urlscan.io logo urlscan.io
SecurityTrails logo

promo.level.travel Open in urlscan Pro
185.165.123.206  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://tours.biletikoff.ru/
Effective URL: https://promo.level.travel/wlalert
Submission: On October 26 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 24 IPs in 3 countries across 21 domains to perform 90 HTTP transactions. The main IP is 185.165.123.206, located in Russian Federation and belongs to VARITI-AS, RU. The main domain is promo.level.travel.
TLS certificate: Issued by R3 on October 2nd 2021. Valid for: 3 months.
This is the only time promo.level.travel was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 178.154.205.88 200350 (YANDEXCLOUD)
1 185.165.123.206 64432 (VARITI-AS)
24 151.236.118.235 204720 (CDNETWORKS)
2 178.248.236.28 197068 (QRATOR)
1 142.250.185.138 15169 (GOOGLE)
1 172.217.23.104 15169 (GOOGLE)
6 142.250.186.99 15169 (GOOGLE)
4 142.250.185.78 15169 (GOOGLE)
3 142.251.5.156 15169 (GOOGLE)
5 52.19.73.183 16509 (AMAZON-02)
3 84.252.130.113 200350 (YANDEXCLOUD)
4 217.69.133.145 47764 (MAILRU-AS...)
1 13.32.121.98 16509 (AMAZON-02)
2 87.240.190.67 47541 (VKONTAKTE...)
2 157.240.20.19 32934 (FACEBOOK)
3 7 93.158.134.119 13238 (YANDEX)
2 35.186.228.179 15169 (GOOGLE)
1 142.250.185.132 15169 (GOOGLE)
2 185.60.216.35 32934 (FACEBOOK)
18 151.236.71.248 204720 (CDNETWORKS)
1 2 193.232.148.144 48061 (UMA-TECH-AS)
1 2 35.244.223.69 15169 (GOOGLE)
1 185.129.100.115 57724 (DDOS-GUARD)
90 24
2    178.154.205.88 (Russian Federation)

ASN200350 (YANDEXCLOUD, RU)
tours.biletikoff.ru
conversion.cx
1    185.165.123.206 (Russian Federation)

ASN64432 (VARITI-AS, RU)
promo.level.travel
24    151.236.118.235 (Moscow, Russian Federation)

ASN204720 (CDNETWORKS, RU)
static.tildacdn.com
2    178.248.236.28 (Russian Federation)

ASN197068 (QRATOR, RU)
ws.tildacdn.com
1    142.250.185.138 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f10.1e100.net
fonts.googleapis.com
1    172.217.23.104 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f8.1e100.net
www.googletagmanager.com
6    142.250.186.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f3.1e100.net
fonts.gstatic.com
4    142.250.185.78 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f14.1e100.net
www.google-analytics.com
3    142.251.5.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wg-in-f156.1e100.net
stats.g.doubleclick.net
5    52.19.73.183 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-73-183.eu-west-1.compute.amazonaws.com
api.flocktory.com
3    84.252.130.113 (Russian Federation)

ASN200350 (YANDEXCLOUD, RU)
api.mindbox.ru
4    217.69.133.145 (Russian Federation)

ASN47764 (MAILRU-AS Mail.Ru, RU)
PTR: top-fwz1.mail.ru
top-fwz1.mail.ru
1    13.32.121.98 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-98.fra60.r.cloudfront.net
cdn.level.travel
2    87.240.190.67 (Russian Federation)

ASN47541 (VKONTAKTE-SPB-AS vk.com, RU)
PTR: srv67-190-240-87.vk.com
vk.com
2    157.240.20.19 (United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-frt3.fbcdn.net
connect.facebook.net
7    93.158.134.119 (Russian Federation)

ASN13238 (YANDEX, RU)
PTR: mc.yandex.ru
mc.yandex.ru
mc.yandex.com
2    35.186.228.179 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 179.228.186.35.bc.googleusercontent.com
google-analytics.bi.owox.com
1    142.250.185.132 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f4.1e100.net
www.google.com
2    185.60.216.35 (Ireland)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-frx5.facebook.com
www.facebook.com
18    151.236.71.248 (Moscow, Russian Federation)

ASN204720 (CDNETWORKS, RU)
thumb.tildacdn.com
2    193.232.148.144 (Russian Federation)

ASN48061 (UMA-TECH-AS, RU)
PTR: smtp5.sender.ltmse.com
px.adhigh.net
2    35.244.223.69 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 69.223.244.35.bc.googleusercontent.com
wf.frontend.weborama.fr
1    185.129.100.115 (Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: ddos-guard.net
stat.tildacdn.com
Domain Requested by
24 static.tildacdn.com promo.level.travel
18 thumb.tildacdn.com
6 fonts.gstatic.com fonts.googleapis.com
5 mc.yandex.com 2 redirects
5 api.flocktory.com www.googletagmanager.com
api.flocktory.com
4 top-fwz1.mail.ru promo.level.travel
top-fwz1.mail.ru
api.flocktory.com
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 api.mindbox.ru www.googletagmanager.com
api.mindbox.ru
3 stats.g.doubleclick.net www.googletagmanager.com
www.google-analytics.com
2 wf.frontend.weborama.fr 1 redirects
2 px.adhigh.net 1 redirects
2 www.facebook.com
2 google-analytics.bi.owox.com
2 mc.yandex.ru 1 redirects promo.level.travel
2 connect.facebook.net promo.level.travel
connect.facebook.net
2 vk.com promo.level.travel
2 ws.tildacdn.com promo.level.travel
1 stat.tildacdn.com static.tildacdn.com
1 www.google.com
1 conversion.cx cdn.level.travel
1 cdn.level.travel promo.level.travel
1 www.googletagmanager.com promo.level.travel
1 fonts.googleapis.com ws.tildacdn.com
1 promo.level.travel
1 tours.biletikoff.ru 1 redirects
90 25
Subject Issuer Validity Valid
promo.level.travel
R3		 2021-10-02 -
2021-12-31		 3 months crt.sh
*.tildacdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-19 -
2022-03-19		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.flocktory.com
Go Daddy Secure Certificate Authority - G2		 2021-07-16 -
2022-06-27		 a year crt.sh
*.mindbox.ru
Thawte RSA CA 2018		 2021-03-16 -
2022-03-21		 a year crt.sh
*.mail.ru
GeoTrust ECC CA 2018		 2021-10-15 -
2022-11-15		 a year crt.sh
*.level.travel
R3		 2021-09-12 -
2021-12-11		 3 months crt.sh
*.vk.com
GlobalSign Organization Validation CA - SHA256 - G2		 2020-06-09 -
2022-06-10		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-08-04 -
2021-11-02		 3 months crt.sh
mc.yandex.ru
Yandex CA		 2021-07-28 -
2022-01-07		 5 months crt.sh
conversion.cx
R3		 2021-08-09 -
2021-11-07		 3 months crt.sh
google-analytics.bi.owox.com
GTS CA 1D4		 2021-10-25 -
2022-01-23		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
ltmse.com
R3		 2021-10-12 -
2022-01-10		 3 months crt.sh
*.frontend.weborama.fr
Go Daddy Secure Certificate Authority - G2		 2021-02-20 -
2022-03-24		 a year crt.sh

This page contains 3 frames:

Primary Page: https://promo.level.travel/wlalert
Frame ID: 2FB40DDBAB65460563A64EA09CE7A6F3
Requests: 88 HTTP requests in this frame

Frame: https://api.flocktory.com/v2/provider/provider.html
Frame ID: A45B5AAC02EAB5018A6188F3AC591F2E
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: D9C4025C2724AE55CBA627243E27EE5F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Страница этого партнера Level.Travel временно отключена

Page URL History Show full URLs

  1. https://tours.biletikoff.ru/ HTTP 302
    https://promo.level.travel/wlalert Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+tilda(?:cdn|\.ws|-blocks)
  • tilda(?:cdn|\.ws|-blocks)
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
Overall confidence: 100%
Detected patterns
  • hammer(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • tracker\.js
Overall confidence: 100%
Detected patterns
  • mc\.yandex\.ru/metrika/(?:tag|watch)\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

90
Requests

100 %
HTTPS

0 %
IPv6

21
Domains

25
Subdomains

24
IPs

3
Countries

2065 kB
Transfer

3795 kB
Size

42
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://tours.biletikoff.ru/ HTTP 302
    https://promo.level.travel/wlalert Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55
  • https://mc.yandex.com/sync_cookie_image_check?t=ti(4) HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9438.D7EVjD330HQbHCx3q_zORr_mCP7IfFMhCWlfdjj7gufPV6mtO0vjNrQPIJmGwx5P.Y84rfekWa0tPU6t6T1G4Nn3t0sY%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=9438.tiB-fFrYGc_I8sN50DfF78pl8Ir8w8IhYPp5HNhcRpOQYQZxq5qHGv01CrCiu7uZ8lTx9T90x6_ty2HeBlj0Cg%2C%2C.feQqH-TF0XShLi4wy4-Uac4aNNQ%2C
Request Chain 63
  • https://mc.yandex.com/watch/18706828?wmode=7&page-url=https%3A%2F%2Fpromo.level.travel%2Fwlalert&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1295726874995%3Ahid%3A495929719%3Az%3A0%3Ai%3A202101026061221%3Aet%3A1635228742%3Ac%3A1%3Arn%3A937238065%3Arqn%3A1%3Au%3A1635228742585664401%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1635228740668%3Ads%3A10%2C29%2C46%2C6%2C170%2C0%2C%2C663%2C33%2C985%2C985%2C9%2C923%3Adsn%3A10%2C30%2C46%2C6%2C171%2C0%2C%2C660%2C34%2C985%2C985%2C9%2C923%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1635228742%3At%3A%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0&t=gdpr(14)ti(2) HTTP 302
  • https://mc.yandex.com/watch/18706828/1?wmode=7&page-url=https%3A%2F%2Fpromo.level.travel%2Fwlalert&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1295726874995%3Ahid%3A495929719%3Az%3A0%3Ai%3A202101026061221%3Aet%3A1635228742%3Ac%3A1%3Arn%3A937238065%3Arqn%3A1%3Au%3A1635228742585664401%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1635228740668%3Ads%3A10%2C29%2C46%2C6%2C170%2C0%2C%2C663%2C33%2C985%2C985%2C9%2C923%3Adsn%3A10%2C30%2C46%2C6%2C171%2C0%2C%2C660%2C34%2C985%2C985%2C9%2C923%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1635228742%3At%3A%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0&t=gdpr%2814%29ti%282%29
Request Chain 81
  • https://px.adhigh.net/p/cm/flocktory?u=198ef338-7691-4959-803ce49d9293d63c HTTP 302
  • https://px.adhigh.net/p/cm/flocktory?u=198ef338-7691-4959-803ce49d9293d63c&bounced=1
Request Chain 82
  • https://wf.frontend.weborama.fr/streampixel/?wamid=7629&Wvar=%7B%22flocktory_id%22%3A%22198ef338-7691-4959-803ce49d9293d63c%22%7D&d.r=1635228742192 HTTP 302
  • https://wf.frontend.weborama.fr/streampixel/?wamid=7629&Wvar=%7B%22flocktory_id%22%3A%22198ef338-7691-4959-803ce49d9293d63c%22%7D&d.r=1635228742192&bounce=1&random=3388073068

90 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set wlalert
promo.level.travel/
Redirect Chain
  • https://tours.biletikoff.ru/
  • https://promo.level.travel/wlalert
91 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://promo.level.travel/wlalert
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.165.123.206 , Russian Federation, ASN64432 (VARITI-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
702ae144ae7385791ff5e3f815616360464b2587e1eac2af1edfe7c92c713df4
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Host
promo.level.travel
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx
Date
Tue, 26 Oct 2021 06:12:20 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
11419
Last-Modified
Fri, 05 Mar 2021 12:34:26 GMT
ETag
"16d70-5bcc94df7fc06-gzip"
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
X-Frame-Options
SAMEORIGIN
X-Host
promo.level.travel
Cache-Control
max-age=0 public
X-VARITI-CCR
1457767302:17
Set-Cookie
rerf=AAAAAGF3nEQknGr5A4g8Ag==; expires=Thu, 25-Nov-21 06:12:20 GMT; path=/ ipp_uid=1635228740882/4xAT5kmCF2Z2DKbP/kp+DBquQcaOWwCAJtpZzXw==; Expires=Tue, 31 Dec 2030 23:59:59 GMT; Path=/ ipp_uid1=1635228740882; Expires=Tue, 31 Dec 2030 23:59:59 GMT; Path=/ ipp_uid2=4xAT5kmCF2Z2DKbP/kp+DBquQcaOWwCAJtpZzXw==; Expires=Tue, 31 Dec 2030 23:59:59 GMT; Path=/
P3P
policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
Connection
keep-alive
Keep-Alive
timeout=60

Redirect headers

server
nginx/1.18.0
date
Tue, 26 Oct 2021 06:12:20 GMT
content-type
text/html; charset=utf-8
location
https://promo.level.travel/wlalert
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-download-options
noopen
x-permitted-cross-domain-policies
none
referrer-policy
strict-origin-when-cross-origin
cache-control
no-cache
set-cookie
cversion=30; path=/ uuid=9a789b94-d84e-49c6-8da3-3d2a5b74efe3; domain=.biletikoff.ru; path=/; expires=Sat, 26 Oct 2041 06:12:20 GMT
x-request-id
7ae03595-de58-42f2-af57-e06c4ea6fa38
x-runtime
0.008706
tilda-grid-3.0.min.css
static.tildacdn.com/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/css/tilda-grid-3.0.min.css
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
f5c301b8769579afae9deb4eda7659df32661229039c6b7a37cfabd1827317ce

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
11
last-modified
Thu, 18 Mar 2021 12:08:37 GMT
server
nginx
etag
W/"605342c5-1010"
content-type
text/css
cache-control
max-age=86400
tilda-blocks-2.12.css
ws.tildacdn.com/project1296230/ 		285 KB
43 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws.tildacdn.com/project1296230/tilda-blocks-2.12.css?t=1611053256
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.248.236.28 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software
QRATOR /
Resource Hash
3383da0f1f56cef32d0f184f3ca4683b2dd071b6c2a3f1669181506fcf2ac6d3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 26 Oct 2021 06:12:21 GMT
Content-Encoding
gzip
Last-Modified
Thu, 25 Mar 2021 09:18:27 GMT
Server
QRATOR
Transfer-Encoding
chunked
Content-Type
text/css
cache-control
max-age=0, public
X-Host
ws.tildacdn.com
Connection
keep-alive
Keep-Alive
timeout=15
tilda-animation-1.0.min.css
static.tildacdn.com/css/ 		10 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/css/tilda-animation-1.0.min.css
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
d845ac461a77e54af0e48ca2e3dcac959f793205c2eefbf1d698bc0f73998f34

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
9
last-modified
Sun, 04 Jul 2021 13:39:45 GMT
server
nginx
etag
W/"60e1ba21-28a4"
content-type
text/css
cache-control
max-age=86400
tilda-menusub-1.0.min.css
static.tildacdn.com/css/ 		2 KB
900 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/css/tilda-menusub-1.0.min.css
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
5b8c6fc9e408f36dc05233a581ed05d94a71e0e848969b6fb7370153461b042f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
12
last-modified
Sun, 25 Apr 2021 08:12:17 GMT
server
nginx
etag
W/"60852461-87f"
content-type
text/css
cache-control
max-age=86400
tilda-slds-1.4.min.css
static.tildacdn.com/css/ 		11 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/css/tilda-slds-1.4.min.css
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
cf2c58c07b25eedb7ac08c2e3c54a2a65e264979862a51a448ee81d96b8c1601

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
11
last-modified
Tue, 30 Mar 2021 09:27:55 GMT
server
nginx
etag
W/"6062ef1b-2bc7"
content-type
text/css
cache-control
max-age=86400
tilda-zoom-2.0.min.css
static.tildacdn.com/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/css/tilda-zoom-2.0.min.css
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
ee834fea8083fdba1e884b530abe364c78d61ec45f0ea39a23a68faadced3f65

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
9
last-modified
Thu, 18 Mar 2021 12:08:37 GMT
server
nginx
etag
W/"605342c5-17bd"
content-type
text/css
cache-control
max-age=86400
jquery-1.10.2.min.js
static.tildacdn.com/js/ 		91 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/js/jquery-1.10.2.min.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
c73b004ebf31b395cf237c3d2b13c1e576f385e04660ceb5f7be163ff3c201dc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
13
last-modified
Sun, 25 Apr 2021 08:11:36 GMT
server
nginx
etag
W/"60852438-16b88"
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
tilda-scripts-2.8.min.js
static.tildacdn.com/js/ 		57 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/js/tilda-scripts-2.8.min.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
f6470dc62a176c496d4754710effd20362288260e9d15c1b390b7391406e8564

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
8
last-modified
Thu, 02 Sep 2021 09:57:46 GMT
server
nginx
etag
W/"6130a01a-e3bc"
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
tilda-blocks-2.7.js
ws.tildacdn.com/project1296230/ 		196 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.tildacdn.com/project1296230/tilda-blocks-2.7.js?t=1611053256
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.248.236.28 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software
QRATOR /
Resource Hash
af41c19366789bea56a7a324dc0b0b2900762a9a614137f45eae4701be61b2cf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 26 Oct 2021 06:12:21 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Oct 2021 14:46:47 GMT
Server
QRATOR
Transfer-Encoding
chunked
Content-Type
application/javascript
cache-control
max-age=0, public
X-Host
ws.tildacdn.com
Connection
keep-alive
Keep-Alive
timeout=15
lazyload-1.3.min.js
static.tildacdn.com/js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/js/lazyload-1.3.min.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
a4eb1c41366018b711e43dcce520ebd5587ef1c97d06cdf1e7cc9dca4a8285de

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
13
last-modified
Tue, 19 Oct 2021 10:16:37 GMT
server
nginx
etag
W/"616e9b05-4374"
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
tilda-animation-1.0.min.js
static.tildacdn.com/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/js/tilda-animation-1.0.min.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
9480d469e680c9e6b9750db90c7a7167e6846811a98a13a678d21404cdc63c19

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
9
last-modified
Tue, 12 Oct 2021 12:27:05 GMT
server
nginx
etag
W/"61657f19-4773"
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
tilda-menusub-1.0.min.js
static.tildacdn.com/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/js/tilda-menusub-1.0.min.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
4759aeeb3142ecc89ea26254c0d6cde06096c64e120dc4b8705a09bf56257008

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
8
last-modified
Thu, 20 May 2021 10:03:21 GMT
server
nginx
etag
W/"60a633e9-26b4"
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
tilda-slds-1.4.min.js
static.tildacdn.com/js/ 		24 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/js/tilda-slds-1.4.min.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
cade315e3d18357ce5a8c3069cc47a5e589ced9d9069df81807c0ef8b7892c4e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
13
last-modified
Tue, 28 Sep 2021 10:42:14 GMT
server
nginx
etag
W/"6152f186-5fc0"
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
hammer.min.js
static.tildacdn.com/js/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/js/hammer.min.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
090a7068a2209545279f858c6f41ff7ae42815e11c3d69463a2a2ea835282bd9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
8
last-modified
Thu, 18 Mar 2021 12:08:37 GMT
server
nginx
etag
W/"605342c5-50f6"
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
tilda-zoom-2.0.min.js
static.tildacdn.com/js/ 		23 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/js/tilda-zoom-2.0.min.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
8bf3448edeeb86d3c774890b63ab0e14a65d1c2311b0f29872e4f2fd81263254

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
13
last-modified
Fri, 15 Oct 2021 11:53:35 GMT
server
nginx
etag
W/"61696bbf-5c03"
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
Frame.png
static.tildacdn.com/tild3336-6134-4431-b133-653065306638/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild3336-6134-4431-b133-653065306638/Frame.png
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
f8381698ecb6ba1784a81eb40cac179ca3a7249c73a2a010bdb7c9ce20f53632

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
tserver
10
last-modified
Thu, 23 May 2019 10:54:34 GMT
server
nginx
age
0
etag
"2ca4525b5758fb2c66432063c921a400"
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Expires, Cache-Control
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1761
x-trans-id
15a14a8348777315
x-timestamp
1558608873.79720
css
fonts.googleapis.com/ 		8 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,400,500,600,700&subset=latin,cyrillic
Requested by
Host: ws.tildacdn.com
URL: https://ws.tildacdn.com/project1296230/tilda-blocks-2.12.css?t=1611053256
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f10.1e100.net
Software
ESF /
Resource Hash
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ws.tildacdn.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 04:16:43 GMT
server
ESF
date
Tue, 26 Oct 2021 06:12:21 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Tue, 26 Oct 2021 06:12:21 GMT
gtm.js
www.googletagmanager.com/ 		267 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-P6VN73
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.104 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
68e629cb89363d8a61b5484389afa7314e35c023596f7dfb3eadc6ea96c3245b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
64106
x-xss-protection
0
expires
Tue, 26 Oct 2021 06:12:21 GMT
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v29/ 		9 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,600,700&subset=latin,cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://promo.level.travel
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 03:41:26 GMT
x-content-type-options
nosniff
age
527455
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 20 Oct 2022 03:41:26 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,600,700&subset=latin,cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://promo.level.travel
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 20 Oct 2021 16:31:41 GMT
x-content-type-options
nosniff
age
481240
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 20 Oct 2022 16:31:41 GMT
greece.png
static.tildacdn.com/tild3832-3236-4666-b137-643534626562/-/resizeb/20x/ 		551 B
642 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild3832-3236-4666-b137-643534626562/-/resizeb/20x/greece.png
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
b9b57d41d0ac20d9407c003a5a64491fcb330aab872b0a98bf94658a535b1708

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
cache-control
max-age=2592000
tserver
12
server
nginx
content-type
image/png
shutterstock_1421945.png
static.tildacdn.com/tild3033-3430-4231-a635-623635333132/-/resizeb/20x/ 		724 B
815 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild3033-3430-4231-a635-623635333132/-/resizeb/20x/shutterstock_1421945.png
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
262c61db9409847903a897beffde81aed4c1d37a1c3786dbfde0c0b8e897ca90

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
cache-control
max-age=2592000
tserver
12
server
nginx
content-type
image/png
shutterstock_1028899.jpg
static.tildacdn.com/tild6461-3732-4533-b531-656262316533/-/resizeb/20x/ 		363 B
454 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild6461-3732-4533-b531-656262316533/-/resizeb/20x/shutterstock_1028899.jpg
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
46f7648bbcd2ad2a615cf7d2af4ca6e555d9770935b3de0983988d6490aa8130

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
cache-control
max-age=2592000
tserver
9
server
nginx
content-type
image/jpeg
1.jpg
static.tildacdn.com/tild3439-3634-4634-b461-383030323530/-/resizeb/20x/ 		373 B
465 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild3439-3634-4634-b461-383030323530/-/resizeb/20x/1.jpg
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
389e3527776b6c23f12da344a900521883a81eeaceed0d8836be149077a22d1a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
cache-control
max-age=2592000
tserver
11
server
nginx
content-type
image/jpeg
shutterstock_1023408.jpg
static.tildacdn.com/tild3266-6438-4362-a635-336336393438/-/resizeb/20x/ 		390 B
482 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild3266-6438-4362-a635-336336393438/-/resizeb/20x/shutterstock_1023408.jpg
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
29812e2ababb1e2ab16ff99f0460cc7b522e9fe1505e64d13c889169daf95d2f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
cache-control
max-age=2592000
tserver
12
server
nginx
content-type
image/jpeg
2.jpg
static.tildacdn.com/tild3931-6637-4366-a139-623661666333/-/resizeb/20x/ 		376 B
467 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild3931-6637-4366-a139-623661666333/-/resizeb/20x/2.jpg
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
de4852d9873fd8ec250ee131b8273ac0e7f5a0da0231747a8279306db5a2aa75

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
cache-control
max-age=2592000
tserver
8
server
nginx
content-type
image/jpeg
shutterstock_1433606.jpg
static.tildacdn.com/tild3236-3732-4932-a364-356563633462/-/resizeb/20x/ 		382 B
474 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild3236-3732-4932-a364-356563633462/-/resizeb/20x/shutterstock_1433606.jpg
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
98a237b9c32173c0a7e10fd33d830c352ca2fa5f0c8d885e36338e673a24ac16

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
cache-control
max-age=2592000
tserver
12
server
nginx
content-type
image/jpeg
1-min.jpg
static.tildacdn.com/tild6336-3166-4239-b132-656539323538/-/resizeb/20x/ 		354 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild6336-3166-4239-b132-656539323538/-/resizeb/20x/1-min.jpg
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
a57b5802278aea6dfe45cfb50de83f5e45d82d8f44f4c21c87e7073189924284

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
cache-control
max-age=2592000
tserver
12
server
nginx
content-type
image/jpeg
7676.jpg
static.tildacdn.com/tild3439-3231-4265-b966-363436316161/-/resizeb/20x/ 		338 B
430 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.tildacdn.com/tild3439-3231-4265-b966-363436316161/-/resizeb/20x/7676.jpg
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
33b7bc75a41b150379b6bac39bb6e766d5b8d79473f2c8ac9fc9667639495160

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
cache-control
max-age=2592000
tserver
11
server
nginx
content-type
image/jpeg
KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,600,700&subset=latin,cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://promo.level.travel
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 04:39:47 GMT
x-content-type-options
nosniff
age
351154
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9544
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:33 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 22 Oct 2022 04:39:47 GMT
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,600,700&subset=latin,cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://promo.level.travel
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Thu, 21 Oct 2021 02:40:20 GMT
x-content-type-options
nosniff
age
444721
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15732
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:20 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 21 Oct 2022 02:40:20 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,600,700&subset=latin,cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://promo.level.travel
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 01:55:14 GMT
x-content-type-options
nosniff
age
361027
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 22 Oct 2022 01:55:14 GMT
KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,600,700&subset=latin,cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f3.1e100.net
Software
sffe /
Resource Hash
fb83389ea7513242a9a237454ce7989eb6d84c4ec2fe15c81bad6f89c87fe89e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://promo.level.travel
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 01:44:01 GMT
x-content-type-options
nosniff
age
361700
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9500
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 22 Oct 2022 01:44:01 GMT
tildastat-0.2.min.js
static.tildacdn.com/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.tildacdn.com/js/tildastat-0.2.min.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.118.235 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
65a7577f35726ea847bdf440ad18a70ee61c01ef0b5ee26b0e6a2352ace3a2ce

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
tserver
11
last-modified
Thu, 25 Mar 2021 15:46:15 GMT
server
nginx
etag
W/"605cb047-1814"
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
truncated
/ 		66 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/webp
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6VN73
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.78 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 19 Oct 2021 16:47:48 GMT
server
Golfe2
age
707
date
Tue, 26 Oct 2021 06:00:34 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
19887
expires
Tue, 26 Oct 2021 08:00:34 GMT
dc.js
stats.g.doubleclick.net/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/dc.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6VN73
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.5.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wg-in-f156.1e100.net
Software
Golfe2 /
Resource Hash
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 19 Oct 2021 16:47:48 GMT
server
Golfe2
age
1964
date
Tue, 26 Oct 2021 05:39:37 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17093
expires
Tue, 26 Oct 2021 07:39:37 GMT
loader.js
api.flocktory.com/v2/ 		263 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.flocktory.com/v2/loader.js?site_id=2113
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6VN73
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.73.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-19-73-183.eu-west-1.compute.amazonaws.com
Software
openresty /
Resource Hash
3daf8ab92f6f7021fa395a4bca9487f34ba4ecc06e5a7fcf7ff72f88c451c177

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 26 Oct 2021 06:12:21 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Oct 2021 13:00:27 GMT
Server
openresty
x-amz-meta-s3cmd-attrs
atime:1633352363/ctime:1633352363/gid:0/gname:root/md5:d531eb2e38b7a335eefb9f91ebf27ad4/mode:33188/mtime:1633352363/uid:0/uname:root
x-amz-request-id
N259H9N3WY4AQYYA
ETag
W/"d531eb2e38b7a335eefb9f91ebf27ad4"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=10800
Access-Control-Allow-Credentials
true
Connection
keep-alive
transfer-encoding
chunked
x-amz-id-2
mUPFeDWXhBfb7USw1Gk+kc5YM5FiQtA0O/M/n2YQL2YMkCSmT6kIwemFNt8Aa6ZK8vR9AZy2Pdc=
tracker.js
api.mindbox.ru/scripts/v1/ 		59 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.mindbox.ru/scripts/v1/tracker.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6VN73
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
84.252.130.113 , Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software
nginx /
Resource Hash
b24ac49bfc1bab8f318d64d1bbe7e98fe1e0d816cb3ea7d3e251ad6b4fc08c8a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=315360000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline'
content-encoding
gzip
x-content-type-options
nosniff
x-amz-request-id
5ce303bed4319adc
transfer-encoding
chunked
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Fri, 02 Jul 2021 16:48:14 UTC
server
nginx
x-frame-options
DENY
date
Tue, 26 Oct 2021 06:12:21 GMT
strict-transport-security
max-age=315360000; includeSubDomains; preload
content-type
application/javascript
cache-control
public,max-age=604800
feature-policy
vibrate 'self'
etag
W/"5a4bc88341c488386d322bff9ccade42"
code.js
top-fwz1.mail.ru/js/ 		25 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://top-fwz1.mail.ru/js/code.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
top-fwz1.mail.ru
Software
nginx /
Resource Hash
536cd983c5ac840349770984405fe9eb9e67b9d7e35e0c45673a653b003173b6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NOI DSP COR NID CUR PSA OUR NOR"
amp-access-control-allow-source-origin
*
last-modified
Thu, 15 Jul 2021 18:35:46 GMT
server
nginx
etag
W/"60f08002-64db"
access-control-allow-methods
GET, POST, HEAD, PUT, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
max-age=3600, private
access-control-allow-credentials
true
accept-ch-lifetime
86400
accept-ch
DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin
*
access-control-allow-headers
*
expires
Tue, 26 Oct 2021 07:12:21 GMT
tracker.js
cdn.level.travel/tracker/ 		28 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.level.travel/tracker/tracker.js?1635228741678
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.98 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-98.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c8ed0e2ea676f117fc6e7ee09293e1cede20453d2ec576d8a3709a65538baf41

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:10:41 GMT
content-encoding
br
last-modified
Tue, 25 May 2021 10:39:10 GMT
server
AmazonS3
age
109
etag
W/"2c83e9ff3447beb7e041b670c59207d0"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
cache-control
max-age=1800
x-amz-cf-pop
FRA60-P1
x-amz-cf-id
JUhor-kFkeZQb8hw78dmUtqiHXSywnuUEMzwOeGZr9RHs5TBc89haA==
openapi.js
vk.com/js/api/ 		102 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vk.com/js/api/openapi.js?160
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
87.240.190.67 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS vk.com, RU),
Reverse DNS
srv67-190-240-87.vk.com
Software
kittenx /
Resource Hash
2b2a0ec5190589d2d1e44aadfcda6283283f4f95d9828cf8259f63bc7e093677

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
br
x-frontend
front224004
last-modified
Thu, 07 Oct 2021 11:12:43 GMT
server
kittenx
etag
"615ed62b-5a1f"
content-type
application/x-javascript
access-control-expose-headers
X-Frontend
cache-control
max-age=345600
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
23071
expires
Sat, 30 Oct 2021 06:12:21 GMT
fbevents.js
connect.facebook.net/en_US/ 		98 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.240.20.19 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-02-frt3.fbcdn.net
Software
/
Resource Hash
4b5e988359c30afd1d84b7a5118296f1fc33f4527d530b096ca27aa7fbfef99a
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
25969
x-xss-protection
0
pragma
public
x-fb-debug
8FPtmnKceR8MIkrjOs+kMX/st4oQ5/d6Bbs+PiZZ/Axtc712ecGdY094u5CIH663nRVNvKF+/9ATz14z7xsN7A==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Tue, 26 Oct 2021 06:12:21 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
watch.js
mc.yandex.ru/metrika/ 		130 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/metrika/watch.js
Requested by
Host: promo.level.travel
URL: https://promo.level.travel/wlalert
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.158.134.119 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
mc.yandex.ru
Software
/
Resource Hash
48b23ea142c9df1ee6c25a1e313128022d0fffbe051787cb974a1eb058273005
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
br
last-modified
Mon, 25 Oct 2021 12:24:54 GMT
etag
"617677e6-b7cf"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
content-length
47055
expires
Tue, 26 Oct 2021 07:12:21 GMT
js
www.google-analytics.com/gtm/ 		96 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/gtm/js?id=GTM-T5QFWGM&t=gtm11&cid=805573343.1635228742
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.78 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f14.1e100.net
Software
Google Tag Manager /
Resource Hash
e2674ad2ce344ecc62371d53b2fef73249ea2e96f242bcf94aa22438a4feef91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
37925
x-xss-protection
0
expires
Tue, 26 Oct 2021 06:12:21 GMT
812571719077506
connect.facebook.net/signals/config/ 		307 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/812571719077506?v=2.9.47&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
157.240.20.19 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-02-frt3.fbcdn.net
Software
/
Resource Hash
64590b2886b37a811b50548e53bb869372d3ffef0649d75bae1a2d7d394abe29
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
iKFexr+84sm2IpGZR+1D1E2I5flKq0Nm4HZE6+jKV42mGvahi5ewDvjK50Mae01bJ/s6oPMUzRwJiGokZri51Q==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 26 Oct 2021 06:12:21 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
__utm.gif
stats.g.doubleclick.net/r/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=602274290&utmhn=promo.level.travel&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0&utmhid=75486074&utmr=-&utmp=%2Fwlalert&utmht=1635228741752&utmac=UA-27369706-1&utmgtm=2wgak0P6VN73&utmcc=__utma%3D217467095.805573343.1635228742.1635228742.1635228742.1%3B%2B__utmz%3D217467095.1635228742.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1373581741&utmredir=3&utmu=qmAgAABAAAGBAAAAAgABAAAE~
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.5.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wg-in-f156.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 26 Oct 2021 06:12:21 GMT
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
track
conversion.cx/ 		35 B
294 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://conversion.cx/track
Requested by
Host: cdn.level.travel
URL: https://cdn.level.travel/tracker/tracker.js?1635228741678
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.154.205.88 , Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
0f958a26b2e1df115d2241a0938c558b8cca6db30fc4dd0acdcf31713a104e2e

Request headers

Referer
https://promo.level.travel/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
server
nginx/1.18.0
vary
Accept-Encoding
access-control-allow-methods
POST
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://promo.level.travel
access-control-allow-credentials
true
access-control-allow-headers
Set-Cookie, *
collect
stats.g.doubleclick.net/j/ 		2 B
23 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j94&tid=UA-27369706-7&cid=805573343.1635228742&jid=328657569&gjid=1112626713&_gid=157634338.1635228742&_u=aGDCiEADRAAAAE~&z=1888438594
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.5.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wg-in-f156.1e100.net
Software
Golfe2 /
Resource Hash
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://promo.level.travel/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 26 Oct 2021 06:12:21 GMT
content-type
text/plain
access-control-allow-origin
https://promo.level.travel
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j94&a=75486074&t=pageview&_s=1&dl=https%3A%2F%2Fpromo.level.travel%2Fwlalert&ul=en-us&de=UTF-8&dt=%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&xid=3OmRys75QjGNFhJToKWWow&_utma=217467095.805573343.1635228742.1635228742.1635228742.1&_utmz=217467095.1635228742.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1635228741785&_u=aGDCiEADR~&jid=328657569&gjid=1112626713&cid=805573343.1635228742&tid=UA-27369706-7&_gid=157634338.1635228742&gtm=2wgak0P6VN73&cd3=none&cd5=805573343.1635228742_1635228741784&cd4=805573343.1635228742&cd6=none&z=733113453
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.78 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 25 Oct 2021 07:59:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
79981
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
UA-27369706-7
google-analytics.bi.owox.com/ 		0
437 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://google-analytics.bi.owox.com/UA-27369706-7?v=1&_v=j94&a=75486074&t=pageview&_s=1&dl=https%3A%2F%2Fpromo.level.travel%2Fwlalert&ul=en-us&de=UTF-8&dt=%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&xid=3OmRys75QjGNFhJToKWWow&_utma=217467095.805573343.1635228742.1635228742.1635228742.1&_utmz=217467095.1635228742.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1635228741785&_u=aGDCiEADR~&jid=328657569&gjid=1112626713&cid=805573343.1635228742&tid=UA-27369706-7&_gid=157634338.1635228742&gtm=2wgak0P6VN73&cd3=none&cd5=805573343.1635228742_1635228741784&cd4=805573343.1635228742&cd6=none&z=733113453
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.228.179 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
179.228.186.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Oct 2021 06:12:21 GMT
owoxtid
UA-27369706-7
server
openresty
cache-control
max-age=0, no-store, no-cache, must-revalidate
content-type
image/gif
access-control-allow-origin
*
owoxserver
frontend-europe-mffx
access-control-allow-credentials
true
owoxcode
200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
via
1.1 google
expires
Tue, 26 Oct 2021 06:12:21 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j94&a=75486074&t=pageview&_s=1&dl=https%3A%2F%2Fpromo.level.travel%2Fwlalert&ul=en-us&de=UTF-8&dt=%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&xid=3OmRys75QjGNFhJToKWWow&_utma=217467095.805573343.1635228742.1635228742.1635228742.1&_utmz=217467095.1635228742.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1635228741790&_u=aGDCiEADRAAAAE~&jid=&gjid=&cid=805573343.1635228742&tid=UA-27369706-7&_gid=157634338.1635228742&gtm=2wgak0P6VN73&cd3=none&cd5=805573343.1635228742_1635228741790&cd4=805573343.1635228742&cd6=none&z=448189735
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.78 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 25 Oct 2021 07:59:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
79981
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
UA-27369706-7
google-analytics.bi.owox.com/ 		0
140 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://google-analytics.bi.owox.com/UA-27369706-7?v=1&_v=j94&a=75486074&t=pageview&_s=1&dl=https%3A%2F%2Fpromo.level.travel%2Fwlalert&ul=en-us&de=UTF-8&dt=%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&xid=3OmRys75QjGNFhJToKWWow&_utma=217467095.805573343.1635228742.1635228742.1635228742.1&_utmz=217467095.1635228742.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1635228741790&_u=aGDCiEADRAAAAE~&jid=&gjid=&cid=805573343.1635228742&tid=UA-27369706-7&_gid=157634338.1635228742&gtm=2wgak0P6VN73&cd3=none&cd5=805573343.1635228742_1635228741790&cd4=805573343.1635228742&cd6=none&z=448189735
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.228.179 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
179.228.186.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Oct 2021 06:12:21 GMT
owoxtid
UA-27369706-7
server
openresty
cache-control
max-age=0, no-store, no-cache, must-revalidate
content-type
image/gif
access-control-allow-origin
*
owoxserver
frontend-europe-6d6d
access-control-allow-credentials
true
owoxcode
200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
via
1.1 google
expires
Tue, 26 Oct 2021 06:12:21 GMT
ga-audiences
www.google.com/ads/ 		42 B
472 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-27369706-7&cid=805573343.1635228742&jid=328657569&_u=aGDCiEADRAAAAE~&z=817612804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Oct 2021 06:12:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
313 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=812571719077506&ev=PageView&dl=https%3A%2F%2Fpromo.level.travel%2Fwlalert&rl=&if=false&ts=1635228741837&sw=1600&sh=1200&v=2.9.47&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1635228741836.1724970575&it=1635228741742&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.60.216.35 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-frx5.facebook.com
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Tue, 26 Oct 2021 06:12:21 GMT
sync_cookie_image_decide
mc.yandex.com/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check?t=ti(4)
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9438.D7EVjD330HQbHCx3q_zORr_mCP7IfFMhCWlfdjj7gufPV6mtO0vjNrQPIJmGwx5P.Y84rfekWa0tPU6t6T1G4Nn3t0sY%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=9438.tiB-fFrYGc_I8sN50DfF78pl8Ir8w8IhYPp5HNhcRpOQYQZxq5qHGv01CrCiu7uZ8lTx9T90x6_ty2HeBlj0Cg%2C%2C.feQqH-TF0XShLi4wy4-Uac4aNNQ%2C
75 B
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/sync_cookie_image_decide?token=9438.tiB-fFrYGc_I8sN50DfF78pl8Ir8w8IhYPp5HNhcRpOQYQZxq5qHGv01CrCiu7uZ8lTx9T90x6_ty2HeBlj0Cg%2C%2C.feQqH-TF0XShLi4wy4-Uac4aNNQ%2C
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.158.134.119 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
mc.yandex.ru
Software
/
Resource Hash
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
strict-transport-security
max-age=31536000
content-length
75
x-xss-protection
1; mode=block
content-type
text/html; charset=utf-8

Redirect headers

location
https://mc.yandex.com/sync_cookie_image_decide?token=9438.tiB-fFrYGc_I8sN50DfF78pl8Ir8w8IhYPp5HNhcRpOQYQZxq5qHGv01CrCiu7uZ8lTx9T90x6_ty2HeBlj0Cg%2C%2C.feQqH-TF0XShLi4wy4-Uac4aNNQ%2C
date
Tue, 26 Oct 2021 06:12:21 GMT
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
advert.gif
mc.yandex.com/metrika/ 		43 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/metrika/advert.gif?t=ti(4)
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.158.134.119 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
mc.yandex.ru
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
last-modified
Mon, 25 Oct 2021 12:24:54 GMT
etag
"617677e6-2b"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
43
expires
Tue, 26 Oct 2021 07:12:21 GMT
rtrg
vk.com/ 		49 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vk.com/rtrg?p=VK-RTRG-347566-7NRbs&metatag_url=https%3A%2F%2Fpromo.level.travel%2Fwlalert&metatag_title=%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
87.240.190.67 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS vk.com, RU),
Reverse DNS
srv67-190-240-87.vk.com
Software
kittenx / KPHP/7.4.109056
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
content-encoding
gzip
x-frontend
front220004
server
kittenx
x-powered-by
KPHP/7.4.109056
strict-transport-security
max-age=15768000
content-type
image/gif
access-control-expose-headers
X-Frontend
cache-control
no-store
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
65
provider.html
api.flocktory.com/v2/provider/ Frame A45B 		176 B
807 B 		Document
General
Check archive.org
Download Go to
Full URL
https://api.flocktory.com/v2/provider/provider.html
Requested by
Host: api.flocktory.com
URL: https://api.flocktory.com/v2/loader.js?site_id=2113
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.73.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-19-73-183.eu-west-1.compute.amazonaws.com
Software
openresty /
Resource Hash
7b2195aeeebb6d9585dcbbc008d73017abe6354a15205c034bc4e9452a8e5d1e

Request headers

Host
api.flocktory.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://promo.level.travel/
Accept-Encoding
gzip, deflate, br
Cookie
__flocktory-web_session2=198ef338-7691-4959-803ce49d9293d63c
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
max-age=15552000 max-age=604800 public, must-revalidate, proxy-revalidate
Content-Type
text/html
Date
Tue, 26 Oct 2021 06:12:21 GMT
ETag
"fa0d23dc4ae114b646672c80aabc3406"
Expires
Sun, 24 Apr 2022 06:12:21 GMT
Last-Modified
Fri, 17 Sep 2021 10:36:13 GMT
Pragma
public
Server
openresty
x-amz-id-2
U2kObKt6lLVgAYwPTBZLfefcFEecRUwTafdlqf0AW1+SGEIEupNFA5oNdfFi5aAloVEwfiQZ0aE=
x-amz-request-id
N25ACTKPBFYAAHZ8
Content-Length
176
Connection
keep-alive
track-visit
api.mindbox.ru/v1.1/customer/ 		134 B
882 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.mindbox.ru/v1.1/customer/track-visit?version=1.0.207&transport=XmlHttpRequest
Requested by
Host: api.mindbox.ru
URL: https://api.mindbox.ru/scripts/v1/tracker.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
84.252.130.113 , Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software
Kestrel /
Resource Hash
d725399f22363cfa4d6b3b7f489e1154d6569d84360da2ae2169f636639d54d8
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=315360000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json
Referer
https://promo.level.travel/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

content-security-policy
default-src 'self' 'unsafe-inline'
x-content-type-options
nosniff
content-length
134
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
server
Kestrel
x-frame-options
DENY
date
Tue, 26 Oct 2021 06:12:21 GMT
strict-transport-security
max-age=315360000; includeSubDomains; preload
content-type
application/json; charset=utf-8
access-control-allow-origin
https://promo.level.travel
cache-control
no-cache, no-store, must-revalidate
feature-policy
vibrate 'self'
access-control-allow-credentials
true
expires
-1
counter
top-fwz1.mail.ru/ 		43 B
1012 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://top-fwz1.mail.ru/counter?js=13;id=3012583;u=https%3A//promo.level.travel/wlalert;st=1635228741591;title=%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0;s=1600*1200;vp=1600*1200;touch=0;hds=1;frame=0;flash=;sid=11d3a60285084658;ver=60.3.0;tz=0%2FEtc%2FUnknown;ni=9.3//4g/0/0/;lvid=1635228741941%3A1635228741942%3A1%3A1b55b5d9a0dd24d1b541a3ad85287919;opts=dl;visible=true;_=0.3796059152619118
Requested by
Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
top-fwz1.mail.ru
Software
nginx /
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://promo.level.travel/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
x-content-type-options
nosniff
p3p
CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length
43
pragma
no-cache
amp-access-control-allow-source-origin
https://promo.level.travel
server
nginx
access-control-allow-methods
GET, POST, HEAD, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
https://promo.level.travel
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
accept-ch-lifetime
86400
accept-ch
DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin
https://promo.level.travel
access-control-allow-headers
*
tracker
top-fwz1.mail.ru/ 		43 B
1015 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://top-fwz1.mail.ru/tracker?js=13;id=3012583;u=https%3A//promo.level.travel/wlalert;st=1635228741591;s=1600*1200;vp=1600*1200;touch=0;hds=1;frame=0;flash=;sid=11d3a60285084658;ver=60.3.0;tz=0%2FEtc%2FUnknown;nt=0/0/1635228740668/////170/171/181/181/210/186/211/257/263/260/923/923/956/985/985/994;ni=9.3//4g/0/0/;lvid=1635228741941%3A1635228741944%3A2%3A1b55b5d9a0dd24d1b541a3ad85287919;opts=dl;visible=true;_=0.7585943748678969;e=RT/load;et=1635228741943
Requested by
Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
top-fwz1.mail.ru
Software
nginx /
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://promo.level.travel/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 26 Oct 2021 06:12:21 GMT
x-content-type-options
nosniff
p3p
CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length
43
pragma
no-cache
amp-access-control-allow-source-origin
https://promo.level.travel
server
nginx
access-control-allow-methods
GET, POST, HEAD, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
https://promo.level.travel
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
accept-ch-lifetime
86400
accept-ch
DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin
https://promo.level.travel
access-control-allow-headers
*
provider.min.js
api.flocktory.com/v2/provider/ Frame A45B 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.flocktory.com/v2/provider/provider.min.js
Requested by
Host: api.flocktory.com
URL: https://api.flocktory.com/v2/provider/provider.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.73.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-19-73-183.eu-west-1.compute.amazonaws.com
Software
openresty /
Resource Hash
138de4a50bdc40aca1841a0114a0a4f36e978a4f804664e08df23780c7306399

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://api.flocktory.com/v2/provider/provider.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 26 Oct 2021 06:12:21 GMT
Content-Encoding
gzip
x-amz-request-id
N258MCWPQ7VZBZ9T
Connection
keep-alive
Content-Length
13144
x-amz-id-2
e5fycGULV6etsidlrYpepqcVRjG4BEug+BvVx78y6IkjML2HDnbUB8h1tE+82fXRBYf0SvpHDgs=
Pragma
public
Last-Modified
Fri, 17 Sep 2021 10:36:13 GMT
Server
openresty
ETag
W/"eaf2f8ce7cbc8b156a7be074fcc7db31"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=15552000, max-age=604800, public, must-revalidate, proxy-revalidate
Access-Control-Allow-Credentials
true
Expires
Sun, 24 Apr 2022 06:12:21 GMT
1
mc.yandex.com/watch/18706828/
Redirect Chain
  • https://mc.yandex.com/watch/18706828?wmode=7&page-url=https%3A%2F%2Fpromo.level.travel%2Fwlalert&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%3A...
  • https://mc.yandex.com/watch/18706828/1?wmode=7&page-url=https%3A%2F%2Fpromo.level.travel%2Fwlalert&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%...
350 B
504 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/watch/18706828/1?wmode=7&page-url=https%3A%2F%2Fpromo.level.travel%2Fwlalert&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1295726874995%3Ahid%3A495929719%3Az%3A0%3Ai%3A202101026061221%3Aet%3A1635228742%3Ac%3A1%3Arn%3A937238065%3Arqn%3A1%3Au%3A1635228742585664401%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1635228740668%3Ads%3A10%2C29%2C46%2C6%2C170%2C0%2C%2C663%2C33%2C985%2C985%2C9%2C923%3Adsn%3A10%2C30%2C46%2C6%2C171%2C0%2C%2C660%2C34%2C985%2C985%2C9%2C923%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1635228742%3At%3A%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0&t=gdpr%2814%29ti%282%29
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.158.134.119 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
mc.yandex.ru
Software
/
Resource Hash
3090ed4435014c88df78b59e408297f818c4529030bb80453d7b896b8bf32dc7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Oct 2021 06:12:22 GMT
x-content-type-options
nosniff
last-modified
Tue, 26-Oct-2021 06:12:22 GMT
strict-transport-security
max-age=31536000
content-type
application/json; charset=utf-8
access-control-allow-origin
https://promo.level.travel
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
350
x-xss-protection
1; mode=block
expires
Tue, 26-Oct-2021 06:12:22 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Oct 2021 06:12:21 GMT
last-modified
Tue, 26-Oct-2021 06:12:21 GMT
location
/watch/18706828/1?wmode=7&page-url=https%3A%2F%2Fpromo.level.travel%2Fwlalert&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1295726874995%3Ahid%3A495929719%3Az%3A0%3Ai%3A202101026061221%3Aet%3A1635228742%3Ac%3A1%3Arn%3A937238065%3Arqn%3A1%3Au%3A1635228742585664401%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1635228740668%3Ads%3A10%2C29%2C46%2C6%2C170%2C0%2C%2C663%2C33%2C985%2C985%2C9%2C923%3Adsn%3A10%2C30%2C46%2C6%2C171%2C0%2C%2C660%2C34%2C985%2C985%2C9%2C923%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1635228742%3At%3A%D0%A1%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%20%D1%8D%D1%82%D0%BE%D0%B3%D0%BE%20%D0%BF%D0%B0%D1%80%D1%82%D0%BD%D0%B5%D1%80%D0%B0%20Level.Travel%20%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%BE%20%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD%D0%B0&t=gdpr%2814%29ti%282%29
strict-transport-security
max-age=31536000
access-control-allow-origin
https://promo.level.travel
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
x-xss-protection
1; mode=block
expires
Tue, 26-Oct-2021 06:12:21 GMT
async
api.mindbox.ru/v3/js/operations/ 		0
700 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://api.mindbox.ru/v3/js/operations/async?version=1.0.207&transport=beacon&operation=Online.VisitPromoLevelTravel&originDomain=promo.level.travel
Requested by
Host: api.mindbox.ru
URL: https://api.mindbox.ru/scripts/v1/tracker.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
84.252.130.113 , Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=315360000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://promo.level.travel/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
content-security-policy
default-src 'self' 'unsafe-inline'
referrer-policy
same-origin
server
Kestrel
date
Tue, 26 Oct 2021 06:12:21 GMT
x-frame-options
DENY
access-control-allow-origin
https://promo.level.travel
cache-control
no-cache, no-store, must-revalidate
feature-policy
vibrate 'self'
x-content-type-options
nosniff
strict-transport-security
max-age=315360000; includeSubDomains; preload
access-control-allow-credentials
true
content-length
0
x-xss-protection
1; mode=block
expires
-1
greece.png
thumb.tildacdn.com/tild3832-3236-4666-b137-643534626562/-/format/webp/ 		87 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3832-3236-4666-b137-643534626562/-/format/webp/greece.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
3f8db7f1ad5cfda7bda7e8759767e20bf36024322551cf006ae81edc63529ea9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
shutterstock_1421945.png
thumb.tildacdn.com/tild3033-3430-4231-a635-623635333132/-/resize/300x300/-/format/webp/ 		36 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3033-3430-4231-a635-623635333132/-/resize/300x300/-/format/webp/shutterstock_1421945.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
d91375c24e7f92aec7d2bf2118bf321370592d901e605abf31ecdea3a84c57f5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
shutterstock_1028899.jpg
thumb.tildacdn.com/tild6461-3732-4533-b531-656262316533/-/resize/300x300/-/format/webp/ 		36 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild6461-3732-4533-b531-656262316533/-/resize/300x300/-/format/webp/shutterstock_1028899.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
7985e639fd6a5f07717cbe121a00df7867e97872dca042ddde5a59d6fe68fd23

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
1.jpg
thumb.tildacdn.com/tild3439-3634-4634-b461-383030323530/-/resize/300x300/-/format/webp/ 		38 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3439-3634-4634-b461-383030323530/-/resize/300x300/-/format/webp/1.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
2f317d4c9032dd2b98e12fee5c3de650ed0322340c7b9ddd1e293918a18d6bc3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
shutterstock_1023408.jpg
thumb.tildacdn.com/tild3266-6438-4362-a635-336336393438/-/resize/300x300/-/format/webp/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3266-6438-4362-a635-336336393438/-/resize/300x300/-/format/webp/shutterstock_1023408.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
8065faba771389d4f542012c9764b828792e675eb1f2d6e2525fde114e5f4bd4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
shutterstock_1421945.png
thumb.tildacdn.com/tild3033-3430-4231-a635-623635333132/-/format/webp/ 		134 KB
135 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3033-3430-4231-a635-623635333132/-/format/webp/shutterstock_1421945.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
7c4b5b517101a18e598c9a3b28eef7f75547506bce843b0e4fbf8e26dcd6da78

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
shutterstock_1028899.jpg
thumb.tildacdn.com/tild6461-3732-4533-b531-656262316533/-/format/webp/ 		87 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild6461-3732-4533-b531-656262316533/-/format/webp/shutterstock_1028899.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
e8899d963998a2d77ca016c438414bfa4e7d2c2501c3119472b8b299008c017e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
1.jpg
thumb.tildacdn.com/tild3439-3634-4634-b461-383030323530/-/format/webp/ 		86 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3439-3634-4634-b461-383030323530/-/format/webp/1.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
b5751e81b8364f1bf065ba24686461407639a42e720eda594bd59a1c7f9a8525

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/jpeg
shutterstock_1023408.jpg
thumb.tildacdn.com/tild3266-6438-4362-a635-336336393438/-/format/webp/ 		40 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3266-6438-4362-a635-336336393438/-/format/webp/shutterstock_1023408.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
76b60bb33ab5ad4c74a3cdf3245e097297ee9fdb96a44955d4736536cf507835

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
2.jpg
thumb.tildacdn.com/tild3931-6637-4366-a139-623661666333/-/format/webp/ 		65 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3931-6637-4366-a139-623661666333/-/format/webp/2.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
1db536c56d2d27b45ec396906fea1b6ac6090b39acdb479831898dd287e26c5d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/jpeg
shutterstock_1433606.jpg
thumb.tildacdn.com/tild3236-3732-4932-a364-356563633462/-/format/webp/ 		218 KB
219 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3236-3732-4932-a364-356563633462/-/format/webp/shutterstock_1433606.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
66dcd50cd69629947af67c4203e3531eae1f8089a9cf14ad8cc946c61654d2a2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
1-min.jpg
thumb.tildacdn.com/tild6336-3166-4239-b132-656539323538/-/format/webp/ 		61 KB
61 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild6336-3166-4239-b132-656539323538/-/format/webp/1-min.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
8e7a0552f6c2c9fa6148cd8233cfb9b5288602025e27d53e4a3c694c42a01993

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/jpeg
7676.jpg
thumb.tildacdn.com/tild3439-3231-4265-b966-363436316161/-/format/webp/ 		206 KB
206 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3439-3231-4265-b966-363436316161/-/format/webp/7676.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
63cc52bc18b3d5dd8cf11a34f6c12bb886983223822d198f73eef2382ad94e75

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
setup-api.js
api.flocktory.com/u_shaman/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://api.flocktory.com/u_shaman/setup-api.js?body=%7B%22siteId%22%3A%222113%22%2C%22utm%22%3A%7B%22source%22%3A%22direct%22%2C%22medium%22%3A%22none%22%2C%22campaign%22%3A%22direct%22%2C%22term%22%3A%22%22%2C%22content%22%3A%22%22%7D%2C%22site-session-id%22%3A%22358d004d-309d-47be-b1af-9dd89a4d637d-8%22%7D&callback=flock_jsonp_1
Requested by
Host: api.flocktory.com
URL: https://api.flocktory.com/v2/loader.js?site_id=2113
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.73.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-19-73-183.eu-west-1.compute.amazonaws.com
Software
openresty /
Resource Hash
5095c1ca7a63dd026f60dc9a392fbee82a3f1dd4ed58ff77474781b84529b063
Security Headers
Name Value
Strict-Transport-Security max-age=604800;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 26 Oct 2021 06:12:22 GMT
Content-Encoding
gzip
x-envoy-decorator-operation
shaman-public-api.production.svc.cluster.local:80/*
Server
openresty
Vary
Accept-Encoding
Strict-Transport-Security
max-age=604800;
Content-Type
application/javascript; charset=utf-8
x-envoy-upstream-service-time
7
Connection
keep-alive
Content-Length
1240
ultimate.js
api.flocktory.com/underworld/tracks/ 		33 B
33 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.flocktory.com/underworld/tracks/ultimate.js?body=%7B%22data%22%3A%7B%22action%22%3A%22session.page_visit%22%2C%22payload%22%3A%7B%22resolution%22%3A%221600x1200%22%2C%22ga%22%3A%7B%22utmcsr%22%3A%22direct%22%2C%22utmccn%22%3A%22direct%22%2C%22utmcmd%22%3A%22none%22%2C%22h_utmcsr%22%3A%22%22%2C%22h_utmccn%22%3A%22%22%2C%22h_utmcmd%22%3A%22%22%2C%22previous_visit_ts%22%3A1635228742%2C%22current_visit_ts%22%3A1635228742%2C%22initial_visit_ts%22%3A1635228742%2C%22pageviews%22%3A1%7D%2C%22url%22%3A%22https%3A%2F%2Fpromo.level.travel%2Fwlalert%22%7D%2C%22links%22%3A%7B%22site%22%3A2113%7D%7D%2C%22site-session-id%22%3A%22358d004d-309d-47be-b1af-9dd89a4d637d-8%22%7D&callback=flock_jsonp_9999
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.73.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-19-73-183.eu-west-1.compute.amazonaws.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=604800;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 26 Oct 2021 06:12:22 GMT
Content-Encoding
gzip
x-envoy-decorator-operation
tracks-general.production.svc.cluster.local:80/*
Server
openresty
Vary
Accept-Encoding
Strict-Transport-Security
max-age=604800;
Content-Type
application/javascript; charset=utf-8
x-envoy-upstream-service-time
1
Connection
keep-alive
Content-Length
51
counter
top-fwz1.mail.ru/ 		43 B
927 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://top-fwz1.mail.ru/counter?id=2951107;pid=198ef338-7691-4959-803ce49d9293d63c
Requested by
Host: api.flocktory.com
URL: https://api.flocktory.com/v2/loader.js?site_id=2113
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
top-fwz1.mail.ru
Software
nginx /
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
x-content-type-options
nosniff
p3p
CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length
43
pragma
no-cache
amp-access-control-allow-source-origin
https://promo.level.travel
server
nginx
access-control-allow-methods
GET, POST, HEAD, PUT, OPTIONS
content-type
image/gif
access-control-allow-origin
https://promo.level.travel
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
accept-ch-lifetime
86400
accept-ch
DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin
https://promo.level.travel
access-control-allow-headers
*
flocktory
px.adhigh.net/p/cm/
Redirect Chain
  • https://px.adhigh.net/p/cm/flocktory?u=198ef338-7691-4959-803ce49d9293d63c
  • https://px.adhigh.net/p/cm/flocktory?u=198ef338-7691-4959-803ce49d9293d63c&bounced=1
49 B
343 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://px.adhigh.net/p/cm/flocktory?u=198ef338-7691-4959-803ce49d9293d63c&bounced=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.232.148.144 , Russian Federation, ASN48061 (UMA-TECH-AS, RU),
Reverse DNS
smtp5.sender.ltmse.com
Software
nginx /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Oct 2021 06:12:22 GMT
server
nginx
x-backend-id
f5-ru
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
access-control-allow-origin
https://promo.level.travel
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-type
image/gif
content-length
49
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Oct 2021 06:12:22 GMT
server
nginx
access-control-allow-origin
https://promo.level.travel
x-backend-id
f5-ru
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://px.adhigh.net/p/cm/flocktory?u=198ef338-7691-4959-803ce49d9293d63c&bounced=1
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
wf.frontend.weborama.fr/streampixel/
Redirect Chain
  • https://wf.frontend.weborama.fr/streampixel/?wamid=7629&Wvar=%7B%22flocktory_id%22%3A%22198ef338-7691-4959-803ce49d9293d63c%22%7D&d.r=1635228742192
  • https://wf.frontend.weborama.fr/streampixel/?wamid=7629&Wvar=%7B%22flocktory_id%22%3A%22198ef338-7691-4959-803ce49d9293d63c%22%7D&d.r=1635228742192&bounce=1&random=3388073068
67 B
143 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://wf.frontend.weborama.fr/streampixel/?wamid=7629&Wvar=%7B%22flocktory_id%22%3A%22198ef338-7691-4959-803ce49d9293d63c%22%7D&d.r=1635228742192&bounce=1&random=3388073068
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.223.69 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
69.223.244.35.bc.googleusercontent.com
Software
nginx/1.12.0 /
Resource Hash
09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 26 Oct 2021 06:12:22 GMT
via
1.1 google
last-modified
Tue, 26 Oct 2021 06:12:22 GMT
server
nginx/1.12.0
p3p
CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin
https://promo.level.travel
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
access-control-allow-credentials
true
content-type
image/gif
alt-svc
clear
content-length
67
expires
Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Oct 2021 06:12:22 GMT
via
1.1 google
last-modified
Tue, 26 Oct 2021 06:12:22 GMT
server
nginx/1.12.0
location
https://wf.frontend.weborama.fr/streampixel/?wamid=7629&Wvar=%7B%22flocktory_id%22%3A%22198ef338-7691-4959-803ce49d9293d63c%22%7D&d.r=1635228742192&bounce=1&random=3388073068
p3p
CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin
https://promo.level.travel
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
access-control-allow-credentials
true
alt-svc
clear
content-length
0
expires
Tue, 03 Jul 2001 06:00:00 GMT
greece.png
thumb.tildacdn.com/tild3832-3236-4666-b137-643534626562/-/format/webp/ 		87 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3832-3236-4666-b137-643534626562/-/format/webp/greece.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
3f8db7f1ad5cfda7bda7e8759767e20bf36024322551cf006ae81edc63529ea9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
shutterstock_1421945.png
thumb.tildacdn.com/tild3033-3430-4231-a635-623635333132/-/resize/300x300/-/format/webp/ 		36 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3033-3430-4231-a635-623635333132/-/resize/300x300/-/format/webp/shutterstock_1421945.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
d91375c24e7f92aec7d2bf2118bf321370592d901e605abf31ecdea3a84c57f5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
shutterstock_1023408.jpg
thumb.tildacdn.com/tild3266-6438-4362-a635-336336393438/-/resize/300x300/-/format/webp/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3266-6438-4362-a635-336336393438/-/resize/300x300/-/format/webp/shutterstock_1023408.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
8065faba771389d4f542012c9764b828792e675eb1f2d6e2525fde114e5f4bd4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
shutterstock_1028899.jpg
thumb.tildacdn.com/tild6461-3732-4533-b531-656262316533/-/resize/300x300/-/format/webp/ 		36 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild6461-3732-4533-b531-656262316533/-/resize/300x300/-/format/webp/shutterstock_1028899.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
7985e639fd6a5f07717cbe121a00df7867e97872dca042ddde5a59d6fe68fd23

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
1.jpg
thumb.tildacdn.com/tild3439-3634-4634-b461-383030323530/-/resize/300x300/-/format/webp/ 		38 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thumb.tildacdn.com/tild3439-3634-4634-b461-383030323530/-/resize/300x300/-/format/webp/1.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.236.71.248 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software
nginx /
Resource Hash
2f317d4c9032dd2b98e12fee5c3de650ed0322340c7b9ddd1e293918a18d6bc3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:12:22 GMT
cache-control
max-age=2600000
x-cdn-edge-cache
HIT
x-cdn-edge-id
2315
server
nginx
content-type
image/webp
/
www.facebook.com/tr/ Frame D9C4 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
185.60.216.35 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-frx5.facebook.com
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
2071
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
origin
https://promo.level.travel
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://promo.level.travel/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
Origin
https://promo.level.travel
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://promo.level.travel/

Response headers

content-type
text/plain
access-control-allow-origin
https://promo.level.travel
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
content-length
0
server
proxygen-bolt
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
date
Tue, 26 Oct 2021 06:12:22 GMT
/
stat.tildacdn.com/event/ 		16 B
236 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stat.tildacdn.com/event/
Requested by
Host: static.tildacdn.com
URL: https://static.tildacdn.com/js/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.129.100.115 , Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
fb1bf528d8237aac3e9ead389ab246ba0068f61fe281610110937ef2b8adefce

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://promo.level.travel/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin
https://promo.level.travel
date
Tue, 26 Oct 2021 06:12:23 GMT
content-encoding
gzip
server
ddos-guard
vary
Accept-Encoding
content-type
application/json;charset=utf-8

Verdicts & Comments Add Verdict or Comment

514 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery undefined| version function| t_throttle function| t_onFuncLoad boolean| isSearchBot boolean| isMobile boolean| $isMobile boolean| isiOS boolean| isiOSChrome string| isiOSVersion boolean| isSafari string| isSafariVersion string| browserLang string| tildaBrowserLang object| jQuery110200049087047509681625 object| videoLoadProcessor object| sequenceController function| processVideo function| cover_init function| processYoutubeVideo function| onYouTubeIframeAPIReady object| observer object| Tilda function| t121_setHeight function| t142_checkSize function| t190_scrollToTop function| t228__init function| t228_highlight function| t228_checkAnchorLinks function| t228_checkOverflow function| t228_checkNoOverflow function| t228_catchScroll function| t228_getSectionByHref function| t228_highlightNavLinks function| t228_setWidth function| t228_setBg function| t228_appearMenu function| t228_changebgopacitymenu function| t228_createMobileMenu function| t268_init function| t268_setHeight function| t300_init function| t365_showPopup function| t365_closePopup function| t365_resizePopup function| t365_sendPopupEventToStatistics function| t365_createCookie function| t365_readCookie function| t365_initPopup object| t386 function| t390_initPopup function| t390_showPopup function| t390_closePopup function| t390_resizePopup function| t390_sendPopupEventToStatistics function| t393_appearMenu function| t396_init function| t396_getRotateValue function| t396_scaleBlock function| t396_doResize function| t396_detectResolution function| t396_initTNobj function| t396_updateTNobj function| t396_waitForFinalEvent function| t396_switchResolution function| t396_artboard_build function| t396_ab__renderView function| t396_addText function| t396_addImage function| t396_addShape function| t396_addButton function| t396_addVideo function| t396_addHtml function| t396_addTooltip function| t396_addForm function| t396_addGallery function| t396_elem__setFieldValue function| t396_elem__getFieldValue function| t396_elem__renderView function| t396_elem__renderViewOneField function| t396_elem__convertPosition__Local__toAbsolute function| t396_ab__setFieldValue function| t396_ab__getFieldValue function| t396_ab__renderViewOneField function| t396_allelems__renderView function| t396_ab__filterUpdate function| t396_ab__getHeight function| t396_hex2rgb function| t396_elem__getWidth function| t396_elem__getHeight function| t396_roundFloat function| tn_console function| t396_setUpTooltip_desktop function| t396_setUpTooltip_mobile function| t396_hideTooltip function| t396_showTooltip function| t396_hex2rgba function| t397_init function| t397_alltabs_updateContent function| t397_updateContentBySelect function| t397_updateSelect function| t397_startUpdateLazyLoad function| t397_updateVideoLazyLoad function| t397_scrollToTabs function| t397_removeUrl function| t400_init function| t400_alltabs_updateContent function| t400_checkSize function| t400_updateVideoLazyLoad function| t412_init function| t412_setCoordinateToPaymentBox function| t412_unifyHeights function| t451_initMenu function| t451_showMenu function| t451_closeMenu function| t451_checkSize function| t451_highlight function| t451_changeBgOpacityMenu function| t451_appearMenu function| t451_catchScroll function| t451_updateSectionsOffsets function| t451_getSectionByHref function| t451_highlightNavLinks function| t456_setListMagin function| t456_highlight function| t456_checkAnchorLinks function| t456_catchScroll function| t456_updateSectionsOffsets function| t456_getSectionByHref function| t456_highlightNavLinks function| t456_setPath function| t456_setBg function| t456_appearMenu function| t456_changebgopacitymenu function| t456_createMobileMenu function| t477_setHeight function| t478_setHeight function| t480_init function| t480_setHeight function| t498_unifyHeights function| t509_setHeight function| t517_unifyHeights function| t533_equalHeight function| t552_init function| t552__setHeight function| t570_init function| t570_setMapHeight function| t576_init function| t577_equalHeight function| t602_init function| t602_setProgressBarWidth function| t604_init function| t604_show function| t604_hide function| t604_imageHeight function| t604_arrowWidth function| t607_init function| t607_checkAnchorLinks function| t607_catchScroll function| t607_getSectionByHref function| t607_highlightNavLinks function| t609_setHeight function| t609_init function| t616_init function| t616_equalHeight function| t635_init function| t635_startType function| t635_findAnimElem function| t635_updateAnimTextLimits function| t635_animateText function| t650_unifyHeights function| t670_init function| t670_show function| t670_hide function| t670_imageHeight function| t674_init function| t678_onSuccess function| t686_init function| t686_setHeight function| t686_GetIEVersion function| t688_unifyHeights function| t690_onSuccess function| t691_unifyHeights function| t694_init function| t694_setHeight function| t696_onSuccess function| t702_initPopup function| t702_onSuccess function| t702_lockScroll function| t702_unlockScroll function| t702_showPopup function| t702_closePopup function| t702_resizePopup function| t702_sendPopupEventToStatistics function| t718_onSuccess function| t756_init function| t756_initPopup function| t756_showPopup function| t756_closePopup function| t756_sendPopupEventToStatistics function| t764_init function| t772_init function| t774_init function| t774__updateLazyLoad function| t774_unifyHeights function| t776__init function| t776_initProductQuantity function| t776__showMore function| t776__showSeparator function| t776__dict function| t776__alignButtons_init function| t776__alignButtons function| t776__hoverZoom_init function| t776__updateLazyLoad function| t776_initPopup function| t776_checkUrl function| t776_updateSlider function| t776_showPopup function| t776_closePopup function| t776_removeSizeStyles function| t776_copyTypography function| t797_init function| t806__init function| t806_scrollToTop function| t806__clearFormOnBackClick function| t806__startClickBtn function| t806__changeRadio function| t806__changeTestInput function| t806__checkClickBtn function| t806__nextClickBtn function| t806__resultClickBtn function| t806__restartClickBtn function| t806__showResult function| t806__openResultWrapper function| t806__showNumber function| t806_fixcontentheight function| t806_changeShareFBUrl function| t806_shareVK function| t806_shareFB function| t806_shareTwitter function| t806__openPopup function| t807__init function| t807__replyClickBtn function| t807__onSuccess function| t817_init function| t817_showTab function| t817_showTabMobile function| t817_showTabByUrl function| t817_scrollToTabs function| t817_removeUrl function| t819_init function| t819_showTab function| t819_showTabMobile function| t819_showTabByUrl function| t819_scrollToTabs function| t819_removeUrl function| t821_init function| t821_setBg function| t821_appearMenu function| t821_changebgopacitymenu function| t821_createMobileMenu function| t829_init function| t829_initMasonry function| t829_calcColumnWidth function| t835_init function| t835_workWithAnswerCode function| t835_setAnswerCode function| t835_scrollToTop function| t835_checkLength function| t835_showCounter function| t835_setError function| t835_hideError function| t835_setProgress function| t835_wrapCaptureForm function| t835_createQuestionArr function| t835_disabledPrevBtn function| t835_switchQuestion function| t835_switchResultScreen function| t835_awayFromResultScreen function| t835_onSuccess function| t842_init function| t842_unifyHeights function| t849_init function| t850_init function| t850_unifyHeights function| t852_init function| t852_updateLazyLoad function| t854_init function| t854_hideBtn function| t854_formatDate function| t854_getNews function| t854_showNews function| t854_addText function| t854_addImage function| t854_addPopup function| t854_closePopup function| t854_closeContent function| t857__init function| t858_init function| t858_unifyHeights function| t859_init function| t859_unifyHeights function| t860_init function| t860_translateBlock function| t860_unifyHeights function| t868_setHeight function| t868_initPopup function| t868__readCustomCode function| t868_showPopup function| t868_closePopup function| t868_resizePopup function| t868_sendPopupEventToStatistics function| t902_init function| t902_unifyHeights function| t905_init function| t905_unifyHeights function| t911_init function| t911_checkPhoneNumber function| t912_init function| t912_setHeight function| t923_init function| t923_unifyHeights function| t959__init function| t959__updateLazyLoad function| t959_unifyHeights function| t985_init function| t985_addSearchVariants function| t985_showSearch function| t985_hideSearch function| t422_setHeight function| t422_checkEqualHeight string| lzld function| t_lazyload_update function| t_lazyload_getResizeUrl function| t_lazyload_round function| t_lazyload_reloadonError function| t_lazyload_getWebPUrl function| t_lazyload_onWindowResize function| t_lazyload_detectwebp function| LazyLoad string| lazy function| t_lazyload_updateResize_elem function| t_animate__getAttrByRes function| t_animate__init function| t_animate__checkMobile function| t_animate__startAnimation function| t_animate__animateOnScroll function| t_animate__animateGroups function| t_animate__animateChainsBlocks function| t_animate__animateChainItemsOnScroll function| t_animate__getSectionHeadDealy function| t_animate__getDelayFromPreviousScrollEvent function| t_animate__catchTransitionEndEvent function| t_animate__animateElems function| t_animate__parseNumberText function| t_animate__changeNumberOnZero function| t_animate__animateNumbers function| t_animate__setAnimationState function| t_animate__setAnimationStateChains function| t_animate__assignSectionDelay function| t_animate__assignGroupDelay function| t_animate__assignOrderedElemsDelay function| t_animate__assignChainDelay function| t_animate__setCustomAnimSettings function| t_animate__removeInlineAnimStyles function| t_animate__forceElemInViewPortRepaint function| t_animate__detectElemTriggerOffset function| t_animate__saveSectionHeaderStartTime function| t_animate__getCurBlockSectionHeadDelay function| t_animate__makeSectionButtonWait function| t_animate__checkSectionButtonAnimation function| t_animate__checkSectionButtonAnimation__outOfTurn function| t_animate__addNoHoverClassToBtns function| t_animate__removeNoHoverClassFromBtns function| t_animate__getGroupsOffsets function| t_animate__getChainOffsets function| t_animate__getElemsOffsets function| t_animate__removeAnimFromHiddenSlides function| t_animate__wrapTextWithOpacity function| t_animate__checkIE function| t_menusub_init function| t_menusub_set_up_menu function| t_menusub_open_inME401 function| t_menusub_close_inME401 function| t_menusub_set_up_menu_mobile function| t_menusub_set_up_menu_desktop function| t_menusub_show function| t_menusub_hide_submenu function| t_menusub_add_arrow function| t_menusub_highlight function| t_menusub_is_static_ME401 function| t_menusub_is_mobile_ME401 function| t_menusub_checkAnchorLinks function| t_menusub_catchScroll function| t_menusub_getSectionByHref function| t_menusub_highlightNavLinks function| t_menusub_updateSectionsOffsets function| t_sldsInit function| t_slds_setItemsInRow function| t_slds_initSliderControls function| t_slds_animate function| t_slide_MoveAnimation function| t_slideMoveWithoutAnimation function| t_slideMoveInstantly function| t_slideMove function| t_slds_updateSlider function| t_slds_UpdateImages function| t_slds_ActiveCaption function| t_slds_scrollImages function| t_slds_ActiveBullet function| t_slds_ActiveSlide function| t_slds_SliderWidth function| t_slds_SliderHeight function| t_slds_UpdateSliderHeight function| t_slds_SliderArrowsHeight function| t_slds_UpdateSliderArrowsHeight function| t_slds_initAutoPlay function| t_slds_positionArrows function| t_slds_initSliderSwipe function| t_slds_getCurrentTranslate function| t_slds_changeImageUrl function| t_slds_onHammerLoad function| Hammer function| t_initZoom function| t_zoomHandler function| t_zoom_initSwipe function| t_zoom_showSlide function| t_zoom_transitForLoop function| t_zoom_loopSlider function| t_zoom_initCloseSwipe function| t_zoom_closeSwipeHandler function| t_zoom_checkForScale function| t_zoom_scale_init function| t_zoom_doubletapScaleInit function| t_zoom_desktopZoomPositioningInit function| t_zoom_mobileZoomPositioningInit function| t_zoom_getTouchEventXY function| t_zoom_close function| t_zoom_unscale function| t_zoom_lockScroll function| t_zoom_unlockScroll function| t_zoom_initResizeListener function| t_zoom_resizeHandler function| t_zoom_onFuncLoad function| t_zoom_setModalColor function| t_zoom_luma_rgb function| t_zoom_hexToRgb function| t_zoom_setHideControlsTimer object| dataLayer object| style string| mainTracker number| a number| b number| winWidth number| winHeight string| lazy_imgoptimoff boolean| tzoominited boolean| tzoomopenonce boolean| isDoubletapScaleAdded number| tn_window_width number| tn_scale_factor object| tn string| lazy_webp number| t_lazyload_domloaded function| onVisibilityWindowChange function| tildastat_scrollEvent function| tildastat string| tildastatscroll object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| _gaq function| mindbox object| _tmr function| fbq function| _fbq object| lazyload_cover object| gaplugins object| gaGlobal object| gaData object| _gat object| __core-js_shared__ object| core function| HitStorageTracker object| Tracker object| google_optimize object| Ya object| yaCounter18706828 boolean| IS_CLIENT_SIDE boolean| IS_ANDROID_WEBVIEW boolean| IS_IOS_WEBVIEW boolean| IS_WEB undefined| androidBridge undefined| iosBridge function| _bridgeSend function| _bridgeSupports boolean| IS_BRIDGE_AVAILABLE function| obj2qs object| fastXDM object| VK object| flocktory boolean| mindboxInitialized function| directCrm object| lazyload_img object| lazyload_bgimg object| lazyload_iframe function| flock_jsonp_1 string| sessid boolean| tildastatload

42 Cookies

Domain/Path Name / Value
tours.biletikoff.ru/ Name: cversion
Value: 30
.biletikoff.ru/ Name: uuid
Value: 9a789b94-d84e-49c6-8da3-3d2a5b74efe3
promo.level.travel/ Name: rerf
Value: AAAAAGF3nEQknGr5A4g8Ag==
promo.level.travel/ Name: ipp_uid
Value: 1635228740882/4xAT5kmCF2Z2DKbP/kp+DBquQcaOWwCAJtpZzXw==
promo.level.travel/ Name: ipp_uid1
Value: 1635228740882
promo.level.travel/ Name: ipp_uid2
Value: 4xAT5kmCF2Z2DKbP/kp+DBquQcaOWwCAJtpZzXw==
promo.level.travel/ Name: tildauid
Value: 1635228741643.460579
promo.level.travel/ Name: tildasid
Value: 1635228741643.924827
.level.travel/ Name: _ga
Value: GA1.2.805573343.1635228742
.level.travel/ Name: _gid
Value: GA1.2.157634338.1635228742
.promo.level.travel/ Name: __utma
Value: 217467095.805573343.1635228742.1635228742.1635228742.1
.promo.level.travel/ Name: __utmc
Value: 217467095
.promo.level.travel/ Name: __utmz
Value: 217467095.1635228742.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.promo.level.travel/ Name: __utmt_UA-27369706-1
Value: 1
.promo.level.travel/ Name: __utmb
Value: 217467095.1.10.1635228742
.level.travel/ Name: _dc_gtm_UA-27369706-7
Value: 1
google-analytics.bi.owox.com/ Name: ouid
Value: 4226852111_1400961297
.level.travel/ Name: _fbp
Value: fb.1.1635228741836.1724970575
.flocktory.com/ Name: __flocktory-web_session2
Value: 198ef338-7691-4959-803ce49d9293d63c
.level.travel/ Name: _ym_uid
Value: 1635228742585664401
.level.travel/ Name: _ym_d
Value: 1635228742
.mc.yandex.com/ Name: sync_cookie_csrf
Value: 1193026932fake
.level.travel/ Name: _ym_isad
Value: 2
.mc.yandex.ru/ Name: sync_cookie_csrf
Value: 3512585286fake
.level.travel/ Name: tmr_lvid
Value: 1b55b5d9a0dd24d1b541a3ad85287919
.level.travel/ Name: tmr_lvidTS
Value: 1635228741941
.level.travel/ Name: tmr_reqNum
Value: 2
.vk.com/ Name: remixlang
Value: 6
.yandex.com/ Name: yandexuid
Value: 8943533391635228741
.yandex.com/ Name: yuidss
Value: 8943533391635228741
mc.yandex.com/ Name: yabs-sid
Value: 1317913581635228741
.yandex.com/ Name: i
Value: O890IoYogXKHFNp0L6uJcVnwS5yjtHp+DzfskqXW24liqrHz0GXU++jk/aYy5vPXkKFLdse+DwzaYPWtKUhs3V9Of1M=
.yandex.com/ Name: ymex
Value: 1666764741.yrts.1635228741#1666764741.yrtsi.1635228741
api.mindbox.ru/ Name: deviceUUID
Value: ccacb471-490b-4f44-901a-1e80690e77b9
.level.travel/ Name: mindboxDeviceUUID
Value: ccacb471-490b-4f44-901a-1e80690e77b9
.level.travel/ Name: directCrm-session
Value: %7B%22deviceGuid%22%3A%22ccacb471-490b-4f44-901a-1e80690e77b9%22%7D
promo.level.travel/ Name: flocktory-uuid
Value: 358d004d-309d-47be-b1af-9dd89a4d637d-8
.mail.ru/ Name: VID
Value: 0Hmf_B2U19Y500000X12H425:::0-0-0-691f505:CAASEE5muerSODaVksxmdVb_hskaYO44cyPpkE-U4kIFfdiM4GedplENdldDkQJ_WDj9f49fLS8QRV9EL-cUITQw7t_cuF-grhSrUo2K6KAb1AYz4RqY_YpPgir_pz0xh3wQu-q6GYJDU7N5SjrLv6LAUraUzQ
.weborama.fr/ Name: AFFICHE_W
Value: -Rmu70YNWUX961
.adhigh.net/ Name: gi_u
Value: 5mSTV3Sylny.AikABlF8uzpyow
promo.level.travel/ Name: previousUrl
Value: promo.level.travel%2Fwlalert
promo.level.travel/ Name: tmr_detect
Value: 0%7C1635228744215

1 Console Messages

Source Level URL
Text
network error URL: https://mc.yandex.com/sync_cookie_image_decide?token=9438.tiB-fFrYGc_I8sN50DfF78pl8Ir8w8IhYPp5HNhcRpOQYQZxq5qHGv01CrCiu7uZ8lTx9T90x6_ty2HeBlj0Cg%2C%2C.feQqH-TF0XShLi4wy4-Uac4aNNQ%2C
Message:
Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.flocktory.com
api.mindbox.ru
cdn.level.travel
connect.facebook.net
conversion.cx
fonts.googleapis.com
fonts.gstatic.com
google-analytics.bi.owox.com
mc.yandex.com
mc.yandex.ru
promo.level.travel
px.adhigh.net
stat.tildacdn.com
static.tildacdn.com
stats.g.doubleclick.net
thumb.tildacdn.com
top-fwz1.mail.ru
tours.biletikoff.ru
vk.com
wf.frontend.weborama.fr
ws.tildacdn.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
13.32.121.98
142.250.185.132
142.250.185.138
142.250.185.78
142.250.186.99
142.251.5.156
151.236.118.235
151.236.71.248
157.240.20.19
172.217.23.104
178.154.205.88
178.248.236.28
185.129.100.115
185.165.123.206
185.60.216.35
193.232.148.144
217.69.133.145
35.186.228.179
35.244.223.69
52.19.73.183
84.252.130.113
87.240.190.67
93.158.134.119
053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa
090a7068a2209545279f858c6f41ff7ae42815e11c3d69463a2a2ea835282bd9
09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0f958a26b2e1df115d2241a0938c558b8cca6db30fc4dd0acdcf31713a104e2e
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
138de4a50bdc40aca1841a0114a0a4f36e978a4f804664e08df23780c7306399
1db536c56d2d27b45ec396906fea1b6ac6090b39acdb479831898dd287e26c5d
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
262c61db9409847903a897beffde81aed4c1d37a1c3786dbfde0c0b8e897ca90
29812e2ababb1e2ab16ff99f0460cc7b522e9fe1505e64d13c889169daf95d2f
2b2a0ec5190589d2d1e44aadfcda6283283f4f95d9828cf8259f63bc7e093677
2f317d4c9032dd2b98e12fee5c3de650ed0322340c7b9ddd1e293918a18d6bc3
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
3090ed4435014c88df78b59e408297f818c4529030bb80453d7b896b8bf32dc7
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
3383da0f1f56cef32d0f184f3ca4683b2dd071b6c2a3f1669181506fcf2ac6d3
33b7bc75a41b150379b6bac39bb6e766d5b8d79473f2c8ac9fc9667639495160
389e3527776b6c23f12da344a900521883a81eeaceed0d8836be149077a22d1a
3daf8ab92f6f7021fa395a4bca9487f34ba4ecc06e5a7fcf7ff72f88c451c177
3f8db7f1ad5cfda7bda7e8759767e20bf36024322551cf006ae81edc63529ea9
46f7648bbcd2ad2a615cf7d2af4ca6e555d9770935b3de0983988d6490aa8130
4759aeeb3142ecc89ea26254c0d6cde06096c64e120dc4b8705a09bf56257008
48b23ea142c9df1ee6c25a1e313128022d0fffbe051787cb974a1eb058273005
4b5e988359c30afd1d84b7a5118296f1fc33f4527d530b096ca27aa7fbfef99a
5095c1ca7a63dd026f60dc9a392fbee82a3f1dd4ed58ff77474781b84529b063
536cd983c5ac840349770984405fe9eb9e67b9d7e35e0c45673a653b003173b6
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5b8c6fc9e408f36dc05233a581ed05d94a71e0e848969b6fb7370153461b042f
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
63cc52bc18b3d5dd8cf11a34f6c12bb886983223822d198f73eef2382ad94e75
64590b2886b37a811b50548e53bb869372d3ffef0649d75bae1a2d7d394abe29
65a7577f35726ea847bdf440ad18a70ee61c01ef0b5ee26b0e6a2352ace3a2ce
66dcd50cd69629947af67c4203e3531eae1f8089a9cf14ad8cc946c61654d2a2
68e629cb89363d8a61b5484389afa7314e35c023596f7dfb3eadc6ea96c3245b
702ae144ae7385791ff5e3f815616360464b2587e1eac2af1edfe7c92c713df4
76b60bb33ab5ad4c74a3cdf3245e097297ee9fdb96a44955d4736536cf507835
7985e639fd6a5f07717cbe121a00df7867e97872dca042ddde5a59d6fe68fd23
7b2195aeeebb6d9585dcbbc008d73017abe6354a15205c034bc4e9452a8e5d1e
7c4b5b517101a18e598c9a3b28eef7f75547506bce843b0e4fbf8e26dcd6da78
8065faba771389d4f542012c9764b828792e675eb1f2d6e2525fde114e5f4bd4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
8bf3448edeeb86d3c774890b63ab0e14a65d1c2311b0f29872e4f2fd81263254
8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee
8e7a0552f6c2c9fa6148cd8233cfb9b5288602025e27d53e4a3c694c42a01993
9480d469e680c9e6b9750db90c7a7167e6846811a98a13a678d21404cdc63c19
98a237b9c32173c0a7e10fd33d830c352ca2fa5f0c8d885e36338e673a24ac16
a4eb1c41366018b711e43dcce520ebd5587ef1c97d06cdf1e7cc9dca4a8285de
a57b5802278aea6dfe45cfb50de83f5e45d82d8f44f4c21c87e7073189924284
af41c19366789bea56a7a324dc0b0b2900762a9a614137f45eae4701be61b2cf
b24ac49bfc1bab8f318d64d1bbe7e98fe1e0d816cb3ea7d3e251ad6b4fc08c8a
b5751e81b8364f1bf065ba24686461407639a42e720eda594bd59a1c7f9a8525
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
b9b57d41d0ac20d9407c003a5a64491fcb330aab872b0a98bf94658a535b1708
c73b004ebf31b395cf237c3d2b13c1e576f385e04660ceb5f7be163ff3c201dc
c8ed0e2ea676f117fc6e7ee09293e1cede20453d2ec576d8a3709a65538baf41
cade315e3d18357ce5a8c3069cc47a5e589ced9d9069df81807c0ef8b7892c4e
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cf2c58c07b25eedb7ac08c2e3c54a2a65e264979862a51a448ee81d96b8c1601
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d725399f22363cfa4d6b3b7f489e1154d6569d84360da2ae2169f636639d54d8
d845ac461a77e54af0e48ca2e3dcac959f793205c2eefbf1d698bc0f73998f34
d91375c24e7f92aec7d2bf2118bf321370592d901e605abf31ecdea3a84c57f5
de4852d9873fd8ec250ee131b8273ac0e7f5a0da0231747a8279306db5a2aa75
e2674ad2ce344ecc62371d53b2fef73249ea2e96f242bcf94aa22438a4feef91
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8899d963998a2d77ca016c438414bfa4e7d2c2501c3119472b8b299008c017e
ee834fea8083fdba1e884b530abe364c78d61ec45f0ea39a23a68faadced3f65
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5c301b8769579afae9deb4eda7659df32661229039c6b7a37cfabd1827317ce
f6470dc62a176c496d4754710effd20362288260e9d15c1b390b7391406e8564
f8381698ecb6ba1784a81eb40cac179ca3a7249c73a2a010bdb7c9ce20f53632
fb1bf528d8237aac3e9ead389ab246ba0068f61fe281610110937ef2b8adefce
fb83389ea7513242a9a237454ce7989eb6d84c4ec2fe15c81bad6f89c87fe89e
fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3