urlscan.io logo urlscan.io
SecurityTrails logo

email.departures.travel Open in urlscan Pro
13.52.43.40  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://departures.travel/
Effective URL: https://email.departures.travel/login?ReturnUrl=%2F
Submission: On July 21 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 6 countries across 14 domains to perform 24 HTTP transactions. The main IP is 13.52.43.40, located in San Jose, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is email.departures.travel.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 5th 2019. Valid for: 3 months.
This is the only time email.departures.travel was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 185.65.40.82 21396 (NETCONNEX...)
2 3 13.52.43.40 16509 (AMAZON-02)
7 52.85.183.231 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a03:2880:f01... 32934 (FACEBOOK)
1 52.85.183.192 16509 (AMAZON-02)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f11... 32934 (FACEBOOK)
2 2 52.213.182.66 16509 (AMAZON-02)
1 2 52.85.183.82 16509 (AMAZON-02)
1 34.95.92.78 15169 (GOOGLE)
24 12
1    185.65.40.82 (United Kingdom)

ASN21396 (NETCONNEX NetConnex Broadband Ltd., GB)
PTR: khaleesi.mycreativehosting.co.uk
departures.travel
3    13.52.43.40 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-13-52-43-40.us-west-1.compute.amazonaws.com
email.departures.travel
7    52.85.183.231 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-183-231.fra50.r.cloudfront.net
css.createsend1.com
js.createsend1.com
img.createsend1.com
1    2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
3    2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
3    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net
1    52.85.183.192 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-183-192.fra50.r.cloudfront.net
tag.demandbase.com
1    2a02:26f0:6c00:183::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
cdn.optimizely.com
1    2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:817::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
2    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com
2    52.213.182.66 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-213-182-66.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
2    52.85.183.82 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-183-82.fra50.r.cloudfront.net
segments.company-target.com
1    34.95.92.78 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 78.92.95.34.bc.googleusercontent.com
id.rlcdn.com
Domain Requested by
4 css.createsend1.com email.departures.travel
3 connect.facebook.net email.departures.travel
connect.facebook.net
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
email.departures.travel
3 email.departures.travel 2 redirects
2 segments.company-target.com 1 redirects email.departures.travel
2 match.prod.bidr.io 2 redirects
2 www.facebook.com email.departures.travel
2 js.createsend1.com email.departures.travel
1 id.rlcdn.com email.departures.travel
1 www.google.de email.departures.travel
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 cdn.optimizely.com www.googletagmanager.com
1 tag.demandbase.com email.departures.travel
1 www.googletagmanager.com email.departures.travel
1 img.createsend1.com email.departures.travel
1 departures.travel 1 redirects
0 api.company-target.com Failed tag.demandbase.com
24 18

This site contains no links.

Subject Issuer Validity Valid
email.departures.travel
Let's Encrypt Authority X3		 2019-07-05 -
2019-10-03		 3 months crt.sh
*.createsend1.com
DigiCert SHA2 Secure Server CA		 2019-02-25 -
2020-07-08		 a year crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-06-18 -
2019-09-10		 3 months crt.sh
*.google.com
Google Internet Authority G3		 2019-06-18 -
2019-09-10		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-06-06 -
2019-09-04		 3 months crt.sh
*.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2018-09-20 -
2020-11-19		 2 years crt.sh
cdn.optimizely.com
DigiCert ECC Secure Server CA		 2018-11-24 -
2020-02-23		 a year crt.sh
www.google.de
Google Internet Authority G3		 2019-06-18 -
2019-09-10		 3 months crt.sh
*.company-target.com
Go Daddy Secure Certificate Authority - G2		 2017-08-18 -
2019-08-18		 2 years crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-04-24 -
2020-04-23		 a year crt.sh

This page contains 1 frames:

Primary Page: https://email.departures.travel/login?ReturnUrl=%2F
Frame ID: 8B8ED9F0E3884F8947849082E4D1F209
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://departures.travel/ HTTP 301
    http://email.departures.travel/ HTTP 301
    https://email.departures.travel/ HTTP 302
    https://email.departures.travel/login?ReturnUrl=%2F Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<!-- (?:End )?Google Tag Manager -->/i

Page Statistics

24
Requests

92 %
HTTPS

53 %
IPv6

14
Domains

18
Subdomains

12
IPs

6
Countries

307 kB
Transfer

1035 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://departures.travel/ HTTP 301
    http://email.departures.travel/ HTTP 301
    https://email.departures.travel/ HTTP 302
    https://email.departures.travel/login?ReturnUrl=%2F Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j77&tid=UA-30586-1&cid=632365936.1563753210&jid=84810925&gjid=1729639778&_gid=615367543.1563753210&_u=aGBAgUAj~&z=1020176573 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-30586-1&cid=632365936.1563753210&jid=84810925&_v=j77&z=1020176573 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-30586-1&cid=632365936.1563753210&jid=84810925&_v=j77&z=1020176573&slf_rd=1&random=2988253356
Request Chain 21
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAI5Y066afYAABa_1NwE9w HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAI5Y066afYAABa_1NwE9w&verifyHash=6c35e360e05fcf1c7188a9027b847d4304ba03e3

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
email.departures.travel/
Redirect Chain
  • http://departures.travel/
  • http://email.departures.travel/
  • https://email.departures.travel/
  • https://email.departures.travel/login?ReturnUrl=%2F
12 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
13.52.43.40 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-13-52-43-40.us-west-1.compute.amazonaws.com
Software
csw /
Resource Hash
faa1a2543e5adf6027a654ca956a0cc9298cf98aadd1dcc8325affc0138500a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:method
GET
:authority
email.departures.travel
:scheme
https
:path
/login?ReturnUrl=%2F
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
server
csw
vary
Accept-Encoding
cache-control
private
content-type
text/html; charset=utf-8
content-encoding
gzip
p3p
CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
date
Sun, 21 Jul 2019 23:53:27 GMT
x-xss-protection
1;mode=block
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
referrer-policy
no-referrer-when-downgrade

Redirect headers

status
302
server
csw
cache-control
private
content-type
text/html; charset=utf-8
p3p
CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
date
Sun, 21 Jul 2019 23:53:26 GMT
location
/login?ReturnUrl=%2F
x-xss-protection
1;mode=block
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
referrer-policy
no-referrer-when-downgrade
content-length
137
reset.min.css
css.createsend1.com/css/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://css.createsend1.com/css/reset.min.css?h=3B4BACAF20190627
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-231.fra50.r.cloudfront.net
Software
csw /
Resource Hash
8d3002d3039b7a126cd3d7aa3e068f1b46ac98d6e1dfbc167305ca21cd19d74c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 27 Jun 2019 05:58:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2138116
x-cache
Hit from cloudfront
p3p
CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
status
200
vary
Accept-Encoding
x-xss-protection
1;mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 26 Jun 2019 18:46:14 GMT
server
csw
etag
"05f306e4f2cd51:0"
x-frame-options
SAMEORIGIN
content-type
text/css
via
1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
cache-control
public,max-age=31536000
x-amz-cf-pop
FRA50
x-amz-cf-id
Fvb0PQlyEUsgkmmRWP6pH4CKw5hZlDV9xEcEg5krIOgj99F3cqcOlQ==
new-login.min.css
css.createsend1.com/css/ 		15 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://css.createsend1.com/css/new-login.min.css?h=24C3F06220190627
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-231.fra50.r.cloudfront.net
Software
csw /
Resource Hash
57a98fe05cf3db3251a1f309d2e3a7142cb56f0f066faffef474ee0d4bed3b16
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 27 Jun 2019 05:57:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2138119
x-cache
Hit from cloudfront
p3p
CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
status
200
vary
Accept-Encoding
x-xss-protection
1;mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 26 Jun 2019 18:45:48 GMT
server
csw
etag
"016b15e4f2cd51:0"
x-frame-options
SAMEORIGIN
content-type
text/css
via
1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
cache-control
public,max-age=31536000
x-amz-cf-pop
FRA50
x-amz-cf-id
sQO9vl5nZrVTAD3w9RGTMsKOXrcZK0YOT4kweMBfgrwmq4Gh52py4w==
cm-gtm.min.js
js.createsend1.com/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.createsend1.com/js/cm-gtm.min.js?h=6D2AA99F20190627
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-231.fra50.r.cloudfront.net
Software
csw /
Resource Hash
2befc9783d98a5c66e088ff357e282341c3f11b0ac006f1bd4d1e624657c63e3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 27 Jun 2019 05:57:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2138138
x-cache
Hit from cloudfront
p3p
CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
status
200
vary
Accept-Encoding
x-xss-protection
1;mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 26 Jun 2019 18:46:30 GMT
server
csw
x-frame-options
SAMEORIGIN
content-type
application/javascript
via
1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
cache-control
public,max-age=31536000
x-amz-cf-pop
FRA50
x-amz-cf-id
gu8BKSAShj5VHdS8ZetVLcTcCQBoXXZMNjSSBNNyR5WK8YhQmwFKag==
cm-logoauth.png
img.createsend1.com/static/logos/r/D81CF733/login/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.createsend1.com/static/logos/r/D81CF733/login/cm-logoauth.png
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-231.fra50.r.cloudfront.net
Software
csw /
Resource Hash
73c4853ccc92452fd88899182ea19a2f36c2f6b820c59cdbf4ecac4bdaa94825
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1;mode=block

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 21 Jul 2019 23:53:28 GMT
via
1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA50
x-cache
Miss from cloudfront
p3p
CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
status
200
content-length
9587
x-xss-protection
1;mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 06 Jun 2017 15:23:58 GMT
server
csw
etag
"e87dcdead8ded21:0"
content-type
image/png
cache-control
public,max-age=86400
accept-ranges
bytes
x-amz-cf-id
W-VKiXEv2DtqkTweN623YjSx1HsOfXDoRcPPSG1osDW8-hfUv35eBg==
jquery-1.7.2.min.js
js.createsend1.com/js/ 		0
0
login.min.js
js.createsend1.com/js/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.createsend1.com/js/login.min.js?h=510D542F20190627
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-231.fra50.r.cloudfront.net
Software
csw /
Resource Hash
bb8114b0159f0666713ce9b70eec487fd143ce482e730e2e1e986d8c30a51a83
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 27 Jun 2019 05:58:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2138117
x-cache
Hit from cloudfront
p3p
CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
status
200
vary
Accept-Encoding
x-xss-protection
1;mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 26 Jun 2019 18:46:52 GMT
server
csw
x-frame-options
SAMEORIGIN
content-type
application/javascript
via
1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
cache-control
public,max-age=31536000
x-amz-cf-pop
FRA50
x-amz-cf-id
YQ0g9RlVTiGuJULUCq7ZP0Ujimt84YkxYLEBvdXBFFmIsqNfpFxDsg==
gtm.js
www.googletagmanager.com/ 		111 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-P6RM8B
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
33a64efbed548d386baec3b6bf744f5e5b3c9477bec3de5a371fa32193159fe7
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 21 Jul 2019 23:53:30 GMT
content-encoding
br
last-modified
Sun, 21 Jul 2019 21:00:00 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
30655
x-xss-protection
0
expires
Sun, 21 Jul 2019 23:53:30 GMT
thanks.png
css.createsend1.com/img/new-login/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://css.createsend1.com/img/new-login/thanks.png?v=1
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-231.fra50.r.cloudfront.net
Software
csw /
Resource Hash
3f4464735c0dc92cbbbe3eaa059d51c8f0c80a948f1609da90aa90017e3a168e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://css.createsend1.com/css/new-login.min.css?h=24C3F06220190627
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 12 Jun 2019 06:07:52 GMT
via
1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
3433538
x-cache
Hit from cloudfront
p3p
CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
status
200
content-length
1820
x-xss-protection
1;mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 11 Jun 2019 18:44:46 GMT
server
csw
etag
"0638abd8520d51:0"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public,max-age=31536000
x-amz-cf-pop
FRA50
accept-ranges
bytes
x-amz-cf-id
Hm6yqYJG_N2R_L1Lc22-YCMPPlQHzFbuCrcttUZhsFGSygcWzJb7Vg==
tiny-checkbox.png
css.createsend1.com/img/new-login/ 		331 B
720 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://css.createsend1.com/img/new-login/tiny-checkbox.png
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.231 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-231.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
37973bfe54c054406cdf1578679ac3e2a81290cd5842fb5ffc88d8dcbde37216

Request headers

Referer
https://css.createsend1.com/css/new-login.min.css?h=24C3F06220190627
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 12 Jun 2019 06:07:40 GMT
via
1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)
x-amz-expiration
expiry-date="Wed, 11 Sep 2019 00:00:00 GMT", rule-id="assets-clean-up"
last-modified
Wed, 12 Jun 2019 05:47:28 GMT
server
AmazonS3
age
54531
etag
"08aaac5b14590e2c4dbde69c047f1d5e"
x-cache
Hit from cloudfront
content-type
image/png
status
200
x-amz-cf-pop
FRA50
accept-ranges
bytes
content-length
331
x-amz-cf-id
oE_nyZKlxcbC_glrKFTcniNoP1HTpyzgv3z010jB0G2IKvrHUORccQ==
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6RM8B
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 20 Jun 2019 21:35:04 GMT
server
Golfe2
age
1551
date
Sun, 21 Jul 2019 23:27:39 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
17707
expires
Mon, 22 Jul 2019 01:27:39 GMT
fbevents.js
connect.facebook.net/en_US/ 		85 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
db04a49b93b18d92b102b50dff25ecb06f6aedd156f442bb8d4dc9f2e3a66a34
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
22680
x-xss-protection
0
pragma
public
x-fb-debug
06ZgBbeThAKgzpJXPnFMfrM3ushPiTz0sxvINWqxIq1Xr22uBNzQgMdd0/C2j/aYymMHEdOYEWhoBGe8zNkqxw==
x-fb-trip-id
997090344
date
Sun, 21 Jul 2019 23:53:30 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
40caefc7.min.js
tag.demandbase.com/ 		59 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.demandbase.com/40caefc7.min.js
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.192 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-192.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
db0a7801968d431903e9cc49c94d5c86ceb3b621f730cc08eb2705f97bcbcec3

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
P7cRq.jrwB2Vofcj6bYl5pnKigwqaY3N
content-encoding
gzip
last-modified
Mon, 01 Jul 2019 17:34:53 GMT
server
AmazonS3
x-amz-cf-pop
FRA50
date
Sun, 21 Jul 2019 23:53:32 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
fWAS-EX-ospvPHeQqTahaSbUmbcTtAqLRgavez4SQEB0NrMt1rReBw==
via
1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
341578140.js
cdn.optimizely.com/js/ 		373 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.optimizely.com/js/341578140.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6RM8B
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:183::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
576d21a80a4e08e3d9eae8f9622ccdf4376920ad0b785f735486897de8eed7d5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-meta-pci_enabled
False
x-amz-version-id
2hfEZpJrezTU035xSktMLuPmA9nqLZhI
content-encoding
gzip
x-amz-request-id
8684F92EE14240F0
status
200
access-control-max-age
86400
date
Sun, 21 Jul 2019 23:53:30 GMT
x-amz-replication-status
COMPLETED
server-timing
cdn;desc="AkamaiION";dur=0,rtt;desc="5";dur=0,cdnip;desc="2a02:26f0:6c00:183::13b8";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
strict-transport-security
max-age=15768000
content-length
119295
x-amz-id-2
FpCzeWmZrfYuaDl9Up//MXrRCHEnB2A0VAFep00g2RtlfWR7jotFqPGKsy0iP7EKwf3ljuPPWfU=
last-modified
Fri, 12 Jul 2019 18:35:21 GMT
server
AmazonS3
etag
"ace1eb4d11990f3c91ed9955de07e23c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
x-amz-meta-revision
cache-control
max-age=120
x-amz-meta-revision
3146
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
*
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
958 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 21 Jul 2019 23:38:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Apr 2016 03:17:22 GMT
server
sffe
age
891
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
856
x-xss-protection
0
expires
Mon, 22 Jul 2019 00:38:39 GMT
1562770640642184
connect.facebook.net/signals/config/ 		301 KB
72 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1562770640642184?v=2.9.1&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
15e7b12570ac6831848a5f5fd2d59d5beff47e4f2bd9bd45ade7d45886016439
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
x-xss-protection
0
pragma
public
x-fb-debug
ft2UvGRha3G9jzLw+vcUICF7faak4JAVh3XUoTspVBASV/6G1QB6YuwDuEN+AdMgn1FM05ktNyJwJ/uPhgUhAw==
x-fb-trip-id
997090344
date
Sun, 21 Jul 2019 23:53:30 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j77&aip=1&a=3446274&t=pageview&_s=1&dl=https%3A%2F%2Femail.departures.travel%2Flogin%3FReturnUrl%3D%252F&dp=%2Fapp%2Flogin%3FReturnUrl%3D%252F&ul=en-us&de=UTF-8&dt=Please%20log%20in%20%7C%20Email%20Departures&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgUAj~&jid=84810925&gjid=1729639778&cid=632365936.1563753210&tid=UA-30586-1&_gid=615367543.1563753210&gtm=2wg7f1P6RM8B&z=1324491511
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 09 Jul 2019 02:05:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1115272
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j77&tid=UA-30586-1&cid=632365936.1563753210&jid=84810925&gjid=1729639778&_gid=615367543.1563753210&_u=aGBAgUAj~&z=1020176573
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-30586-1&cid=632365936.1563753210&jid=84810925&_v=j77&z=1020176573
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-30586-1&cid=632365936.1563753210&jid=84810925&_v=j77&z=1020176573&slf_rd=1&random=2988253356
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-30586-1&cid=632365936.1563753210&jid=84810925&_v=j77&z=1020176573&slf_rd=1&random=2988253356
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 21 Jul 2019 23:53:30 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 21 Jul 2019 23:53:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-30586-1&cid=632365936.1563753210&jid=84810925&_v=j77&z=1020176573&slf_rd=1&random=2988253356
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
inferredEvents.js
connect.facebook.net/signals/plugins/ 		1 KB
898 B 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.9.1
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
772
x-xss-protection
0
pragma
public
x-fb-debug
kJ13R/FE+Js56hqxArwce+UEJfLp/SU14nimsNBs9tPyeOX+zAUYpgSrfirLYbZ+CjusR0orsc5DDq4XcdLlJA==
x-fb-trip-id
997090344
date
Sun, 21 Jul 2019 23:53:30 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
99 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1562770640642184&ev=PageView&dl=https%3A%2F%2Femail.departures.travel%2Flogin%3FReturnUrl%3D%252F&rl=&if=false&ts=1563753210549&sw=1600&sh=1200&v=2.9.1&r=stable&ec=0&o=30&fbp=fb.1.1563753210548.1108873364&it=1563753210444&coo=false&rqm=GET
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 21 Jul 2019 23:53:30 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Sun, 21 Jul 2019 23:53:30 GMT
/
www.facebook.com/tr/ 		44 B
248 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1562770640642184&ev=Microdata&dl=https%3A%2F%2Femail.departures.travel%2Flogin%3FReturnUrl%3D%252F&rl=&if=false&ts=1563753212051&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Please%20log%20in%20%7C%20Email%20Departures%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.1&r=stable&ec=1&o=30&fbp=fb.1.1563753212051.1102928294&it=1563753210444&coo=false&es=automatic&rqm=GET
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 21 Jul 2019 23:53:32 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Sun, 21 Jul 2019 23:53:32 GMT
ip.json
api.company-target.com/api/v2/ 		0
0
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAI5Y066afYAABa_1NwE9w
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAI5Y066afYAABa_1NwE9w&verifyHash=6c35e360e05fcf1c7188a9027b847d4304ba03e3
26 B
359 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAI5Y066afYAABa_1NwE9w&verifyHash=6c35e360e05fcf1c7188a9027b847d4304ba03e3
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.85.183.82 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-183-82.fra50.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 21 Jul 2019 23:53:48 GMT
Via
1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA50
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Connection
keep-alive
Content-Length
26
X-Amz-Cf-Id
4g-jSph3KJaoe6XiMbbf8ZuvAOXK5TUDK80Q4izkKrzYmUCarKGx9w==

Redirect headers

Date
Sun, 21 Jul 2019 23:53:48 GMT
Via
1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA50
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AAI5Y066afYAABa_1NwE9w&verifyHash=6c35e360e05fcf1c7188a9027b847d4304ba03e3
Connection
keep-alive
Content-Length
0
X-Amz-Cf-Id
BiY80nWgiPP9Arft5448cnIXwq41tsecLj0XtoPQlcOKmKvKB2hSCA==
464526.gif
id.rlcdn.com/ 		0
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/464526.gif
Requested by
Host: email.departures.travel
URL: https://email.departures.travel/login?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.92.78 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
78.92.95.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://email.departures.travel/login?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Sun, 21 Jul 2019 23:53:47 GMT
via
1.1 google
alt-svc
clear

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
js.createsend1.com
URL
https://js.createsend1.com/js/jquery-1.7.2.min.js?h=C99A465920190627
Domain
api.company-target.com
URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Femail.departures.travel%2Flogin%3FReturnUrl%3D%252F&page_title=Please%20log%20in%20%7C%20Email%20Departures&key=edabaedf67f8ff738623c2759e9d387b&src=tag

Verdicts & Comments Add Verdict or Comment

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| AppcuesSettings object| analytics object| login object| CS object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga function| fbq function| _fbq object| google_tag_data object| gaplugins object| gaGlobal object| gaData undefined| _ function| __extends object| Demandbase object| __db function| DBSegment

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.company-target.com
cdn.optimizely.com
connect.facebook.net
css.createsend1.com
departures.travel
email.departures.travel
id.rlcdn.com
img.createsend1.com
js.createsend1.com
match.prod.bidr.io
segments.company-target.com
stats.g.doubleclick.net
tag.demandbase.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
api.company-target.com
js.createsend1.com
13.52.43.40
185.65.40.82
2a00:1450:4001:817::2004
2a00:1450:4001:818::2003
2a00:1450:4001:820::200e
2a00:1450:4001:824::2008
2a00:1450:400c:c00::9a
2a02:26f0:6c00:183::13b8
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.95.92.78
52.213.182.66
52.85.183.192
52.85.183.231
52.85.183.82
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
15e7b12570ac6831848a5f5fd2d59d5beff47e4f2bd9bd45ade7d45886016439
2befc9783d98a5c66e088ff357e282341c3f11b0ac006f1bd4d1e624657c63e3
33a64efbed548d386baec3b6bf744f5e5b3c9477bec3de5a371fa32193159fe7
37973bfe54c054406cdf1578679ac3e2a81290cd5842fb5ffc88d8dcbde37216
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3f4464735c0dc92cbbbe3eaa059d51c8f0c80a948f1609da90aa90017e3a168e
576d21a80a4e08e3d9eae8f9622ccdf4376920ad0b785f735486897de8eed7d5
57a98fe05cf3db3251a1f309d2e3a7142cb56f0f066faffef474ee0d4bed3b16
73c4853ccc92452fd88899182ea19a2f36c2f6b820c59cdbf4ecac4bdaa94825
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8d3002d3039b7a126cd3d7aa3e068f1b46ac98d6e1dfbc167305ca21cd19d74c
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
bb8114b0159f0666713ce9b70eec487fd143ce482e730e2e1e986d8c30a51a83
cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e
db04a49b93b18d92b102b50dff25ecb06f6aedd156f442bb8d4dc9f2e3a66a34
db0a7801968d431903e9cc49c94d5c86ceb3b621f730cc08eb2705f97bcbcec3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
faa1a2543e5adf6027a654ca956a0cc9298cf98aadd1dcc8325affc0138500a6