
Mon, 11 Jan 2021 11:18:39 GMT
Server
AmazonS3
x-amz-request-id
KKDD7J72DNV6DH9E
ETag
"fa39271ce2f064dde0f875cf91270b0f"
Content-Type
image/jpeg
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Length
339967
x-amz-id-2
tbFeQM7OXOLXskQc6VWynM3wVrtDdtZRtneHwLi7pWK1O8fv2621YcwFL+orFAnVKF1SuTt4Fxw=
Expires
Tue, 11 Jan 2022 11:18:37 GMT
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.29.0/ 		326 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.29.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de85ba404ac743bd5b7119b9a5dcad583fc9868f530e009e6b281bc1182023b5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Feb 2022 17:05:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
dyhe7y2enj8bR8NtKm1KVA==
age
1413
vary
Accept-Encoding
content-length
79402
x-ms-lease-status
unlocked
last-modified
Thu, 03 Feb 2022 03:33:27 GMT
server
cloudflare
etag
0x8D9E6C5F0E2A936
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
35b7a50d-201e-000e-2eb8-1834ed000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6de85bd1ecc7f923-MXP
en.json
cdn.cookielaw.org/consent/257d34cd-fc96-408e-9692-5ff58828510a/a658f067-0d91-4b4c-8994-c373345a26a7/ 		41 KB
10 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/257d34cd-fc96-408e-9692-5ff58828510a/a658f067-0d91-4b4c-8994-c373345a26a7/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.29.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf0c42c7426e32f5be65c3e36fae436ded9bdc9381d7a29c88e7933a482e6860
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Feb 2022 17:05:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
content-md5
L4MrILodullPx7pOuYSxIQ==
vary
Accept-Encoding
content-length
9736
x-ms-lease-status
unlocked
last-modified
Thu, 27 Jan 2022 17:25:46 GMT
server
cloudflare
etag
0x8D9E1BA0E136B8B
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
4552098a-b01e-0104-08ad-226b31000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6de85bd26d8b0e1e-MXP
expires
Wed, 16 Feb 2022 21:05:04 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.29.0/assets/ 		13 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.29.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.29.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8b8fa76143b1e3d6bcd32187df721f7ad888aeb09fef2dc15b485c98d09e362
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Feb 2022 17:05:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
content-md5
y712byf6x8Sf9hnOqWH0Sg==
vary
Accept-Encoding
content-length
2960
x-ms-lease-status
unlocked
last-modified
Thu, 03 Feb 2022 03:33:19 GMT
server
cloudflare
etag
0x8D9E6C5EC03C97C
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
92f359ac-801e-0065-32ad-2269bb000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6de85bd2ff050e1e-MXP
otPcCenter.json
cdn.cookielaw.org/scripttemplates/6.29.0/assets/v2/ 		47 KB
12 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.29.0/assets/v2/otPcCenter.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.29.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02247b08df8916f94e78453a521fa8d6f4b8f0f22b4b8a3b64176a5068a7de1b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Feb 2022 17:05:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
content-md5
xrtc6FkOgAXd3/qSQUJczw==
vary
Accept-Encoding
content-length
11553
x-ms-lease-status
unlocked
last-modified
Thu, 03 Feb 2022 03:33:21 GMT
server
cloudflare
etag
0x8D9E6C5ED810C1F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
28b01cc9-701e-0156-54ad-2276c3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6de85bd2ff0c0e1e-MXP
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.29.0/assets/ 		20 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.29.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.29.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 16 Feb 2022 17:05:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
content-md5
Ye6OeZcNyuFoWog7CYs00A==
vary
Accept-Encoding
x-ms-lease-status
unlocked
last-modified
Thu, 03 Feb 2022 03:33:32 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
ae2a7f38-501e-0001-7cad-22d91b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
cf-ray
6de85bd2ff0f0e1e-MXP
truncated
/ 		817 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
/
zn78tbmxiy2tfhadv-screenpilot.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zn78tbmxiy2tfhadv-screenpilot.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_78tBMXiy2TfHadv&Q_LOC=https%3A%2F%2Fwww.castlehotsprings.com%2F&t=1645031104936
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3f392cc42b4061394caa8eb440fb366fc71b43377122c9d3c8133ad10afd21c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
108576
cf-polished
origSize=8435
cf-ray
6de85bd659f4eda3-CDG
edge-control
max-age=604800
x-envoy-upstream-service-time
5
vary
Accept-Encoding
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"20f3-svuRfNlQGvt2aBuo78PhrsW6k6A"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600, s-maxage=604800
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
homepage-test-650x650.png.webp
s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2020/05/28131101/ 		619 KB
620 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2020/05/28131101/homepage-test-650x650.png.webp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.175.24 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
2fc66f1675aaa9fb1eeb0f28fc5b870e217aaa578427f5308b9fb4f83a164fcb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:06 GMT
Last-Modified
Mon, 11 Jan 2021 09:17:08 GMT
Server
AmazonS3
x-amz-request-id
3PKQHNA2YTKG4JT7
ETag
"f3173675b8bcebce61d4a74b1fd77a03"
Content-Type
image/webp
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Length
633976
x-amz-id-2
HI2drtNsiyThighaG6Unx7WowGUmrrYa2Eoai3E0MClA7z7qvr2PA06vI1x8eBckqfH77k3yF4Q=
Expires
Tue, 11 Jan 2022 09:17:03 GMT
springs-homepage.jpg.webp
s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2021/01/11094252/ 		260 KB
260 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/uploads.castlehotsprings.com/wp-content/uploads/2021/01/11094252/springs-homepage.jpg.webp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.175.24 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
7cea94cba61f216ba9cfe818f3e6f6e5c7408aea2bcc5ce75b9cb1391f149851

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:06 GMT
Last-Modified
Mon, 11 Jan 2021 16:43:03 GMT
Server
AmazonS3
x-amz-request-id
3PKT6DSPDEKYM5NX
ETag
"5d766429b3bc275bff47f0ebbceae05f"
Content-Type
image/webp
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Length
265994
x-amz-id-2
nAnOkzSvh6RUvkZ6ZDs6BF63QzY6fOoXGNs5nkqvWh2vKfPodithRVyc2bEjwN4gjbvw/6eUpbE=
Expires
Tue, 11 Jan 2022 16:43:00 GMT
truncated
/ 		880 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1ce462f84cde11c5b3cc3943e30d25c6de7299fcbd796f582b2e5574ace0afd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/svg+xml
11.f94ae62479d5b3566b98.chunk.js
siteintercept.qualtrics.com/dxjsmodule/ 		57 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/11.f94ae62479d5b3566b98.chunk.js?Q_CLIENTVERSION=1.66.1&Q_CLIENTTYPE=web&Q_BRANDID=www.castlehotsprings.com
Requested by
Host: zn78tbmxiy2tfhadv-screenpilot.siteintercept.qualtrics.com
URL: https://zn78tbmxiy2tfhadv-screenpilot.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_78tBMXiy2TfHadv&Q_LOC=https%3A%2F%2Fwww.castlehotsprings.com%2F&t=1645031104936
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f495b0356a71a36df0640d33686b4e2122c74ea174bc4b593b7c1d469a00515
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
145458
cf-polished
origSize=59349
cf-ray
6de85bd6ba8deda3-CDG
edge-control
max-age=604800
x-envoy-upstream-service-time
5
vary
Accept-Encoding
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 11 Feb 2022 00:35:36 GMT
server
cloudflare
etag
W/"e7d5-17ee634efc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cf-bgj
minify
Targeting.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		196 B
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_78tBMXiy2TfHadv&Q_CLIENTVERSION=1.66.1&Q_CLIENTTYPE=web
Requested by
Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/11.f94ae62479d5b3566b98.chunk.js?Q_CLIENTVERSION=1.66.1&Q_CLIENTTYPE=web&Q_BRANDID=www.castlehotsprings.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ccd68eaa964699ac2e2590bc1f926992f995a30364abf073eceebc7cdfd9249
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.castlehotsprings.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Wed, 16 Feb 2022 17:05:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-envoy-upstream-service-time
3
strict-transport-security
max-age=31536000; includeSubDomains; preload
timing-allow-origin
*
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.castlehotsprings.com
cache-control
no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
trace-id
5871922093df6eaa
cf-ray
6de85bd70afdeda3-CDG
truncated
/ 		389 B
0 		Script
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
55d074db10740710ea87d678bf54b875f43ba73fd2e2d943099bcc2220fc0090

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
text/javascript
api.js
www.google.com/recaptcha/ 		884 B
998 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&ver=3.0
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 -, , ASN (),
Reverse DNS
Software
GSE /
Resource Hash
120a025efc745490b3f804d9aca70ec359f17927733b26193b6e1b66e00c1b30
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
585
x-xss-protection
1; mode=block
expires
Wed, 16 Feb 2022 17:05:09 GMT
gtm.js
www.googletagmanager.com/ 		237 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WKF4PBF
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 -, , ASN (),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3ade7eb2e0f36ad5fb9687350acaf136a1b7129dd53bfcd838320350f852b32d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:09 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
75084
x-xss-protection
0
last-modified
Wed, 16 Feb 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 16 Feb 2022 17:05:09 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/ 		357 KB
142 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&ver=3.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
e233cde0337424a89df8f71bd45c2c4a2f9f5b699cf79144a5db2949d0bd4529
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.castlehotsprings.com/
Origin
https://www.castlehotsprings.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 16:14:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3015
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
144562
x-xss-protection
0
last-modified
Mon, 07 Feb 2022 05:03:43 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 16 Feb 2023 16:14:54 GMT
anchor
www.google.com/recaptcha/api2/ Frame A247 		43 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&co=aHR0cHM6Ly93d3cuY2FzdGxlaG90c3ByaW5ncy5jb206NDQz&hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ&size=invisible&cb=wlvgh3oq0p30
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 -, , ASN (),
Reverse DNS
Software
GSE /
Resource Hash
4339c6719f061bc757510bd4d7ac41d21e95eee9ea50cf7532e15f02ea1f611c
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-21aPxjVXYTzkd2JysmYbqg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Wed, 16 Feb 2022 17:05:09 GMT
content-security-policy
script-src 'report-sample' 'nonce-21aPxjVXYTzkd2JysmYbqg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
22843
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bat.js
bat.bing.com/ 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WKF4PBF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:08 GMT
content-encoding
gzip
last-modified
Wed, 09 Feb 2022 23:54:49 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 5E692A5B38BE4425BBA4F54612A2DD6E Ref B: FRAEDGE1207 Ref C: 2022-02-16T17:05:09Z
etag
"806a236c101ed81:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
11347
7567.js
script.crazyegg.com/pages/scripts/0011/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/scripts/0011/7567.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WKF4PBF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
2e89ee18324ae4320b10c075af767f56c76c5f0f0fc5284b7aa7545ed26da3f6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
content-encoding
gzip
cf-cache-status
MISS
cf-ray
6de85bf2af260f5e-MXP
ce-version
11.1.376
content-length
1856
last-modified
Wed, 16 Feb 2022 17:05:10 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
tc.min.js
c1.rfihub.net/js/ 		19 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c1.rfihub.net/js/tc.min.js
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:4800:1:76cf:fe80:93a1 -, , ASN (),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 16:59:05 GMT
content-encoding
gzip
last-modified
Wed, 16 Feb 2022 16:58:55 GMT
server
Jetty(9.3.29.v20201019)
age
364
x-cache
Hit from cloudfront
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
via
1.1 9015971351bc982a04ee209a022bb1f8.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
x-amz-cf-pop
FRA56-P2
content-type
application/x-javascript
content-length
6162
x-amz-cf-id
6JSRY5AOWTv5ajLiPEcAv7_S4hO29YeCtUVFrYJnjoxC_f88f2dEtA==
expires
Wed, 16 Feb 2022 17:59:05 GMT
fbevents.js
connect.facebook.net/en_US/ 		99 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:100:face:b00c:0:3 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
26236
x-xss-protection
0
pragma
public
x-fb-debug
ywt1T/8wPiGoqdQM8PkL3l3nKhSaaVzAvFAxNI1WgWA3Bph2aOiSR9gUOIVyq7tyFQfV0+4SpcTjAshyswtUUA==
x-fb-trip-id
917726464
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 16 Feb 2022 17:05:09 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
navis-fusion-loader.js
assets.navisperformance.com/NWRC/Fusion/ 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.navisperformance.com/NWRC/Fusion/navis-fusion-loader.js
Requested by
Host: www.castlehotsprings.com
URL: https://www.castlehotsprings.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:1400:16:3eaa:9140:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
37a7918f1596d21356e4fba56ae52f2099325c3fc04d6b195358f9cc666f681e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-amz-version-id
YBr8SRJCzRKJ8ZhphEqzZ4HNkEzVdCx_
content-encoding
gzip
etag
W/"cc9d6a022deff35e3282ef6ab843f37f"
age
26927
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Thu, 03 Sep 2020 23:26:09 GMT
server
AmazonS3
date
Wed, 16 Feb 2022 09:36:23 GMT
vary
Access-Control-Request-Headers
access-control-allow-methods
GET, PUT, POST, DELETE, HEAD
content-type
application/javascript
via
1.1 cb605905cea2427f1d9f13acc778e822.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-amz-cf-id
vL6xNQF3IaX15EwdY13DYcAuI4zalGiXteYatFKNJjrfN3aKTjACtQ==
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WKF4PBF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e -, , ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
3617
date
Wed, 16 Feb 2022 16:04:52 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Wed, 16 Feb 2022 18:04:52 GMT
243836473671727
connect.facebook.net/signals/config/ 		307 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/243836473671727?v=2.9.52&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:100:face:b00c:0:3 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
86193e06b2e1ecfc502b1d5a661f541cf5082d46e6050bc726e43daa3d1f2c28
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
FVUBo8M8TcaY4Oz0UNdy6miDf/igCwglxXS8mk6di53B8DCfcULRPjuxNxtF1VfljRn7goNpmZo3MzXGl5uIig==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Wed, 16 Feb 2022 17:05:09 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
styles__ltr.css
www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/ Frame A247 		51 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&co=aHR0cHM6Ly93d3cuY2FzdGxlaG90c3ByaW5ncy5jb206NDQz&hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ&size=invisible&cb=wlvgh3oq0p30
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 16:14:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3020
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24237
x-xss-protection
0
last-modified
Mon, 07 Feb 2022 05:03:43 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 16 Feb 2023 16:14:49 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/ Frame A247 		357 KB
141 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&co=aHR0cHM6Ly93d3cuY2FzdGxlaG90c3ByaW5ncy5jb206NDQz&hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ&size=invisible&cb=wlvgh3oq0p30
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
e233cde0337424a89df8f71bd45c2c4a2f9f5b699cf79144a5db2949d0bd4529
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 16:14:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3015
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
144562
x-xss-protection
0
last-modified
Mon, 07 Feb 2022 05:03:43 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 16 Feb 2023 16:14:54 GMT
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=916336663&t=pageview&_s=1&dl=https%3A%2F%2Fwww.castlehotsprings.com%2F&ul=en-us&de=UTF-8&dt=Welcome%20to%20Castle%20Hot%20Springs%20%7C%20Arizona%20Luxury%20Resort&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACAABBAAAAC~&jid=575777241&gjid=1006071134&cid=1230979858.1645031110&tid=UA-116210348-4&_gid=1954060136.1645031110&_r=1&gtm=2wg290WKF4PBF&z=826638257
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::200e -, , ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.castlehotsprings.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:09 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.castlehotsprings.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
ca.html
20827576p.rfihub.com/ Frame 4196 		3 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://20827576p.rfihub.com/ca.html?ver=9&rb=39961&ca=20827576&_o=39961&_t=20827576&pe=https%3A%2F%2Fwww.castlehotsprings.com%2F&pf=&ra=05202067078941841
Requested by
Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.128 -, , ASN (),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
1d567a49bc02ef1bddcdde5cc6bf88f57172804b5d8e4e678be009758ff95795

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/

Response headers

Date
Wed, 16 Feb 2022 17:05:09 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache
Content-Type
text/html;charset=utf-8
Content-Length
2797
Server
Jetty(9.3.29.v20201019)
11035483.js
bat.bing.com/p/action/ 		685 B
763 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/11035483.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
301caa7c8c53f4613a841c48a2bba0d5bc12fa8795dad5bf7724b85714b8903c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:09 GMT
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: D0E1C8E54985447B8FC15B08FEC7E119 Ref B: FRAEDGE1207 Ref C: 2022-02-16T17:05:09Z
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-store,no-cache
content-length
589
0
bat.bing.com/action/ 		0
150 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=11035483&tm=gtm002&Ver=2&mid=0566e659-c2d3-45b7-a51f-6cdc1a32ec0f&sid=98ccbea08f4a11ec926f73e78e60afca&vid=98ccd1108f4a11ecb93e79d8d149f97e&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Welcome%20to%20Castle%20Hot%20Springs%20%7C%20Arizona%20Luxury%20Resort&p=https%3A%2F%2Fwww.castlehotsprings.com%2F&r=&lt=2779&evt=pageLoad&msclkid=N&sv=1&rn=757886
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:08 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: DDA81CC3FA754925AF6DFF40FE499583 Ref B: FRAEDGE1207 Ref C: 2022-02-16T17:05:09Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
discovery.json
assets.navisperformance.com/NWRC/Fusion/ 		61 B
541 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://assets.navisperformance.com/NWRC/Fusion/discovery.json
Requested by
Host: assets.navisperformance.com
URL: https://assets.navisperformance.com/NWRC/Fusion/navis-fusion-loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:1400:16:3eaa:9140:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9d2071d21c7728e75e882a3240e59f7e175809de3296ca06cdd14273e84d6684

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-amz-version-id
7tcDAQ7c5ivWOL6SzEdqjJeDxOoT5c_Z
via
1.1 6fc439c8bc0a64a7ab978ce699795274.cloudfront.net (CloudFront)
etag
"abb936b7e075c6e92be7f68866771f0f"
age
56212
x-cache
Hit from cloudfront
access-control-max-age
3000
content-length
61
last-modified
Mon, 24 Aug 2020 19:13:13 GMT
server
AmazonS3
date
Wed, 16 Feb 2022 01:28:18 GMT
vary
Access-Control-Request-Headers
access-control-allow-methods
GET, PUT, POST, DELETE, HEAD
content-type
application/json
access-control-allow-origin
*
x-amz-cf-pop
FRA60-P3
accept-ranges
bytes
x-amz-cf-id
WfT-CChabxlUYWqWo076tpzSfMd1-8oMBuesE2tjl3HT1P-J7f4aDg==
collect
stats.g.doubleclick.net/j/ 		4 B
448 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-116210348-4&cid=1230979858.1645031110&jid=575777241&gjid=1006071134&_gid=1954060136.1645031110&_u=YGBACAAABAAAAC~&z=1958253785
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9b -, , ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.castlehotsprings.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 16 Feb 2022 17:05:09 GMT
content-type
text/plain
access-control-allow-origin
https://www.castlehotsprings.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame A247 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 -, , ASN (),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 03:05:30 GMT
x-content-type-options
nosniff
age
50379
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin-allow-popups; report-to="recaptcha"
expires
Wed, 23 Feb 2022 03:05:30 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame A247 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&co=aHR0cHM6Ly93d3cuY2FzdGxlaG90c3ByaW5ncy5jb206NDQz&hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ&size=invisible&cb=wlvgh3oq0p30
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 11:18:05 GMT
x-content-type-options
nosniff
age
107224
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 15 Feb 2023 11:18:05 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame A247 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&co=aHR0cHM6Ly93d3cuY2FzdGxlaG90c3ByaW5ncy5jb206NDQz&hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ&size=invisible&cb=wlvgh3oq0p30
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 18:59:48 GMT
x-content-type-options
nosniff
age
79521
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 15 Feb 2023 18:59:48 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame A247 		102 B
134 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&co=aHR0cHM6Ly93d3cuY2FzdGxlaG90c3ByaW5ncy5jb206NDQz&hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ&size=invisible&cb=wlvgh3oq0p30
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 -, , ASN (),
Reverse DNS
Software
GSE /
Resource Hash
a07361b9992cee19b55676bde1d128c8cec6864ba8e9f158ba8eef071d36f107
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&co=aHR0cHM6Ly93d3cuY2FzdGxlaG90c3ByaW5ncy5jb206NDQz&hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ&size=invisible&cb=wlvgh3oq0p30
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
112
x-xss-protection
1; mode=block
expires
Wed, 16 Feb 2022 17:05:09 GMT
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-116210348-4&cid=1230979858.1645031110&jid=575777241&_u=YGBACAAABAAAAC~&z=1944084856
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:09 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-116210348-4&cid=1230979858.1645031110&jid=575777241&_u=YGBACAAABAAAAC~&z=1944084856
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:09 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
getFusionConfig
fusion-api.navisperformance.com/fusion-config/ 		524 B
898 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://fusion-api.navisperformance.com/fusion-config/getFusionConfig?account=15819&url=https%3A%2F%2Fwww.castlehotsprings.com%2F
Requested by
Host: assets.navisperformance.com
URL: https://assets.navisperformance.com/NWRC/Fusion/navis-fusion-loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.241.33.207 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
99e2815ef02567c57969a62fa13d3ce807ede58c0e4204b030c35e851ff92afb

Request headers

secret
c9dx9b2dlky6wl7rkn5r
Referer
https://www.castlehotsprings.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
https://www.castlehotsprings.com
date
Wed, 16 Feb 2022 17:05:10 GMT
access-control-allow-credentials
true
requestguid
7a0ae4a3-0f70-4994-9ace-96f2dc7913c8
access-control-allow-headers
origin, content-type, accept, x-requested-with, secret
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
application/json;charset=UTF-8
getFusionConfig
fusion-api.navisperformance.com/fusion-config/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://fusion-api.navisperformance.com/fusion-config/getFusionConfig?account=15819&url=https%3A%2F%2Fwww.castlehotsprings.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.241.33.207 -, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
secret
Origin
https://www.castlehotsprings.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
content-length
0
requestguid
f0e11e09-5f29-4701-b3f9-6a61e06a46fe
access-control-allow-credentials
true
access-control-allow-origin
https://www.castlehotsprings.com
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers
origin, content-type, accept, x-requested-with, secret
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
allow
GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
/
www.facebook.com/tr/ 		44 B
407 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=243836473671727&ev=PageView&dl=https%3A%2F%2Fwww.castlehotsprings.com%2F&rl=&if=false&ts=1645031110063&sw=1600&sh=1200&v=2.9.52&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1645031110063.898486657&it=1645031109509&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:181:face:b00c:0:25de -, , ASN (),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Wed, 16 Feb 2022 17:05:10 GMT
clarity.js
j.clarity.ms/s/0.6.32/ 		53 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.clarity.ms/s/0.6.32/clarity.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/11035483.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.85.30.134 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
3701cadc5fc84e8ad639f83a87e20d82575e3cc28d479d73a0e66e5230e71c65

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
content-encoding
br
etag
"1d8191fe855c690"
last-modified
Thu, 03 Feb 2022 17:03:04 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public,max-age=86400
accept-ranges
bytes
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?CtsSyncId=DAD831BABF8B4EDA81146EB5CF2D0B86&RedC=c.clarity.ms&MXFR=2166791E5E8F6B230C8168535A8F653E
  • https://c.clarity.ms/c.gif?CtsSyncId=DAD831BABF8B4EDA81146EB5CF2D0B86&MUID=025B7FBDFA6A611F278A6EF0FBB860BA
42 B
367 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?CtsSyncId=DAD831BABF8B4EDA81146EB5CF2D0B86&MUID=025B7FBDFA6A611F278A6EF0FBB860BA
Protocol
H2
Server
52.142.114.2 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:09 GMT
last-modified
Wed, 12 Jan 2022 02:05:35 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"9ea1ae3587d81:0"
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:09 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 866239C3C2194722B6138F94D47FC627 Ref B: FRAEDGE1207 Ref C: 2022-02-16T17:05:10Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?CtsSyncId=DAD831BABF8B4EDA81146EB5CF2D0B86&MUID=025B7FBDFA6A611F278A6EF0FBB860BA
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
cm
a.rfihub.com/ Frame 4196
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTEzMTA3NzcyMDY2MDEyOTAxMw==&forward=
  • https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTEzMTA3NzcyMDY2MDEyOTAxMw==&forward=&google_tc=
  • https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESECVTQs-42zxCf9Fjvq_4u2c&google_cver=1
42 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESECVTQs-42zxCf9Fjvq_4u2c&google_cver=1
Protocol
HTTP/1.1
Server
193.0.160.128 -, , ASN (),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:10 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:10 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESECVTQs-42zxCf9Fjvq_4u2c&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
311
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bounce
ib.adnxs.com/ Frame 4196
Redirect Chain
  • https://ib.adnxs.com/setuid?entity=18&code=5131077720660129013
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D5131077720660129013
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D5131077720660129013
Protocol
HTTP/1.1
Server
37.252.172.249 -, , ASN (),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Feb 2022 17:05:10 GMT
X-Proxy-Origin
193.27.14.24; 193.27.14.24; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
20fc21dc-a361-44ea-8895-80669b71cd7c
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 16 Feb 2022 17:05:10 GMT
X-Proxy-Origin
193.27.14.24; 193.27.14.24; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
18111053-4f4a-4f38-a29e-d075a3037847
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D5131077720660129013
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cm
p.rfihub.com/ Frame 4196
Redirect Chain
  • https://stags.bluekai.com/site/4722?id=5131077720660129013&redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fbk_uuid%3D%24_BK_UUID%26forward%3D
  • https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
42 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
Protocol
HTTP/1.1
Server
193.0.160.128 -, , ASN (),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:10 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
Date
Wed, 16 Feb 2022 17:05:10 GMT
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
tap.php
pixel.rubiconproject.com/ Frame 4196 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=5131077720660129013&
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Content-Type
image/gif
demconf.jpg
dpm.demdex.net/ Frame 4196
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5131077720660129013&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5131077720660129013&redir=
42 B
945 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5131077720660129013&redir=
Protocol
HTTP/1.1
Server
52.19.204.92 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v028-051e97d6d.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
u5MnMN7GST0=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v028-0e7eb2604.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
EjXcMmc9TIQ=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5131077720660129013&redir=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
match
ps.eyeota.net/ Frame 4196
Redirect Chain
  • https://p.rfihub.com/cm?pub=24472&in=1
  • https://ps.eyeota.net/match?uid=5131077720660129013&bid=omt9pi0
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?uid=5131077720660129013&bid=omt9pi0
Protocol
HTTP/1.1
Server
3.122.214.165 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:10 GMT
Content-Length
0
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location
https://ps.eyeota.net/match?uid=5131077720660129013&bid=omt9pi0
Date
Wed, 16 Feb 2022 17:05:10 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cksync.php
contextual.media.net/ Frame 4196 		45 B
614 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=5131077720660129013
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.107.160.24 -, , ASN (),
Reverse DNS
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Wed, 16 Feb 2022 17:05:10 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Wed, 16 Feb 2022 17:05:10 GMT
serving
bs.serving-sys.com/ Frame 4196 		0
105 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bs.serving-sys.com/serving?cn=um&dpid=12&rtu=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D17945%26userid%3D%5B%25tp_UserID%25%5D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.63.34 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-length
0
p3p
CP="NOI DEVa OUR BUS UNI"
362358.gif
idsync.rlcdn.com/ Frame 4196
Redirect Chain
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5131077720660129013&referrer=https%3A%2F%2Fwww.castlehotsprings.com%2F
  • https://p.rfihub.com/cm?pub=39342&in=0&userid=6eb43f00-33ca-49c8-a8ed-5fcd4fe28b2f%3A1645031110.24&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D6eb43f00-33ca-49c8-a8ed-5fcd4fe28b2f...
  • https://idsync.rlcdn.com/501709.gif?partner_uid=6eb43f00-33ca-49c8-a8ed-5fcd4fe28b2f%3A1645031110.24
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEL2jVEuwc6iw4kuPnflPPi8&google_cver=1
42 B
300 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEL2jVEuwc6iw4kuPnflPPi8&google_cver=1
Protocol
H2
Server
35.244.174.68 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Feb 2022 17:05:10 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
clear
content-length
42

Redirect headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:10 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEL2jVEuwc6iw4kuPnflPPi8&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
289
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
bpi.rtactivate.com/tag/ Frame 4196 		43 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bpi.rtactivate.com/tag/?id=11017&user_id=5131077720660129013
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.229.229.140 -, , ASN (),
Reverse DNS
Software
awselb/2.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
server
awselb/2.0
content-length
43
content-type
image/gif
rum
dsum-sec.casalemedia.com/ Frame 4196
Redirect Chain
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5131077720660129013&forward=
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5131077720660129013&forward=&C=1
43 B
1006 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5131077720660129013&forward=&C=1
Protocol
HTTP/1.1
Server
72.247.225.98 -, , ASN (),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Feb 2022 17:05:10 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Wed, 16 Feb 2022 17:05:10 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 16 Feb 2022 17:05:10 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5131077720660129013&forward=&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
295
Expires
Wed, 16 Feb 2022 17:05:10 GMT
360947.gif
idsync.rlcdn.com/ Frame 4196 		42 B
417 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/360947.gif?partner_uid=5131077720660129013
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Feb 2022 17:05:10 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
clear
content-length
42
rocketfuel_sync
x.dlx.addthis.com/e/ Frame 4196 		43 B
191 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.dlx.addthis.com/e/rocketfuel_sync?na_exid=5131077720660129013
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.215.191 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=2628000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:10 GMT
cache-control
max-age=0, no-cache, no-store
expires
Wed, 16 Feb 2022 17:05:10 GMT
content-length
43
strict-transport-security
max-age=2628000
content-type
image/gif
partner
sync.search.spotxchange.com/ Frame 4196
Redirect Chain
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5131077720660129013&img=1
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5131077720660129013&img=1&__user_check__=1&sync_id=993fb028-8f4a-11ec-a4ff-10b91cd50206
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5131077720660129013&img=1&__user_check__=1&sync_id=993fb028-8f4a-11ec-a4ff-10b91cd50206
Protocol
HTTP/1.1
Server
185.94.180.125 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:10 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
52
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Wed, 16 Feb 2022 17:05:10 GMT
Server
nginx
Location
/partner?adv_id=7180&uid=5131077720660129013&img=1&__user_check__=1&sync_id=993fb028-8f4a-11ec-a4ff-10b91cd50206
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
144
Connection
keep-alive
Content-Length
0
sync
partners.tremorhub.com/ Frame 4196 		43 B
183 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partners.tremorhub.com/sync?UIRF=5131077720660129013&r=vbN7PfSrNx1r
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:612b:4264:3ca:5412:4ba5:20da -, , ASN (),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
server
Apache-Coyote/1.1
p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type
image/gif
g.pixel
aa.agkn.com/adscores/ Frame 4196 		43 B
238 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=5131077720660129013
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.9.96.172 -, , ASN (),
Reverse DNS
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:10 GMT
server
AAWebServer
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
usermatch.gif
beacon.krxd.net/ Frame 4196 		0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner_id=rfuel&partner_user_id=5131077720660129013
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.76.155.32 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
cache-control
private, no-cache, no-store
x-request-time
D=73 t=1645031110
x-served-by
beacon-n015-dub-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sync
x.bidswitch.net/ul_cb/ Frame 4196
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=5131077720660129013&expires=30
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5131077720660129013&expires=30
43 B
510 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5131077720660129013&expires=30
Protocol
HTTP/1.1
Server
35.211.178.172 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:10 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5131077720660129013&expires=30
Date
Wed, 16 Feb 2022 17:05:10 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
cm
p.rfihub.com/ Frame 4196
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=Yg0uxgAGsVB-SQBB
  • https://p.rfihub.com/cm?in=1&pub=21653&userid=Yg0uxgAGsVB-SQBB&_test=Yg0uxgAGsVB-SQBB
42 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.rfihub.com/cm?in=1&pub=21653&userid=Yg0uxgAGsVB-SQBB&_test=Yg0uxgAGsVB-SQBB
Protocol
HTTP/1.1
Server
193.0.160.128 -, , ASN (),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20827576p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Wed, 16 Feb 2022 17:05:10 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Wed, 16 Feb 2022 17:05:10 GMT
via
1.1 varnish
server
Varnish
x-timer
S1645031111.513397,VS0,VE0
x-served-by
cache-cdg20721-CDG
x-cache
HIT
location
https://p.rfihub.com/cm?in=1&pub=21653&userid=Yg0uxgAGsVB-SQBB&_test=Yg0uxgAGsVB-SQBB
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
reload
www.google.com/recaptcha/api2/ Frame A247 		31 KB
18 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/reload?k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/BycHQdSIhzR_1EcOLw2mOzYQ/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 -, , ASN (),
Reverse DNS
Software
GSE /
Resource Hash
4f1dc601915c95b0c236ae72a955f30260a2954cd04383a1d7162ec97155dbeb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LenXw8aAAAAAD8Tkt98VjzJsiKD0571mTtXWBOr&co=aHR0cHM6Ly93d3cuY2FzdGxlaG90c3ByaW5ncy5jb206NDQz&hl=de&v=BycHQdSIhzR_1EcOLw2mOzYQ&size=invisible&cb=wlvgh3oq0p30
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type
application/x-protobuffer

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
cache-control
private, max-age=0
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18197
x-xss-protection
1; mode=block
expires
Wed, 16 Feb 2022 17:05:10 GMT
7567.json
script.crazyegg.com/pages/data-scripts/0011/ 		34 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/data-scripts/0011/7567.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0011/7567.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
f736c0c7e47c3a76f37d2e086b3c8e37927bf56c7a72899ba812a8cdb8a8d76e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
content-encoding
gzip
cf-cache-status
HIT
age
4363
ce-version
11.1.376
content-length
2607
timing-allow-origin
*
last-modified
Wed, 16 Feb 2022 15:52:26 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
6de85bf71dce90c1-FRA
11.1.376.js
script.crazyegg.com/pages/versioned/common-scripts/ 		71 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/11.1.376.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0011/7567.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
b401d1e804e0a5079603c8f74249ae0e2ec2c797703490f3a0c38079cd989027

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Feb 2022 17:05:10 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 01 Dec 2021 14:25:17 GMT
server
cloudflare
age
20885
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
cf-ray
6de85bf748e10f5e-MXP
content-length
23366
7567.json
script.crazyegg.com/pages/sampling-data-scripts/0011/ 		2 KB
687 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/sampling-data-scripts/0011/7567.json?t=456953
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.376.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
438cd910717f63d81401385b5866d543d6283090bdce6dbdf2f2f60c56175e27

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 17:05:10 GMT
content-encoding
gzip
cf-cache-status
HIT
age
4363
ce-version
11.1.376
content-length
598
timing-allow-origin
*
last-modified
Wed, 16 Feb 2022 15:52:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
6de85bf78e9b90c1-FRA
/
www.facebook.com/tr/ Frame 1FD9 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:181:face:b00c:0:25de -, , ASN (),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
Origin
https://www.castlehotsprings.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.castlehotsprings.com/

Response headers

content-type
text/plain
access-control-allow-origin
https://www.castlehotsprings.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
content-length
0
server
proxygen-bolt
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=0
date
Wed, 16 Feb 2022 17:05:10 GMT
collect
j.clarity.ms/ 		0
76 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://j.clarity.ms/collect
Requested by
Host: j.clarity.ms
URL: https://j.clarity.ms/s/0.6.32/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.85.30.134 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.castlehotsprings.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
https://www.castlehotsprings.com
date
Wed, 16 Feb 2022 17:05:10 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
collect
j.clarity.ms/ 		0
25 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://j.clarity.ms/collect
Requested by
Host: j.clarity.ms
URL: https://j.clarity.ms/s/0.6.32/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.85.30.134 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.castlehotsprings.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
https://www.castlehotsprings.com
date
Wed, 16 Feb 2022 17:05:10 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
abandoned-cart-config.bundle.js
assets.navisperformance.com/abandoned-cart-client/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
assets.navisperformance.com
URL
https://assets.navisperformance.com/abandoned-cart-client/abandoned-cart-config.bundle.js

Verdicts & Comments Add Verdict or Comment

117 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| OneTrustStub string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer function| OptanonWrapper undefined| $ function| jQuery object| scriptParams function| NavisConvertTagToPhoneNumberBasic function| ValidateNavisKeyword function| CreateNavisTagCookie function| CreateNavisTagCookie2 object| NavisCookieKeywordValue function| CreateNavisTagCookie3 function| ReadNavisTagCookie1 function| ReadNavisTagCookie function| GetNavisQueryString function| GetNavisTagQueryString function| NavisGetDomain function| GetNavisTagReferrer function| GetNavisTagReferrer2 function| GetNavisTagHash function| ProcessNavisNCKeyword function| ProcessNavisNCKeyword2 function| ProcessNavisNCKeyword3 function| ProcessNavisNCKeyword4 function| ProcessNavisNCKeyword5 function| FormatPhone function| ShowNavisNCPhoneNumber function| ShowNavisNCPhoneNumberFormat function| SetElementToNavisNCPhoneNumber function| SetElementToNavisNCPhoneNumberFormat function| NavisConvertTagToPhoneNumber function| NavisSetHiddenKeywordField function| NavisSetHiddenKeywordFieldD function| NavisSetHiddenPhoneNumberField function| SetNavisP2TalkLink function| SetNavisP2TalkCustomLink function| SetNavisP2ChatLink function| SetNavisP2ChatCustomLink function| SetNavisLink function| AppendNavisKeywordToURL function| AppendNavisKeywordToLink function| AppendNavisPhoneNumberToLink function| SetTelLinkToNavisPhoneNumber function| SetLinkToNavisPhoneNumber function| AppendNavisItemToURL function| AppendNavisItemToLink function| SendNavisConfirmationNumberField function| SendNavisConfirmationNumber function| SendNavisAltConfirmationNumber object| NavisCookieContactIdValue function| CreateNavisContactIdCookie function| ReadNavisContactIdCookie function| GetNavisContactIdQueryString function| ProcessNavisContactId function| SendNavisContactIdAttribute function| SendNavisContactIdAttributeIncrement function| SendNavisContactIdAttributeIncrement2 function| SendNavisContactIdAttributeData function| GetNavisUniqueTimeValue string| css object| style object| Arrive function| check_webp_feature function| ewwwLoadImages function| ewwwWebPInit function| ewwwAttr function| ewwwNggParseGalleries function| ewwwNggLoadGalleries function| ewwwNggParseImageList function| submitForm object| wpcf7 object| ElementorProFrontendConfig object| elementorFrontendConfig function| triggerScriptLoader function| loadScripts object| imgLiquid function| objectFitImages function| initBookingDropdown function| initDateFieldFallback function| initMoveTopBanner function| initHomepageTiles function| initImgLiquid function| initImgCover function| initObjectFitPolyfill object| Modernizr function| _ object| jQuery1124011434456713481733 object| lazySizes object| wp function| EventEmitter object| eventie function| imagesLoaded object| __core-js_shared__ object| core object| elementorModules function| Sticky object| elementorProFrontend object| DialogsManager function| Waypoint function| Swiper function| ShareLink object| elementorFrontend string| waypointContextKey object| cvUserImage object| otStubData object| Optanon object| OneTrust object| QSI object| WAFQualtricsWebpackJsonP-cloud-1.66.1 function| arrive function| unbindArrive function| leave function| unbindLeave

1 Cookies

Domain/Path Name / Value
.castlehotsprings.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Wed+Feb+16+2022+17%3A05%3A04+GMT%2B0000+(GMT)&version=6.29.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.castlehotsprings.com%2F&groups=C0002%3A1%2CC0004%3A1%2CC0003%3A1%2CC0001%3A1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20827576p.rfihub.com
a.rfihub.com
aa.agkn.com
assets.navisperformance.com
bat.bing.com
beacon.krxd.net
bpi.rtactivate.com
bs.serving-sys.com
c.bing.com
c.clarity.ms
c1.rfihub.net
castlehotsprings.com
cdn.cookielaw.org
cm.g.doubleclick.net
connect.facebook.net
contextual.media.net
dpm.demdex.net
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
fusion-api.navisperformance.com
geolocation.onetrust.com
ib.adnxs.com
idsync.rlcdn.com
j.clarity.ms
live.rezync.com
p.rfihub.com
partners.tremorhub.com
pixel.rubiconproject.com
ps.eyeota.net
s3.amazonaws.com
script.crazyegg.com
siteintercept.qualtrics.com
stags.bluekai.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.search.spotxchange.com
www.castlehotsprings.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
x.bidswitch.net
x.dlx.addthis.com
zn78tbmxiy2tfhadv-screenpilot.siteintercept.qualtrics.com
assets.navisperformance.com
104.107.160.24
104.111.215.191
104.17.209.240
13.32.121.105
142.250.181.226
151.101.194.49
185.94.180.125
193.0.160.128
20.85.30.134
2600:1f18:612b:4264:3ca:5412:4ba5:20da
2600:9000:223c:4800:1:76cf:fe80:93a1
2600:9000:2251:1400:16:3eaa:9140:93a1
2606:4700:10::6814:b944
2606:4700::6810:9540
2606:4700::6813:9308
2620:1ec:c11::200
2a00:1450:4001:808::200e
2a00:1450:4001:810::2003
2a00:1450:4001:811::200a
2a00:1450:4001:827::2003
2a00:1450:4001:829::2003
2a00:1450:4001:82b::2004
2a00:1450:4001:831::2008
2a00:1450:400c:c06::9b
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
3.120.63.34
3.122.214.165
3.229.229.140
3.9.96.172
34.224.19.33
34.230.184.69
35.211.178.172
35.244.174.68
37.252.172.249
44.241.33.207
52.142.114.2
52.19.204.92
52.217.175.24
54.76.155.32
69.173.144.139
72.247.225.98
02247b08df8916f94e78453a521fa8d6f4b8f0f22b4b8a3b64176a5068a7de1b
0ccd68eaa964699ac2e2590bc1f926992f995a30364abf073eceebc7cdfd9249
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
120a025efc745490b3f804d9aca70ec359f17927733b26193b6e1b66e00c1b30
134482ec36c8980c2c7a3f2454c76546abcd612c9ae596d011251a7cd1d0fcbb
186760d0c61c24ba02aa6f2a7e7215b128648caadc0a30419808461054977942
18aa66c192cbef43a61b1398c292ae5c6c1d40d679428ee998b1c6bfaf61d75a
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1d567a49bc02ef1bddcdde5cc6bf88f57172804b5d8e4e678be009758ff95795
2673d07a19ade0a8eef50fde4c7769dea476e646fcf705d0f1e5692c914ac9b7
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
2e89ee18324ae4320b10c075af767f56c76c5f0f0fc5284b7aa7545ed26da3f6
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
2fc66f1675aaa9fb1eeb0f28fc5b870e217aaa578427f5308b9fb4f83a164fcb
301caa7c8c53f4613a841c48a2bba0d5bc12fa8795dad5bf7724b85714b8903c
321954a54fea26ec3f073b7efa01bfe5f1bd1fbc1e021016ff0d0a8d71132259
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
3701cadc5fc84e8ad639f83a87e20d82575e3cc28d479d73a0e66e5230e71c65
37a7918f1596d21356e4fba56ae52f2099325c3fc04d6b195358f9cc666f681e
3ade7eb2e0f36ad5fb9687350acaf136a1b7129dd53bfcd838320350f852b32d
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
4339c6719f061bc757510bd4d7ac41d21e95eee9ea50cf7532e15f02ea1f611c
438cd910717f63d81401385b5866d543d6283090bdce6dbdf2f2f60c56175e27
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
48d9d46f411b69048e67189844d87d4a4ed54b73298efb16c1109fdd5f8cd257
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d7dd58a837ee0b61b8b69e8aaf538ae109ec48807d54e527fc9728e3e0527f0
4f1dc601915c95b0c236ae72a955f30260a2954cd04383a1d7162ec97155dbeb
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4fb964155d4de85031dbb9bbec2e3c3089829c15bc8ec88336884854bf5c024c
533a9c2a5cede315eb2fff0e36c82e55c5709d0885ece44a86107ef58df2375b
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55d074db10740710ea87d678bf54b875f43ba73fd2e2d943099bcc2220fc0090
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5f495b0356a71a36df0640d33686b4e2122c74ea174bc4b593b7c1d469a00515
701ce714253c2c6dc6c5d3d19a9cc8522fe426280400d21ce1a1dfdfb7396cf7
737beff8087eb07be7bb901785cc1bad100c6aac415eb129e8424d94dd89490d
78cad699eb81d74876ec2984ed96e693267d5cc99644fda4de977da6de1c237c
7b044cb4d18d5e4838323e019603bae878043d3ad9c3228e9312dc359a2a86b0
7cea94cba61f216ba9cfe818f3e6f6e5c7408aea2bcc5ce75b9cb1391f149851
7e41ca21e421f129d3881e345f990027b66c0ab3c5580e549575f9393d117cbd
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
843d5ebf4904a4d7cf46275c48fc52fa4bbea6b0f9291fd3efdf13572c1fc32f
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
86193e06b2e1ecfc502b1d5a661f541cf5082d46e6050bc726e43daa3d1f2c28
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
923d2891646bf945550890db729f1e91de25e10d44da68c0ec4c1461cd93e56e
945c82ffd2df26ef6ef8a227e1ceb6c37e48062f66921867d3c8e3788bd4bc9d
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
99e2815ef02567c57969a62fa13d3ce807ede58c0e4204b030c35e851ff92afb
9d2071d21c7728e75e882a3240e59f7e175809de3296ca06cdd14273e84d6684
9ff4de814c70b7af99aceffe43d1800a4b6f1aa90ab7ce31ed31c00b3ca57f90
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a07361b9992cee19b55676bde1d128c8cec6864ba8e9f158ba8eef071d36f107
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
aaab4ae2a2dfdfa746dd72cead3ebc53cb1b10081ebb32e755f98efebaeab965
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1ce462f84cde11c5b3cc3943e30d25c6de7299fcbd796f582b2e5574ace0afd
b401d1e804e0a5079603c8f74249ae0e2ec2c797703490f3a0c38079cd989027
b8b8fa76143b1e3d6bcd32187df721f7ad888aeb09fef2dc15b485c98d09e362
bf0c42c7426e32f5be65c3e36fae436ded9bdc9381d7a29c88e7933a482e6860
c3f392cc42b4061394caa8eb440fb366fc71b43377122c9d3c8133ad10afd21c
c8f7c04f8d691138d54380550d91349271ca19cfc0f3f6666c401cfa892a12f8
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d15cd8460171bcc77be7b2e35f104c81ab4ad051f1477ef7a06064405f58d0cf
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de85ba404ac743bd5b7119b9a5dcad583fc9868f530e009e6b281bc1182023b5
e233cde0337424a89df8f71bd45c2c4a2f9f5b699cf79144a5db2949d0bd4529
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e9a8d4e0b7326da6e4b9cd66c1298222e619909afb9acf75d62245da979915b7
eda63d887350cf17e48c7777bd8bc8f36e88d2e900a2cabb12c692c921ff628b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f57a038a716263766ff4d7f7d8a6ea13b22701ae6fc91e8b1b52fd8784844d23
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48
f736c0c7e47c3a76f37d2e086b3c8e37927bf56c7a72899ba812a8cdb8a8d76e
fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f