flights.booking.com Open in urlscan Pro
143.204.215.58 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f...
Submission: On January 13 via api (January 13th 2023, 8:13:27 am UTC) from ZA — Scanned from DE

Summary HTTP 48 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 10 domains to perform 48 HTTP transactions. The main IP is 143.204.215.58, located in United States and belongs to AMAZON-02, US. The main domain is flights.booking.com. The Cisco Umbrella rank of the primary domain is 129707.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on August 3rd 2022. Valid for: a year.

This is the only time flights.booking.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 9	143.204.215.58 143.204.215.58	16509 (AMAZON-02) (AMAZON-02)
1 3	65.9.66.108 65.9.66.108	16509 (AMAZON-02) (AMAZON-02)
11	2600:9000:214... 2600:9000:214f:4400:1f:e2ee:200:93a1	16509 (AMAZON-02) (AMAZON-02)
7	2606:4700::68... 2606:4700::6810:9540	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:1a55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:211... 2600:9000:211e:6400:15:9f56:b80:93a1	16509 (AMAZON-02) (AMAZON-02)
48	13

9 143.204.215.58 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-58.fra53.r.cloudfront.net

flights.booking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 65.9.66.108 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-108.fra56.r.cloudfront.net

www.booking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:214f:4400:1f:e2ee:200:93a1 (United States)

ASN16509 (AMAZON-02, US)

q-xx.bstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r-xx.bstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6810:9540 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1a55 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:6400:15:9f56:b80:93a1 (United States)

ASN16509 (AMAZON-02, US)

t-cf.bstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	bstatic.com q-xx.bstatic.com — Cisco Umbrella Rank: 13462 r-xx.bstatic.com — Cisco Umbrella Rank: 27044 t-cf.bstatic.com — Cisco Umbrella Rank: 29696	503 KB
12	booking.com 2 redirects flights.booking.com — Cisco Umbrella Rank: 129707 www.booking.com — Cisco Umbrella Rank: 7067	89 KB
7	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 391	109 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	20 KB
3	google.de www.google.de — Cisco Umbrella Rank: 5880	763 B
3	google.com www.google.com — Cisco Umbrella Rank: 2	763 B
3	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 34 stats.g.doubleclick.net — Cisco Umbrella Rank: 75	3 KB
2	bing.com bat.bing.com — Cisco Umbrella Rank: 362	12 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	140 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 628	295 B
48	10

	Domain	Requested by
10	q-xx.bstatic.com	flights.booking.com q-xx.bstatic.com
9	flights.booking.com	1 redirects q-xx.bstatic.com
7	cdn.cookielaw.org	flights.booking.com cdn.cookielaw.org
5	www.google-analytics.com	flights.booking.com www.google-analytics.com
3	www.google.de	flights.booking.com
3	www.google.com	flights.booking.com
3	www.booking.com	1 redirects flights.booking.com q-xx.bstatic.com
2	bat.bing.com	www.googletagmanager.com bat.bing.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	www.googletagmanager.com	flights.booking.com www.googletagmanager.com
1	t-cf.bstatic.com
1	r-xx.bstatic.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	stats.g.doubleclick.net	www.google-analytics.com
48	14

This site contains links to these domains. Also see Links.

Domain
secure.booking.com
www.booking.com
booking.com
www.flysafair.co.za
flights-za.gotogate.com

Subject Issuer	Validity	Valid
*.booking.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-03` - `2023-07-11`	a year	crt.sh
*.bstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-21` - `2023-10-11`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2022-11-25` - `2023-05-25`	6 months	crt.sh
www.google.com GTS CA 1C3	`2022-12-12` - `2023-03-06`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-12-12` - `2023-03-06`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-12-13` - `2023-12-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0
Frame ID: FBA29459374542937F76FF9915DD9C78
Requests: 47 HTTP requests in this frame

Frame: https://www.booking.com/cookiebanner.html
Frame ID: F33CD171FD763067C801F74B2E43F298
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Flights - Booking.com

Page URL History Show full URLs

https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55... HTTP 302
https://www.booking.com/food_redirect.html?url=aHR0cHM6Ly9mbGlnaHRzLmJvb2tpbmcuY29tL2Jvb2tpbmcvZmxpZ... HTTP 302
https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55... Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

PerimeterX (Security) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

48
Requests

100 %
HTTPS

85 %
IPv6

10
Domains

14
Subdomains

13
IPs

3
Countries

876 kB
Transfer

3615 kB
Size

17
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://secure.booking.com/help?source=hc_entry_point_flights_header&lang=de&aid=304142&label=gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF

Search URL Search Domain Scan URL

URL: https://www.booking.com/index.html?aid=304142&label=gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Title: Aufenthalte

Search URL Search Domain Scan URL

URL: https://booking.com/pxgo?url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fp%3Dsearchbox_link%26sid%3D746d5fe4961ca962377adc5f93222dd6%26mc%3DEUR%26a%3Dbdc%252Fsearchbox%26bdclc%3Dde&token=UmFuZG9tSVYkc2RlIyh9Yb5s-oRzgw76bcWUd8wbcu_sgUu8QY8UOeuGn6A5dwazU_G9h5Wn6OhTzC9LRhcz1xBzWckpQSGTfFHj325qQlP8wO6i74ucOmyETY1IvEAgFL_lwjeIW5puP13Cs_5NpE9pMc3Pxg7KIYUo8MSWrSxpE5CLKhjduJldOebw18qJUGHa_ClbVoBnQON9vie9rOQpELeHMhX2cXKyO4OktKBebozDrp0jLcEx-5Kkiw6aStQAGALa3wvXGMZjQizo6_vfkLeOq_qQuhloNlGNs0m1u9Txc_mAUY3nkyLkzGYiJfAGwXfddT8&aid=304142&lang=de&label=gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Title: Flüge

Search URL Search Domain Scan URL

URL: https://booking.com/pxgo?url=https%3A%2F%2Fbooking-dp.lastminute.de&token=UmFuZG9tSVYkc2RlIyh9YWktmrwAPG7dBQFty4spAI6DDyEZCfGLS78rlZvHF0KavEtPcE7B3niQDoqslD8BR8LbTYUP1eyBLaTjf_4-WJpvYyBgyk8_Oa-Aag_OCRUlytzuUB3HSl_YsLjkzwBRjQi4wDHRlN_4PTf-f3ooyvw_jxZ8taqBgeSFooVYMw6bN9kbeRfFqpyR2Rd0qcardNhHI62NgcVteh_Yp7GvGW52a5NPhXX9m_WEwIhk72PgpYeeW2bOsr71nUbxctt2kEWpEWw1ZhDcC0OPb0MkYPc06ttrf5ZKpk43YjNCuLfhnOBw_fblgHz_JYjkqrEPoQ&lang=de&aid=304142&label=gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Title: Flug + Hotel

Search URL Search Domain Scan URL

URL: https://www.booking.com/cars/index.html?aid=304142&label=gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Title: Mietwagen

Search URL Search Domain Scan URL

URL: https://www.booking.com/attractions/index.de.html?aid=304142&label=gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF&sid=746d5fe4961ca962377adc5f93222dd6&source=booking_index-nav_bar_tours_and_activities
Title: Sehenswürdigkeiten

Search URL Search Domain Scan URL

URL: https://www.booking.com/taxi/index.html?aid=304142&label=gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Title: Taxis zum/vom Flughafen

Search URL Search Domain Scan URL

URL: https://www.flysafair.co.za/travel-tools/extras/luggage-policy
Title: Safair

Search URL Search Domain Scan URL

URL: https://secure.booking.com/help?source=hc_entry_point_flights_order_page
Title: Zu den Hilfeseiten

Search URL Search Domain Scan URL

URL: https://www.booking.com/content/terms.de.html
Title: Geschäftsbedingungen von Booking.com

Search URL Search Domain Scan URL

URL: https://www.booking.com/content/privacy.de.html
Title: Datenschutzrichtlinien von Booking.com

Search URL Search Domain Scan URL

URL: https://flights-za.gotogate.com/rf/travel-conditions
Title: Geschäftsbedingungen von Gotogate International AB

Search URL Search Domain Scan URL

URL: https://flights-za.gotogate.com/rf/privacy-policy
Title: Datenschutzrichtlinien von Gotogate International AB

Search URL Search Domain Scan URL

URL: https://www.flysafair.co.za/about-us/legal-ts-cs
Title: Safair

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0 HTTP 302
https://www.booking.com/food_redirect.html?url=aHR0cHM6Ly9mbGlnaHRzLmJvb2tpbmcuY29tL2Jvb2tpbmcvZmxpZ2h0LWRldGFpbHMvNTI0Y2IzMTkxMjcxYWU5YTAzMDA3MTE2NTQ3YTkwOGRlYTAzMzk2Y2JjNzM5ZTlkYzFlNTU5MDlhZmI3Nzg5Y2ViYWZjYWExZjYxZTljMWY3NjAxZGQwNWIwNmRmNTUwODczMzFlZjRmYTM4MjA3ODMzY2I3Nzg3MjA3OTA5MmI3ZmQ5OWNjNDU5M2UzMzAzYWE5ZDhhYjRjMzU2LzA%3D HTTP 302
https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

48 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 0 Show response
flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/
Redirect Chain

https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa...
https://www.booking.com/food_redirect.html?url=aHR0cHM6Ly9mbGlnaHRzLmJvb2tpbmcuY29tL2Jvb2tpbmcvZmxpZ2h0LWRldGFpbHMvNTI0Y2IzMTkxMjcxYWU5YTAzMDA3MTE2NTQ3YTkwOGRlYTAzMzk2Y2JjNzM5ZTlkYzFlNTU5MDlhZmI3Nz...
https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa...

457 KB
70 KB

99ms
99ms

Document
text/html

143.204.215.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-58.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

e445a6f07214fd44035d177be94f9ab697c19a54642f4a603715dbb24bf72e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 13 Jan 2023 08:13:22 GMT
referrer-policy: no-referrer
server: nginx
strict-transport-security: max-age=31536000;
vary: Accept-Encoding
via: 1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
x-amz-cf-id: Ray4VJ7dO0kFpfJpkUpki6foPKvVoDefMTH7aigG09dVr2dBk3s-fA==
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: 25294d90-931a-11ed-8edf-83e5fb8fb038
x-xss-protection: 1; mode=block

Redirect headers

content-security-policy-report-only: report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=2eab39d01d36004e&e=UmFuZG9tSVYkc2RlIyh9YajUVvlXfGGzllQHPh7pRN7TgGpNHKD-ontRZz8mrnn6kph1zhNNt6E; frame-ancestors 'none';
date: Fri, 13 Jan 2023 08:13:22 GMT
location: https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0
nel: {"report_to":"default","max_age":604800}
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800,"group":"default"}
server: nginx
strict-transport-security: max-age=604800
via: 1.1 2fc0d20914c32e5cd76477ed042298d0.cloudfront.net (CloudFront)
x-amz-cf-id: Xlr5kjr35xOE0bAzZYIkKZmm3TRHRu9b_xVhH_I6niZWVYo1MO1cGg==
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com
x-xss-protection: 1; mode=block

GET
H2 200 client.e9623edc.css
q-xx.bstatic.com/flights/web/static/css/ 150 KB
16 KB 114ms
10ms Stylesheet
text/css 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q-xx.bstatic.com/flights/web/static/css/client.e9623edc.css

Requested by

Host: flights.booking.com
URL: https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c89a78d31bb1a75c562ae57ec725cda46554902efebe0d804c0ac49815149dfe

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Thu, 12 Jan 2023 09:52:52 GMT
content-encoding: br
via: 1.1 8b5bc0831e6dab612582614c3009efa6.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: FRA53-C1
age: 80430
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Sun, 09 Apr 2023 15:24:42 GMT", rule-id="expire-static-assets"
last-modified: Thu, 12 Jan 2023 09:11:04 GMT
server: nginx
x-amz-meta-s3cmd-attrs: md5:1689ce34118b94a3bbc9d622f74cd949
etag: W/"1689ce34118b94a3bbc9d622f74cd949"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 3MKxFiGxThljgO5QmkmzCu6wDIaH7qqAfhfx3bGPT88ApJgS-dr4Jw==
expires: Sat, 11 Feb 2023 09:52:52 GMT

GET
H2 200 screens-Confirmation.578a810b.chunk.css
q-xx.bstatic.com/flights/web/static/css/ 45 KB
6 KB 112ms
9ms Stylesheet
text/css 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q-xx.bstatic.com/flights/web/static/css/screens-Confirmation.578a810b.chunk.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

7b368603dd4dd3f7b131e4e4fbad6481e42678d06b9a431f3850cc34ab752a14

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Thu, 12 Jan 2023 10:00:25 GMT
content-encoding: br
via: 1.1 8b5bc0831e6dab612582614c3009efa6.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: FRA53-C1
age: 79977
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Sun, 09 Apr 2023 15:24:44 GMT", rule-id="expire-static-assets"
last-modified: Thu, 12 Jan 2023 09:11:06 GMT
server: nginx
x-amz-meta-s3cmd-attrs: md5:33afd089a2199cbb03c786864a701c58
etag: W/"33afd089a2199cbb03c786864a701c58"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: gY2gAU101rJ6Iw5krdV25TyascNEQrs2OLBoMBRGpu0A3gL3xfD3qQ==
expires: Sat, 11 Feb 2023 10:00:25 GMT

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/7163e23c-88a8-41d6-8838-55b75cf39a74/ 4 KB
2 KB 40ms
20ms Script
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/7163e23c-88a8-41d6-8838-55b75cf39a74/OtAutoBlock.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff2e295cdd9f633b0e075bb11ec5cf6495f8616c6f7eb9f9892a06b816921d4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: XVLcaa5cX7cTJFLnBVDn4g==
age: 15578
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1679
x-ms-lease-status: unlocked
last-modified: Thu, 01 Dec 2022 15:04:54 GMT
server: cloudflare
etag: 0x8DAD3AD67834804
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 98739f8f-a01e-003d-4797-056dc0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 788cac156ff92c3a-FRA
expires: Sat, 14 Jan 2023 08:13:22 GMT

GET
H2 200 client.c56e2a37.js Show response
q-xx.bstatic.com/flights/web/static/js/ 1 MB
244 KB 25ms
9ms Script
application/javascript 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e54ee3f58129bd16a09dec6a0d4c68527ae254d58b075cbedcaaf6fe6731d4f9

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://flights.booking.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Thu, 12 Jan 2023 14:57:30 GMT
content-encoding: br
via: 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: FRA53-C1
age: 62151
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Wed, 12 Apr 2023 14:50:50 GMT", rule-id="expire-static-assets"
last-modified: Thu, 12 Jan 2023 14:50:50 GMT
server: nginx
x-amz-meta-s3cmd-attrs: md5:38c9b9b617e21e368015e6e4ce3b015a
etag: W/"38c9b9b617e21e368015e6e4ce3b015a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: NAXvhQIFJlp3-mmQajyzgp4u7qiBVqW9znNovyPjxPgyi05usFVUYg==
expires: Sat, 11 Feb 2023 14:57:30 GMT

GET
H2 200 screens-Confirmation.56bc5d02.chunk.js Show response
q-xx.bstatic.com/flights/web/static/js/ 880 KB
166 KB 46ms
31ms Script
application/javascript 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q-xx.bstatic.com/flights/web/static/js/screens-Confirmation.56bc5d02.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3054f56ee59c6dba9c93f014d68a5acc76322dea312afe73b70ae01a13d35399

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://flights.booking.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Thu, 12 Jan 2023 14:58:44 GMT
content-encoding: br
via: 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: FRA53-C1
age: 62077
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Wed, 12 Apr 2023 14:51:26 GMT", rule-id="expire-static-assets"
last-modified: Thu, 12 Jan 2023 14:51:26 GMT
server: nginx
x-amz-meta-s3cmd-attrs: md5:9b9630ea623065c88ab08d310aa4166c
etag: W/"9b9630ea623065c88ab08d310aa4166c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: zVlXPpY58kBjqXlGkqffwqxWQ6gus_aL7-dozGGopetBKqk3fDSceQ==
expires: Sat, 11 Feb 2023 14:58:44 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 200 KB
72 KB 59ms
20ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PQHB9P4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b2c63fbed3d23b2993a3b55c95e3fe707f3f7ec445b3bf4ebc14e8d4da9973e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73479
x-xss-protection: 0
last-modified: Fri, 13 Jan 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 13 Jan 2023 08:13:22 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 51ms
12ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 13 Jan 2023 06:30:51 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 6151
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Fri, 13 Jan 2023 08:30:51 GMT

GET
H2 200 cookiebanner.html Show response
www.booking.com/ Frame F33C 2 KB
2 KB 177ms
177ms Document
text/html 65.9.66.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/cookiebanner.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.66.108 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-66-108.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

d3c7c4dbe9a235e7ba1dbfe981c2af6e18b722ef684ef16eb08c4fc2a82a6627

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private
content-encoding: br
content-length: 836
content-type: text/html; charset=UTF-8
date: Fri, 13 Jan 2023 08:13:22 GMT
nel: {"max_age":604800,"report_to":"default"}
report-to: {"group":"default","max_age":604800,"endpoints":[{"url":"https://nellie.booking.com/report"}]}
server: nginx
strict-transport-security: max-age=604800
vary: Accept-Encoding, User-Agent
via: 1.1 2fc0d20914c32e5cd76477ed042298d0.cloudfront.net (CloudFront)
x-amz-cf-id: f2XSuNqOxHrvEThq8EQ0ceztU0M6Qxwh74hcChKA5RraNuKN4KaYfA==
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com
x-xss-protection: 1; mode=block

GET
H2 200 de.png
q-xx.bstatic.com/backend_static/common/flags/new/48-squared/ 146 B
711 B 9ms
8ms Image
image/png 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/de.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c1f1497ae4ade7ce895bc174187b7c5f145d0924c082c86cfed4efda62f305c

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 09 Jan 2023 00:58:57 GMT
via: 1.1 8b5bc0831e6dab612582614c3009efa6.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: FRA53-C1
age: 371776
x-cache: Hit from cloudfront
content-length: 146
x-xss-protection: 1; mode=block
last-modified: Mon, 07 Sep 2020 10:40:08 GMT
server: nginx
etag: "5f560e08-92"
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: K7YOpuXbDBlQuJvmfNh8dp05z8OqjNLpB1e8oyEIj77DkmlsuMucHA==
expires: Wed, 08 Feb 2023 00:57:06 GMT

GET
H2 200 96312.9627b943.chunk.js Show response
q-xx.bstatic.com/flights/web/static/js/ 9 KB
3 KB 8ms
8ms Script
application/javascript 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q-xx.bstatic.com/flights/web/static/js/96312.9627b943.chunk.js

Requested by

Host: q-xx.bstatic.com
URL: https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

6d6d329d9e7ec60e83b0b232463a942261b40fdf0555319fab51ebeb26e37490

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer
Origin: https://flights.booking.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Thu, 12 Jan 2023 10:00:23 GMT
content-encoding: br
via: 1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: FRA53-C1
age: 79979
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Sun, 09 Apr 2023 15:28:49 GMT", rule-id="expire-static-assets"
last-modified: Thu, 12 Jan 2023 09:14:03 GMT
server: nginx
x-amz-meta-s3cmd-attrs: md5:d4beb819a795095e570ae735e6d36d17
etag: W/"d4beb819a795095e570ae735e6d36d17"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: f5E6qLyk8rLndJewWxj0ztdKYAARERSV8hR56YrdrhZMRRsXZbFiGA==
expires: Sat, 11 Feb 2023 10:00:23 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 21ms
20ms XHR
text/plain 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1825847309&t=pageview&_s=1&dl=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&ul=en-us&de=UTF-8&dt=Flights%20-%20Booking.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=778986825&gjid=143261076&cid=64447788.1673597602&tid=UA-116109-57&_gid=1747500321.1673597602&_r=1&_slc=1&z=1371867834

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 08:13:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://flights.booking.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/481216654/ 2 KB
2 KB 80ms
45ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/481216654/?random=1673597602413&cv=11&fst=1673597602413&bg=ffffff&guid=ON&async=1&gtm=2wg1a1&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&tiba=Flights%20-%20Booking.com&auid=1917202302.1673597602&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PQHB9P4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

edacad3c6fdd09652ceeb1504c12d7a2be1a6b0caa8c04273b0bf897403442cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 983
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 61ms
39ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PQHB9P4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

f2c4b7d20ff42a433d0c76631c460cd75128f8f0436d052ce2cf79dc4fa6a244

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Fri, 13 Jan 2023 08:13:21 GMT
last-modified: Mon, 05 Dec 2022 17:15:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 399461A1848D485FBBAB626BBE806521 Ref B: FRAEDGE1305 Ref C: 2023-01-13T08:13:22Z
etag: "027e538cd8d91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 11472

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 185 KB
67 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1070314322

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PQHB9P4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dae1a80334c434c4e5bbaf0c3e287ed87f7802a187fe14d20768d2f5e2ca53c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68924
x-xss-protection: 0
last-modified: Fri, 13 Jan 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 13 Jan 2023 08:13:22 GMT

GET
H2 200 header Show response
www.booking.com/attractions/api/ 16 KB
6 KB 73ms
57ms Fetch
application/json 65.9.66.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/attractions/api/header?label=gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF&lang=de&aid=304142&product=flights

Requested by

Host: q-xx.bstatic.com
URL: https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.66.108 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-66-108.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

d33888c933a8016cfdb5bb3bbe2e2d06ec11f6c4bae0ad228d1c779bf376a63c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 13 Jan 2023 08:13:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-options: nosniff
via: 1.1 95e0c26862caa0a0aa5e9580919524f8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
content-security-policy-report-only: default-src 'self'; connect-src 'self' *.booking.com:* wss://*.booking.com:* cdn.cookielaw.org *.google-analytics.com *.onetrust.com; script-src 'self' 'unsafe-inline' *.booking.com:* *.bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net *.googletagmanager.com *.google-analytics.com *.googleadservices.com *.googleapis.com *.onetrust.com; img-src * data:; style-src 'self' 'unsafe-inline' *.booking.com *.bstatic.com *.googleapis.com; font-src 'self' *.bstatic.com fonts.gstatic.com; frame-src 'self' *.booking.com; object-src 'none'; report-to default
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
server: nginx
vary: Accept-Encoding
access-control-max-age: 1209600
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://flights.booking.com
x-frame-options: SAMEORIGIN
access-control-allow-credentials: true
x-amz-cf-id: g1emViZhghGZ-EJgELNLd5RX-Rs4KwrYNzbRA36cPedbB-x8Kbgc0A==

POST
H2 202 internal-events Show response
flights.booking.com/track/ 16 B
720 B 125ms
124ms Fetch
application/json 143.204.215.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://flights.booking.com/track/internal-events

Requested by

Host: q-xx.bstatic.com
URL: https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-58.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

X-Requested-From: clientFetch
Referer: https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0
X-Booking-Affiliate-Id: 304142
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
X-Booking-Label: gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Content-Type: application/json

Response headers

date: Fri, 13 Jan 2023 08:13:22 GMT
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
via: 1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
content-length: 16
x-xss-protection: 1; mode=block
x-request-id: 25721660-931a-11ed-b12a-d574c89ef907
server: nginx
vary: Origin
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-origin: https://flights.booking.com
access-control-allow-credentials: true
x-amz-cf-id: _jpoJd8Oxi8A1W_xR-7KZe7BDqccw60B0YnAJUxFpGuGQIgpXu2t_Q==

POST
H2 202 internal-events Show response
flights.booking.com/track/ 16 B
721 B 48ms
48ms Fetch
application/json 143.204.215.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://flights.booking.com/track/internal-events

Requested by

Host: q-xx.bstatic.com
URL: https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-58.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

X-Requested-From: clientFetch
Referer: https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0
X-Booking-Affiliate-Id: 304142
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
X-Booking-Label: gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Content-Type: application/json

Response headers

date: Fri, 13 Jan 2023 08:13:22 GMT
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
via: 1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
content-length: 16
x-xss-protection: 1; mode=block
x-request-id: 25717a20-931a-11ed-8d5a-2778cd493389
server: nginx
vary: Origin
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-origin: https://flights.booking.com
access-control-allow-credentials: true
x-amz-cf-id: CPLwwIYfyjlUgQsI2Y6RY_djr53wE0W4mJpVGmbQjqNCCe5JWSNOyQ==

POST
H2 202 route-changes Show response
flights.booking.com/track/ 13 B
719 B 68ms
68ms Fetch
application/json 143.204.215.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://flights.booking.com/track/route-changes

Requested by

Host: q-xx.bstatic.com
URL: https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-58.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

eea30d77847b2d433e61933006a0fffc094452f86be84c4533b3d6122ab77a99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

X-Requested-From: clientFetch
Referer: https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0
X-Booking-Affiliate-Id: 304142
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
X-Booking-Label: gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Content-Type: application/json

Response headers

date: Fri, 13 Jan 2023 08:13:22 GMT
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
via: 1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
content-length: 13
x-xss-protection: 1; mode=block
x-request-id: 2572d9b0-931a-11ed-a7a2-7f8364501824
server: nginx
vary: Origin
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-origin: https://flights.booking.com
access-control-allow-credentials: true
x-amz-cf-id: TZeoPlUgmZyVPZZdcUs9zVAZZlNeGxMxcqD_SvFAHXenw3OgqyZ6dQ==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 13ms
12ms Image
image/gif 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1825847309&t=event&_s=2&dl=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&ul=en-us&de=UTF-8&dt=Flights%20-%20Booking.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Flights&ea=pb_flight_details_landing_in&el=&_u=KEBAAEABAAAAACAAI~&jid=&gjid=&cid=64447788.1673597602&tid=UA-116109-57&_gid=1747500321.1673597602&z=399547557

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 03:07:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 18343
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
445 B 56ms
18ms XHR
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-116109-57&cid=64447788.1673597602&jid=778986825&gjid=143261076&_gid=1747500321.1673597602&_u=IEBAAEAAAAAAACAAI~&z=563847695

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 13 Jan 2023 08:13:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://flights.booking.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356 Show response
flights.booking.com/api/order/ 7 KB
3 KB 209ms
208ms Fetch
application/json 143.204.215.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://flights.booking.com/api/order/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356?includeAvailableExtras=1

Requested by

Host: q-xx.bstatic.com
URL: https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-58.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

67a8bdf6f16a4d4c6bb45877e23d60320344121eba8b80534ad9c98d4577d34d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

X-Requested-From: clientFetch
Referer
X-Booking-Affiliate-Id: 304142
accept-language: de-DE,de;q=0.9
X-Flights-Context-Name: pb_flight_details
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
X-Booking-Label: gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF

Response headers

date: Fri, 13 Jan 2023 08:13:22 GMT
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-encoding: gzip
via: 1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
x-request-id: 2573eb20-931a-11ed-89b6-ddedcace34ae
referrer-policy: no-referrer
server: nginx
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-credentials: true
x-booking-app-version: 340f380b22884b4a2833f9bb5c93e43d303431ee
x-amz-cf-id: 6ziJ4yMH3yerOrm7IraSO4NvNAHutB5dbFEQlNsWt0T2b8hwbQmIuw==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 13ms
12ms Image
image/gif 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1825847309&t=pageview&_s=3&dl=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&dp=pb-flight-details&ul=en-us&de=UTF-8&dt=Flights%20-%20Booking.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KEBAAEABAAAAACACI~&jid=&gjid=&cid=64447788.1673597602&tid=UA-116109-57&_gid=1747500321.1673597602&cd2=&cd3=&cd4=&cd5=&cd6=&z=1308275547

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 03:07:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 18343
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/481216654/ 42 B
154 B 82ms
26ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/481216654/?random=1673597602413&cv=11&fst=1673596800000&bg=ffffff&guid=ON&async=1&gtm=2wg1a1&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&tiba=Flights%20-%20Booking.com&fmt=3&is_vtc=1&random=574902049&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 08:13:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/481216654/ 42 B
548 B 60ms
26ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/481216654/?random=1673597602413&cv=11&fst=1673596800000&bg=ffffff&guid=ON&async=1&gtm=2wg1a1&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&tiba=Flights%20-%20Booking.com&fmt=3&is_vtc=1&random=574902049&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 08:13:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 24 KB
8 KB 20ms
19ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d277a90920d78efa3d6e473d67240beb26100591c7b02a34bd444aa78ee5d5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: WdCEPqU1pnnoNr/cT9hHyQ==
age: 17580
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 8053
x-ms-lease-status: unlocked
last-modified: Thu, 12 Jan 2023 20:31:24 GMT
server: cloudflare
etag: 0x8DAF4DBF947856B
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 280cbd38-301e-0092-52e3-264f50000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 788cac17bc1c2c3a-FRA

GET
H2 204 15338614.js Show response
bat.bing.com/p/action/ 0
117 B 112ms
111ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/15338614.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Fri, 13 Jan 2023 08:13:22 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3B326F7536F24F97B3920BF5D33636B9 Ref B: FRAEDGE1305 Ref C: 2023-01-13T08:13:22Z
x-cache: CONFIG_NOCACHE

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1070314322/ 2 KB
1 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070314322/?random=1673597602537&cv=11&fst=1673597602537&bg=ffffff&guid=ON&async=1&gtm=2oa1a1&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&tiba=Flights%20-%20Booking.com&auid=1917202302.1673597602&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1070314322

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6e086f5bebd3da2773db72a44c9df5f7db2a9c24b20475d8260ab5241e56a99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1002
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 7163e23c-88a8-41d6-8838-55b75cf39a74.json Show response
cdn.cookielaw.org/consent/7163e23c-88a8-41d6-8838-55b75cf39a74/ 6 KB
3 KB 34ms
19ms XHR
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/7163e23c-88a8-41d6-8838-55b75cf39a74/7163e23c-88a8-41d6-8838-55b75cf39a74.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25c0622dae99de0201ef67b516bbada6ad02ca164abaa8576db31d1da4c3731f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: c4JljhcPfxiEwfucUZ+M8w==
age: 60231
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1983
x-ms-lease-status: unlocked
last-modified: Thu, 01 Dec 2022 15:04:54 GMT
server: cloudflare
etag: 0x8DAD3AD6779103F
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 67d7a373-b01e-00ee-2297-05d265000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 788cac181a539b58-FRA
expires: Sat, 14 Jan 2023 08:13:22 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 44ms
24ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-116109-57&cid=64447788.1673597602&jid=778986825&_u=IEBAAEAAAAAAACAAI~&z=1818464650

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 08:13:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 24ms
24ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-116109-57&cid=64447788.1673597602&jid=778986825&_u=IEBAAEAAAAAAACAAI~&z=1818464650

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 08:13:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
295 B 62ms
37ms XHR
application/json 2606:4700::6812:1a55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1a55 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 13 Jan 2023 08:13:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 788cac186f2b691f-FRA
access-control-allow-headers: Content-Type

GET
H2 200 /
www.google.com/pagead/1p-user-list/1070314322/ 42 B
108 B 29ms
26ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1070314322/?random=1673597602537&cv=11&fst=1673596800000&bg=ffffff&guid=ON&async=1&gtm=2oa1a1&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&tiba=Flights%20-%20Booking.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4263838984&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 08:13:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1070314322/ 42 B
108 B 36ms
33ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1070314322/?random=1673597602537&cv=11&fst=1673596800000&bg=ffffff&guid=ON&async=1&gtm=2oa1a1&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&tiba=Flights%20-%20Booking.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4263838984&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 08:13:22 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.25.0/ 318 KB
76 KB 22ms
21ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.25.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe035b6ff2394b9fc9b4dad0acc9050d633269a5efa7cfeac7e6b8fdc12b7065

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: wv3c0qnkBhaWE//T4i2BGA==
age: 17526
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 77456
x-ms-lease-status: unlocked
last-modified: Fri, 22 Oct 2021 16:52:46 GMT
server: cloudflare
etag: 0x8D9957C5F8AA42D
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: ac5e766c-101e-00e8-7a4e-e3251d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 788cac18ae352c3a-FRA

GET
H2 200 de.json Show response
cdn.cookielaw.org/consent/7163e23c-88a8-41d6-8838-55b75cf39a74/e1b8f75b-db25-46d6-8a45-749ed6c3e64c/ 43 KB
13 KB 16ms
16ms Fetch
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/7163e23c-88a8-41d6-8838-55b75cf39a74/e1b8f75b-db25-46d6-8a45-749ed6c3e64c/de.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.25.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79a21dab640e082a6495372b7fd5292675dadf38ce6ba4f3ba71e5800175e852

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: xK4DshiN8ekhRG5CzICZQA==
age: 60052
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12673
x-ms-lease-status: unlocked
last-modified: Thu, 01 Dec 2022 15:13:23 GMT
server: cloudflare
etag: 0x8DAD3AE970AABD2
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 5a75dca3-801e-0148-7797-05ac2e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 788cac18eb8d9b58-FRA
expires: Sat, 14 Jan 2023 08:13:22 GMT

POST
H2 200 getAccommodations Show response
flights.booking.com/api/crosssell/ 7 KB
2 KB 248ms
247ms Fetch
application/json 143.204.215.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://flights.booking.com/api/crosssell/getAccommodations

Requested by

Host: q-xx.bstatic.com
URL: https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-58.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

118464257f569686aa726befc621f6b1c7e9397bf5cfc5649756f10e7dfd11ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
X-Flights-Context-Name: pb_flight_details
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
X-Booking-Label: gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Content-Type: application/json
X-Requested-From: clientFetch
Referer
X-Booking-Affiliate-Id: 304142

Response headers

date: Fri, 13 Jan 2023 08:13:22 GMT
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-encoding: gzip
via: 1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
x-request-id: 259aad00-931a-11ed-a7a0-d74d7cce2f4a
referrer-policy: no-referrer
server: nginx
vary: Accept-Encoding, Origin
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-origin: https://flights.booking.com
access-control-allow-credentials: true
x-booking-app-version: 340f380b22884b4a2833f9bb5c93e43d303431ee
x-amz-cf-id: r4X0jXg93rwJGzCZ2Oc-F--LNAtKmFQ4Pf4bL1KEvKJVMNHGzje2zw==

GET
H2 200 FA.png
r-xx.bstatic.com/data/airlines_logo/ 1 KB
2 KB 34ms
12ms Image
image/png 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r-xx.bstatic.com/data/airlines_logo/FA.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d6f73f21843a9f29f3b095f9f76a57117302d7117457fd43d72d61652cb2ab4f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 13 Jan 2023 07:35:14 GMT
x-amz-version-id: 70gmLyuqfdVeqsCyHvoyiqJXixRJnjCR
via: 1.1 8b5bc0831e6dab612582614c3009efa6.cloudfront.net (CloudFront)
last-modified: Thu, 12 Jan 2023 12:51:36 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 2289
etag: "a3bc05886c8bf60a73575f32235372c6"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 1307
x-amz-cf-id: -y4XyZ5pmZQAMlv1wI85kvXF5M1Rl5SRZHj6Xu-QRhInUEs3KKbtKg==

GET
H2 200 GeniusGiftBoxDiscount.png
t-cf.bstatic.com/design-assets/assets/v3.42.0/illustrations-traveller/ 24 KB
24 KB 46ms
8ms Image
image/png 2600:9000:211e:6400:15:9f56:b80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t-cf.bstatic.com/design-assets/assets/v3.42.0/illustrations-traveller/GeniusGiftBoxDiscount.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:6400:15:9f56:b80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0f332f5b788204465795b9097539c621b544279326bb282811f3c0747aa58439

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 13 Jan 2023 07:38:33 GMT
via: 1.1 84f381696dd33e92960b92250106e464.cloudfront.net (CloudFront)
last-modified: Mon, 24 Oct 2022 14:01:22 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
age: 2121
etag: "a1052c8126edefa161e7eb4a92d3e6a0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 24198
x-amz-cf-id: oKN4E_vtteYkacUHnDWYPNlvBFM2zGGhdmg7f_8_ojt2PmwTOqcGoQ==

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.25.0/assets/ 13 KB
3 KB 20ms
19ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.25.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.25.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Jan 2023 08:13:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: QAufc0ozHqszfMLxOJh3oA==
age: 2359
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2950
x-ms-lease-status: unlocked
last-modified: Fri, 22 Oct 2021 16:52:36 GMT
server: cloudflare
etag: 0x8D9957C59E8C180
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 7d4c3662-a01e-00b5-1c39-cbd519000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 788cac199c909b58-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.25.0/assets/ 20 KB
4 KB 19ms
19ms Fetch
text/css 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.25.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.25.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Jan 2023 08:13:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Ye6OeZcNyuFoWog7CYs00A==
age: 24212
x-ms-lease-status: unlocked
last-modified: Fri, 22 Oct 2021 16:52:54 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 6a35db47-801e-004c-0ec0-111ff9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 788cac199c929b58-FRA

GET
H2 200 356607938.jpg
q-xx.bstatic.com/xdata/images/hotel/square200/ 11 KB
12 KB 12ms
10ms Image
image/jpeg 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/xdata/images/hotel/square200/356607938.jpg?k=8029f86c44745f822f83159976932612e99c32c8577bad481bcad389873c2d81&o=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

dc1c57ed3ea7bc3a937df5da84dc8ef0d103ad2f320df2a18b318f66eb42ec4b

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 21:58:53 GMT
via: 1.1 8b5bc0831e6dab612582614c3009efa6.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA53-C1
age: 1419270
etag: "6ea35c195375c9e310d70c375bf9505b95b06686"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: tZFtIodPFbBBbDVCqyLRs5OKhwsqdD8jzdBktCsFyK_TN3O2AbPiSw==
content-length: 11492
x-xss-protection: 1; mode=block
expires: Thu, 26 Jan 2023 21:58:53 GMT

GET
H2 200 215501395.jpg
q-xx.bstatic.com/xdata/images/hotel/square200/ 8 KB
8 KB 11ms
9ms Image
image/jpeg 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/xdata/images/hotel/square200/215501395.jpg?k=ec4de3a4c7800dc07341435e51108c3ea0af2f6eccb51537cdb5b7aa213cdbbb&o=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4f3f52d9cc2515f8f8f5931d59a42f3c533066d6316531729768c9d4efb541a4

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 04:31:08 GMT
via: 1.1 8b5bc0831e6dab612582614c3009efa6.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA53-C1
age: 1222935
etag: "ce283aeafa43b6daf73d4a7cac52c2f11990f920"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: _f3XccZl07g9fmO4cDx_nZEC7y8LphFHdyWQtKOxiKwHhN9YJJh05w==
content-length: 8079
x-xss-protection: 1; mode=block
expires: Sun, 29 Jan 2023 04:31:08 GMT

GET
H2 200 314201349.jpg
q-xx.bstatic.com/xdata/images/hotel/square200/ 10 KB
10 KB 11ms
10ms Image
image/jpeg 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/xdata/images/hotel/square200/314201349.jpg?k=75e9f23d6062c9b3072fef26e2ba555692273f600cf5b98f69e2baaad2db04b2&o=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

afbdd7759595b8de3baeb426aa348490e368dbbb266ba37d1b50c76330b54b29

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 10:44:18 GMT
via: 1.1 8b5bc0831e6dab612582614c3009efa6.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA53-C1
age: 1459745
etag: "40fa3aadede9d95e7a19ff701ca947006a84319f"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: Iz8tBhtCMWnQZHB7zmmNUICoW0a_TUOiYEynpcwFZi_wicUJkvL6mQ==
content-length: 9770
x-xss-protection: 1; mode=block
expires: Thu, 26 Jan 2023 10:44:18 GMT

GET
H2 200 130766068.jpg
q-xx.bstatic.com/xdata/images/hotel/square200/ 11 KB
11 KB 13ms
12ms Image
image/jpeg 2600:9000:214f:4400:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/xdata/images/hotel/square200/130766068.jpg?k=34856234794a3275e8561f6559a200a6a895dc3369ee0ccdcbe89d061fdf7be6&o=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:4400:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

25ba99fc4dbedd2edfa1a47562e4dc839fe6619144c1f1fb322975c1c53862dc

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 28 Dec 2022 09:07:07 GMT
via: 1.1 8b5bc0831e6dab612582614c3009efa6.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA53-C1
age: 1379176
etag: "98b54ca530974a18a000aa891a3160dbe3b9d09c"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: edjgFUVQ-z0F018nMN14kxPJFVt5AJdQmoAH-I2gz_7ws2E-j0D8YA==
content-length: 11005
x-xss-protection: 1; mode=block
expires: Fri, 27 Jan 2023 09:07:07 GMT

POST
H2 202 internal-events Show response
flights.booking.com/track/ 16 B
720 B 43ms
42ms Fetch
application/json 143.204.215.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://flights.booking.com/track/internal-events

Requested by

Host: q-xx.bstatic.com
URL: https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-58.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

X-Requested-From: clientFetch
Referer: https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0
X-Booking-Affiliate-Id: 304142
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
X-Booking-Label: gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Content-Type: application/json

Response headers

date: Fri, 13 Jan 2023 08:13:23 GMT
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
via: 1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
content-length: 16
x-xss-protection: 1; mode=block
x-request-id: 25c51860-931a-11ed-a7b2-a1ef39fdebd1
server: nginx
vary: Origin
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-origin: https://flights.booking.com
access-control-allow-credentials: true
x-amz-cf-id: XIyaiOPN4Kpn2k7vInDypVxxLOpMedCajO-K2ZlD_EVBGKTPemwuvA==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 13ms
12ms Image
image/gif 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1825847309&t=event&_s=4&dl=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&ul=en-us&de=UTF-8&dt=Flights%20-%20Booking.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Flights&ea=pb_flight_details_xsell_rendered&el=&_u=KEBAAEABAAAAACACI~&jid=&gjid=&cid=64447788.1673597602&tid=UA-116109-57&_gid=1747500321.1673597602&z=1083810284

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Jan 2023 03:07:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 18344
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 et Show response
flights.booking.com/track/ 4 B
724 B 90ms
89ms Fetch
application/json 143.204.215.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://flights.booking.com/track/et

Requested by

Host: q-xx.bstatic.com
URL: https://q-xx.bstatic.com/flights/web/static/js/client.c56e2a37.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-58.fra53.r.cloudfront.net

Software

nginx /

Resource Hash

b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

X-Requested-From: clientFetch
Referer: https://flights.booking.com/booking/flight-details/524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356/0
X-Booking-Affiliate-Id: 304142
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
X-Booking-Label: gen173rf-18CAEY6AcoggI46AdIB1gEaDuSAQJYWMIBCldpbmRvd3MgMTDYAQPyAQJYWPgBAZgCAagCA7gCoqWEngbAAgHSAiQyOTA2OWJhMS00M2E1LTQyZTQtYjM0Yi1jNjkyMGNhNjIyMTDYAgHqAgRNQVRF
Content-Type: application/json

Response headers

date: Fri, 13 Jan 2023 08:13:23 GMT
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
via: 1.1 80d90c7955dda88e3912960ead8e99d6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
content-length: 4
x-xss-protection: 1; mode=block
x-request-id: 25c7fe90-931a-11ed-af57-a38e02804feb
referrer-policy: no-referrer
server: nginx
vary: Origin
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-origin: https://flights.booking.com
access-control-allow-credentials: true
x-amz-cf-id: aUtEMAGhJhuyVf7IWv5aZJb1Dh3Zvm4HFFC2NgAl7KtcfFGXPBtb_g==

Verdicts & Comments Add Verdict or Comment

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.booking.com/	1970-01-20 08:54:44	Name: fasc Value: 8dfb1b24-c9dc-4605-8527-d60fe60f11dc
.booking.com/	1970-01-20 17:38:53	Name: pc_payer_id Value: 599a1b87-4905-4e33-91dd-4c17be0c3cfa
flights.booking.com/	1969-12-31 23:59:59	Name: skip_redirect Value: 1
.booking.com/	1970-01-20 17:38:53	Name: fsc Value: s%3A14ccee324eef6e7386bb8d1cdb82cfab.95JTj7hoYhCEgAmHbQi4WXdZKZeZBSE8IkM4uZhHkZ0
.booking.com/	1970-01-20 18:29:17	Name: px_init Value: 0
flights.booking.com/	1970-01-20 09:17:48	Name: fsc Value: s%3A14ccee324eef6e7386bb8d1cdb82cfab.95JTj7hoYhCEgAmHbQi4WXdZKZeZBSE8IkM4uZhHkZ0
.booking.com/	1970-01-20 18:29:17	Name: _ga Value: GA1.2.64447788.1673597602
.booking.com/	1970-01-20 08:54:44	Name: _gid Value: GA1.2.1747500321.1673597602
.booking.com/	1970-01-20 08:53:17	Name: _gat Value: 1
.booking.com/	1970-01-20 11:02:53	Name: _gcl_au Value: 1.1.1917202302.1673597602
.booking.com/	1970-01-20 17:38:53	Name: _pxhd Value: 5p58wHnPP3tAKpLZoxLvfBQP2l3kfTSbgChkPoaMNX6eyXp4IdEeLcxHZhtHTDU3icNJrzfdZ2FKYpYEQm-suw%253D%253D%253A8H1lKiRKWqoKU7riBtse4JLk2Now%252FKyHCTRVuKVFeBITyG94pBNFt%252Frn%252F9mfjTDyBLmNtpRWbbMphyFT0fYMwHOrYeak5O41fPBeNKBtDLk%253D
.booking.com/	1970-01-20 18:29:17	Name: bkng Value: 11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiDjFfvokSRisulZUReQYeEaZBoL5bUuNJFCnpt60jH5CvLbjxU4ODGwhX9iO2FIIw83pgsdO1oDcKHVIgSB77zLPxtlMmBbWkcPPr0sw01weMgrzugrXtlFqKSp047ZYvbTJp1ikldTzxruoWHtXrD6TywBrQXAU%3D
.bing.com/	1970-01-20 18:14:53	Name: MUID Value: 27A99899C1A368D122988A01C0716983
.booking.com/	1970-01-20 08:54:44	Name: _uetsid Value: 2575b910931a11ed8d2957a05e741c57
.booking.com/	1970-01-20 18:14:53	Name: _uetvid Value: 25759af0931a11ed9723db0c72d9ce8f
.doubleclick.net/	1970-01-20 18:14:53	Name: IDE Value: AHWqTUmEdXeSjA5avjLEOnKNeQb1_yDjlGad-FcRoYCcrM0lmOzch0bAcU-B1p58
.flights.booking.com/	1970-01-20 13:12:29	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Fri+Jan+13+2023+08%3A13%3A22+GMT%2B0000+(GMT)&version=6.25.0&isIABGlobal=false&hosts=&consentId=4b22c64f-b58a-4433-ade1-d59a286acb8b&interactionCount=0&landingPath=https%3A%2F%2Fflights.booking.com%2Fbooking%2Fflight-details%2F524cb3191271ae9a03007116547a908dea03396cbc739e9dc1e55909afb7789cebafcaa1f61e9c1f7601dd05b06df55087331ef4fa38207833cb77872079092b7fd99cc4593e3303aa9d8ab4c356%2F0&groups=C0001%3A1%2CC0002%3A0%2CC0004%3A0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bat.bing.com
cdn.cookielaw.org
flights.booking.com
geolocation.onetrust.com
googleads.g.doubleclick.net
q-xx.bstatic.com
r-xx.bstatic.com
stats.g.doubleclick.net
t-cf.bstatic.com
www.booking.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
143.204.215.58
2600:9000:211e:6400:15:9f56:b80:93a1
2600:9000:214f:4400:1f:e2ee:200:93a1
2606:4700::6810:9540
2606:4700::6812:1a55
2620:1ec:c11::200
2a00:1450:4001:800::2003
2a00:1450:4001:806::2008
2a00:1450:4001:811::200e
2a00:1450:4001:813::2002
2a00:1450:4001:831::2004
2a00:1450:400c:c00::9c
65.9.66.108
0f332f5b788204465795b9097539c621b544279326bb282811f3c0747aa58439
118464257f569686aa726befc621f6b1c7e9397bf5cfc5649756f10e7dfd11ee
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
25ba99fc4dbedd2edfa1a47562e4dc839fe6619144c1f1fb322975c1c53862dc
25c0622dae99de0201ef67b516bbada6ad02ca164abaa8576db31d1da4c3731f
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
3054f56ee59c6dba9c93f014d68a5acc76322dea312afe73b70ae01a13d35399
3d277a90920d78efa3d6e473d67240beb26100591c7b02a34bd444aa78ee5d5c
4c1f1497ae4ade7ce895bc174187b7c5f145d0924c082c86cfed4efda62f305c
4f3f52d9cc2515f8f8f5931d59a42f3c533066d6316531729768c9d4efb541a4
67a8bdf6f16a4d4c6bb45877e23d60320344121eba8b80534ad9c98d4577d34d
6d6d329d9e7ec60e83b0b232463a942261b40fdf0555319fab51ebeb26e37490
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
79a21dab640e082a6495372b7fd5292675dadf38ce6ba4f3ba71e5800175e852
7b368603dd4dd3f7b131e4e4fbad6481e42678d06b9a431f3850cc34ab752a14
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afbdd7759595b8de3baeb426aa348490e368dbbb266ba37d1b50c76330b54b29
b2c63fbed3d23b2993a3b55c95e3fe707f3f7ec445b3bf4ebc14e8d4da9973e1
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
c89a78d31bb1a75c562ae57ec725cda46554902efebe0d804c0ac49815149dfe
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
d33888c933a8016cfdb5bb3bbe2e2d06ec11f6c4bae0ad228d1c779bf376a63c
d3c7c4dbe9a235e7ba1dbfe981c2af6e18b722ef684ef16eb08c4fc2a82a6627
d6f73f21843a9f29f3b095f9f76a57117302d7117457fd43d72d61652cb2ab4f
dae1a80334c434c4e5bbaf0c3e287ed87f7802a187fe14d20768d2f5e2ca53c6
dc1c57ed3ea7bc3a937df5da84dc8ef0d103ad2f320df2a18b318f66eb42ec4b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e445a6f07214fd44035d177be94f9ab697c19a54642f4a603715dbb24bf72e95
e54ee3f58129bd16a09dec6a0d4c68527ae254d58b075cbedcaaf6fe6731d4f9
edacad3c6fdd09652ceeb1504c12d7a2be1a6b0caa8c04273b0bf897403442cd
eea30d77847b2d433e61933006a0fffc094452f86be84c4533b3d6122ab77a99
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2c4b7d20ff42a433d0c76631c460cd75128f8f0436d052ce2cf79dc4fa6a244
f6e086f5bebd3da2773db72a44c9df5f7db2a9c24b20475d8260ab5241e56a99
fe035b6ff2394b9fc9b4dad0acc9050d633269a5efa7cfeac7e6b8fdc12b7065
ff2e295cdd9f633b0e075bb11ec5cf6495f8616c6f7eb9f9892a06b816921d4f

flights.booking.com Open in urlscan Pro 143.204.215.58 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

48 Requests

100 %HTTPS

85 %IPv6

10 Domains

14 Subdomains

13 IPs

3 Countries

876 kBTransfer

3615 kBSize

17 Cookies

14 Outgoing links

Page URL History

Redirected requests

48 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

flights.booking.com Open in urlscan Pro
143.204.215.58 Public Scan

Screenshot
Live screenshot

Full Image

48
Requests

100 %
HTTPS

85 %
IPv6

10
Domains

14
Subdomains

13
IPs

3
Countries

876 kB
Transfer

3615 kB
Size

17
Cookies

48 HTTP transactions
0 data transactions