booking.negx.net Open in urlscan Pro
23.111.238.40 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://booking.negx.net/
Submission: On March 23 via automatic, source certstream-suspicious (March 23rd 2023, 4:22:08 pm UTC) — Scanned from NL

Summary HTTP 25 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 11 IPs in 4 countries across 7 domains to perform 25 HTTP transactions. The main IP is 23.111.238.40, located in Netherlands and belongs to SERVERS-COM, US. The main domain is booking.negx.net.
TLS certificate: Issued by R3 on March 23rd 2023. Valid for: 3 months.

This is the only time booking.negx.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
9	23.111.238.40 23.111.238.40	7979 (SERVERS-COM) (SERVERS-COM)
1	89.46.109.44 89.46.109.44	31034 (ARUBA-ASN) (ARUBA-ASN)
2	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:20:... 2606:4700:20::ac43:44ed	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.255.224.36 172.255.224.36	7979 (SERVERS-COM) (SERVERS-COM)
4	23.108.212.76 23.108.212.76	7979 (SERVERS-COM) (SERVERS-COM)
1	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
1 2	185.106.81.236 185.106.81.236	7979 (SERVERS-COM) (SERVERS-COM)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
25	11

9 23.111.238.40 (Netherlands)

ASN7979 (SERVERS-COM, US)

booking.negx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.46.109.44 (Arezzo, Italy)

ASN31034 (ARUBA-ASN, IT)
PTR: webx1373.aruba.it

www.negx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:44ed (United States)

ASN13335 (CLOUDFLARENET, US)

st.avsplow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.255.224.36 (Netherlands)

ASN7979 (SERVERS-COM, US)

www.travelpayouts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.108.212.76 (Netherlands)

ASN7979 (SERVERS-COM, US)

mamka.aviasales.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.106.81.236 (Netherlands) 1 redirects

ASN7979 (SERVERS-COM, US)

avsplow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	negx.net booking.negx.net www.negx.net	512 KB
4	aviasales.ru mamka.aviasales.ru — Cisco Umbrella Rank: 846246	1 KB
4	travelpayouts.com www.travelpayouts.com — Cisco Umbrella Rank: 169776	72 KB
3	avsplow.com 1 redirects st.avsplow.com — Cisco Umbrella Rank: 239870 avsplow.com — Cisco Umbrella Rank: 195157	15 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 25 region1.google-analytics.com — Cisco Umbrella Rank: 2368	20 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	128 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 194	17 KB
25	7

	Domain	Requested by
9	booking.negx.net	booking.negx.net www.travelpayouts.com
4	mamka.aviasales.ru	booking.negx.net
4	www.travelpayouts.com	booking.negx.net
2	avsplow.com	1 redirects booking.negx.net
2	www.googletagmanager.com	booking.negx.net www.googletagmanager.com
1	region1.google-analytics.com	www.googletagmanager.com
1	www.google-analytics.com	www.googletagmanager.com
1	st.avsplow.com	booking.negx.net
1	cdnjs.cloudflare.com	booking.negx.net
1	www.negx.net	booking.negx.net
25	10

This site contains links to these domains. Also see Links.

Domain
www.negx.net
www.travelpayouts.com

Subject Issuer	Validity	Valid
booking.negx.net R3	`2023-03-23` - `2023-06-21`	3 months	crt.sh
*.aruba.it Actalis Organization Validated Server CA G3	`2022-04-05` - `2023-04-05`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
travelpayouts.com R3	`2023-02-26` - `2023-05-27`	3 months	crt.sh
*.aviasales.ru AlphaSSL CA - SHA256 - G2	`2022-08-22` - `2023-09-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://booking.negx.net/
Frame ID: 16F23646EA17F919CA27E699C0DC18C9
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Motore di ricerca prezzi di Hotel, case vacanza, B&B e Voli

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Rollbar (Issue trackers) Expand

Overall confidence: 100%
Detected patterns

rollbar\.js/([0-9.]+)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

25
Requests

92 %
HTTPS

50 %
IPv6

7
Domains

10
Subdomains

11
IPs

4
Countries

765 kB
Transfer

4169 kB
Size

12
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.negx.net/

Search URL Search Domain Scan URL

URL: https://www.travelpayouts.com/?marker=265103.poweredby&utm_source=powered_by&utm_medium=widget&utm_campaign=mewtwo

Search URL Search Domain Scan URL

URL: https://www.travelpayouts.com/promo/whitelabel/en/?marker=265103.poweredby&utm_source=powered_by&utm_medium=whitelabel&utm_campaign=whitelabel

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 19

https://avsplow.com/a/j.gif?p=web&tv=pixel&e=se&aid=tp_widgets&se_ca=mewtwo&se_ac=proxy_init&co=%7B%22schema%22%3A%22contexts%22%2C%22data%22%3A%5B%7B%22schema%22%3A%22event%22%2C%22data%22%3A%7B%22widget_id%22%3A%22whitelabel_it%22%2C%22trace_id%22%3A%22Zzd4dc4b6fed0c489a81c9f97-265103%22%2C%22promo_id%22%3A%224238%22%7D%7D%5D%7D HTTP 302
https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22whitelabel_it%22,%22trace_id%22:%22Zzd4dc4b6fed0c489a81c9f97-265103%22,%22promo_id%22:%224238%22%7D%7D%5D%7D&aid=tp_widgets&tv=pixel&se_ac=proxy_init&se_ca=mewtwo&p=web

25 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
booking.negx.net/ 20 KB
5 KB 222ms
84ms Document
text/html 23.111.238.40
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.111.238.40 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 3e6ea4b968225c33178bee0cd392970f3140cd520e511d1321ef0efd6f7a21dc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 23 Mar 2023 16:22:04 GMT
x-request-id: 94b16ef1d08f34269ae9c919fe2e35c4

GET
H2 200 search-form.js Show response
booking.negx.net/whitelabel/v1/ 7 KB
2 KB 154ms
154ms Script
application/javascript 23.111.238.40
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.negx.net/whitelabel/v1/search-form.js?locale=it&salt=1de43e6d-1e71-4b51-9c92-043786733a9c
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.111.238.40 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: e720a666893112488caf7f1407f237631e7cf52b67bbc069b5c2996b7002a784

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

x-promo-id: 4238
date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=0
x-robots-tag: noindex
timing-allow-origin: *
link: </mewtwo/styles.css?v=002>; rel=preload; as=style, </widgets_static/whitelabel_it.js?locale=it&salt=1de43e6d-1e71-4b51-9c92-043786733a9c>; rel=preload; as=script
content-length: 1964
x-request-id: 9453a69f28da73a6d78f88f77d998437

GET
H2 200 main.js Show response
booking.negx.net/whitelabel/v1/ 771 KB
148 KB 129ms
129ms Script
application/javascript 23.111.238.40
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.negx.net/whitelabel/v1/main.js?locale=it&salt=1de43e6d-1e71-4b51-9c92-043786733a9c
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.111.238.40 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: e2fd08d043bd06edc2a38a2f528b2e14df31bb65098ac256b72b79967767f416

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
last-modified: Tue, 21 Mar 2023 06:31:40 GMT
etag: "64194f4c-24de0"
content-length: 151008
x-request-id: fdf7b5a3bae51220169fff0744fe1019
content-type: application/javascript; charset=utf-8

GET
H2 200 main.css
booking.negx.net/whitelabel/v1/ 2 MB
219 KB 30ms
30ms Stylesheet
text/css 23.111.238.40
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.negx.net/whitelabel/v1/main.css?rtl=false&salt=1de43e6d-1e71-4b51-9c92-043786733a9c
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.111.238.40 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 6af92538cc217bad5cc5497f488bf8a7786da628afde2f5b3c62279dd72e659e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
last-modified: Tue, 21 Mar 2023 06:31:54 GMT
etag: "64194f5a-36a9c"
content-length: 223900
x-request-id: 759cd614218d671b71b93c59272dd3a0
content-type: text/css

GET
H2 200 Trovaprezzi-e-confronta-Hotel-viaggi-Voli-.png
www.negx.net/wp-content/uploads/2020/01/ 0
0 266ms
47ms Image
text/html 89.46.109.44
ARUBA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.negx.net/wp-content/uploads/2020/01/Trovaprezzi-e-confronta-Hotel-viaggi-Voli-.png
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.46.109.44 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx1373.aruba.it
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 130 KB
49 KB 215ms
88ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M47KB56

Requested by

Host: booking.negx.net
URL: https://booking.negx.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2c8675bf508a3496a8c1a590f47dbd4a9fadb8cb25ba8726d0f4e0bcb87c2110

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49763
x-xss-protection: 0
last-modified: Thu, 23 Mar 2023 15:14:09 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 23 Mar 2023 16:22:04 GMT

GET
H2 200 styles.css
booking.negx.net/mewtwo/ 167 KB
12 KB 131ms
131ms Stylesheet
text/css 23.111.238.40
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.negx.net/mewtwo/styles.css?v=002
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.111.238.40 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 5627529e11b9dc9abd9754a8011415cb5244d37c15cecfafc2c05ba533c1340e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
last-modified: Mon, 05 Dec 2022 13:46:53 GMT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=600
content-length: 11680
x-request-id: 31fe7466bcc701acef0fa96e790c3d02

GET
H2 200 whitelabel_it.js Show response
booking.negx.net/widgets_static/ 317 KB
62 KB 157ms
157ms Script
application/javascript 23.111.238.40
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.negx.net/widgets_static/whitelabel_it.js?locale=it&salt=1de43e6d-1e71-4b51-9c92-043786733a9c
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.111.238.40 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: d2684462adf7df8d14bffae2318e563723042014e51a71dc204266464ac3c059

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: gzip
last-modified: Mon, 05 Dec 2022 13:49:37 GMT
etag: W/"638df6f1-4f32f"
x-request-id: 737caed53a3f102c1c1938a9eedc8416
content-type: application/javascript; charset=utf-8

GET
H2 200 rollbar.min.js Show response
cdnjs.cloudflare.com/ajax/libs/rollbar.js/2.3.9/ 58 KB
17 KB 93ms
37ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/rollbar.js/2.3.9/rollbar.min.js

Requested by

Host: booking.negx.net
URL: https://booking.negx.net/whitelabel/v1/main.js?locale=it&salt=1de43e6d-1e71-4b51-9c92-043786733a9c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ee21873f0f644e948c8ccc8cbb2647d2691a94b1a36b3ed9980672b103d71d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://booking.negx.net/
Origin: https://booking.negx.net
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 11097882
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 16327
last-modified: Mon, 04 May 2020 16:16:01 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fc1-e9f8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxE3vn66NH8SHREpH9Szl47K3S0CIA9HVDKIs0gZo8jdy2XDDjwVzkiJ5fUTPPE3G0fGDiB4IyzjEthOsPKgqNxWJz1QbiRfw79aCuZLwMaad3O8o83N7GLQDjjc1IfKPBFndBMN6n9Q7Y3%2BLIl8oOIo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7ac802d52dd91c90-AMS
expires: Tue, 12 Mar 2024 16:22:04 GMT

GET
H2 200 sp.js Show response
st.avsplow.com/19.18.12/ 41 KB
14 KB 93ms
38ms Script
application/x-javascript 2606:4700:20::ac43:44ed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.avsplow.com/19.18.12/sp.js
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/whitelabel/v1/main.js?locale=it&salt=1de43e6d-1e71-4b51-9c92-043786733a9c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:44ed , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c266b32e3008dfd1061e143c92be4bb7e6e293a80005e23c7289f932001b2bff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 121837
cf-polished: origSize=42670
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 20 Mar 2023 11:06:37 GMT
server: cloudflare
etag: W/"19ae50cc8f44735f712dc77bd3c22064"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rs2JGmSgI38nOkCabrszaABXlOm2WScr%2FFyj1M5bGIM%2BjeALP2rsub9pVneyYZe%2FcXB3%2BZd4dpjVg5WReOGpQTAhWageRVEBFN%2FlfmyWneCljXm0Mjj0lYJW07cXq%2Fq0HpgRDnS3rnBfoQcC"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: public, max-age=31536000
cf-ray: 7ac802d56a5d0a4d-AMS

GET
DATA 200
OK truncated
/ 270 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e06f132ba0bd7ee1aa2b5e4294f5f37fc47702f811ebfe823d11c316639194a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 currency-regular-webfont.woff2
www.travelpayouts.com/currency_fonts/ 4 KB
4 KB 130ms
50ms Font
application/octet-stream 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelpayouts.com/currency_fonts/currency-regular-webfont.woff2
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/whitelabel/v1/main.css?rtl=false&salt=1de43e6d-1e71-4b51-9c92-043786733a9c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 4ba3cac275ae4d06824607aa55da87e077a60cc9608aa0d6d8b6004922573d2e

Request headers

Referer: https://booking.negx.net/
Origin: https://booking.negx.net
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
last-modified: Thu, 23 Mar 2023 06:22:47 GMT
server: nginx
etag: "641bf037-e08"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 3592
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 set
mamka.aviasales.ru/third_party_cookies/ 0
295 B 84ms
24ms Image
text/plain 23.108.212.76
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mamka.aviasales.ru/third_party_cookies/set?mamka_version=0.0.13&mamka_utc_datetime=2023-03-23T16%3A22%3A04.271Z
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.212.76 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 0
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain charset=UTF-8

GET
H2 200 tp.png
www.travelpayouts.com/powered_by/img/ 4 KB
4 KB 108ms
31ms Image
image/png 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelpayouts.com/powered_by/img/tp.png
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2485b6352182e9b84c6010dedea330b64058983d22008327a64fd7d9b10df905

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
last-modified: Tue, 13 Sep 2022 13:39:39 GMT
server: nginx
accept-ranges: bytes
etag: "6320881b-e00"
content-length: 3584
content-type: image/png

GET
DATA 200
OK truncated
/ 345 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 34b78c3408288a9518fdfeb20235670ec71822d4352c588fa2463966f46f9f26

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 130ms
58ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M47KB56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 23 Mar 2023 16:05:11 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 1013
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Thu, 23 Mar 2023 18:05:11 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 230 KB
79 KB 89ms
88ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6C1GFWKMT9&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M47KB56

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2960fde49e081d701c3609fad0cd9931c5e125f0a7a564925973e2af9cfc3b42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 80963
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 23 Mar 2023 16:22:04 GMT

GET
H2 200 whitelabel_it.js Show response
booking.negx.net/widgets/ 7 KB
2 KB 126ms
126ms Script
application/javascript 23.111.238.40
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.negx.net/widgets/whitelabel_it.js
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/whitelabel/v1/main.js?locale=it&salt=1de43e6d-1e71-4b51-9c92-043786733a9c
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.111.238.40 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: e2660d048012d8266ca1227ecce99d1339fbb822ff4aa3cfa788679a253bbb06

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

x-promo-id: 4238
date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=0
x-robots-tag: noindex
timing-allow-origin: *
link: </mewtwo/styles.css?v=002>; rel=preload; as=style, </widgets_static/whitelabel_it.js>; rel=preload; as=script
content-length: 1933
x-request-id: 4311784731d75d1c345c190229dca6a6

GET
H2 200 whitelabel_it.js Show response
booking.negx.net/widgets_static/ 317 KB
62 KB 176ms
176ms Script
application/javascript 23.111.238.40
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.negx.net/widgets_static/whitelabel_it.js
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.111.238.40 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: d2684462adf7df8d14bffae2318e563723042014e51a71dc204266464ac3c059

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: gzip
last-modified: Mon, 05 Dec 2022 13:49:37 GMT
etag: W/"638df6f1-4f32f"
x-request-id: 799f76535228885bd80532ec52191f13
content-type: application/javascript; charset=utf-8

GET
H2 200 whitelabel_it.js Show response
www.travelpayouts.com/widgets_static/ 317 KB
62 KB 69ms
69ms Script
application/javascript 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://www.travelpayouts.com/widgets_static/whitelabel_it.js
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/widgets/whitelabel_it.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: d2684462adf7df8d14bffae2318e563723042014e51a71dc204266464ac3c059

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: gzip
last-modified: Mon, 05 Dec 2022 13:47:59 GMT
server: nginx
etag: W/"638df68f-4f32f"
content-type: application/javascript; charset=utf-8

GET
H2

200

j.gif
avsplow.com/a/
Redirect Chain

https://avsplow.com/a/j.gif?p=web&tv=pixel&e=se&aid=tp_widgets&se_ca=mewtwo&se_ac=proxy_init&co=%7B%22schema%22%3A%22contexts%22%2C%22data%22%3A%5B%7B%22schema%22%3A%22event%22%2C%22data%22%3A%7B%2...
https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22whitelabel_it%22,%22trace_id%22:%22Zzd4dc4b6f...

43 B
388 B

50ms
49ms

Image
image/gif

185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22whitelabel_it%22,%22trace_id%22:%22Zzd4dc4b6fed0c489a81c9f97-265103%22,%22promo_id%22:%224238%22%7D%7D%5D%7D&aid=tp_widgets&tv=pixel&se_ac=proxy_init&se_ca=mewtwo&p=web
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"
access-control-allow-origin: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 43

Redirect headers

date: Thu, 23 Mar 2023 16:22:04 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"
location: https://avsplow.com/a/j.gif?e=se&b3pc=true&co=%7B%22schema%22:%22contexts%22,%22data%22:%5B%7B%22schema%22:%22event%22,%22data%22:%7B%22widget_id%22:%22whitelabel_it%22,%22trace_id%22:%22Zzd4dc4b6fed0c489a81c9f97-265103%22,%22promo_id%22:%224238%22%7D%7D%5D%7D&aid=tp_widgets&tv=pixel&se_ac=proxy_init&se_ca=mewtwo&p=web
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 0

GET
H2 200 set
mamka.aviasales.ru/third_party_cookies/ 0
295 B 25ms
25ms Image
text/plain 23.108.212.76
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mamka.aviasales.ru/third_party_cookies/set?mamka_version=0.0.13&mamka_utc_datetime=2023-03-23T16%3A22%3A04.564Z&mamka_attempts=1
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.212.76 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 0
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain charset=UTF-8

POST
H2 204 collect
region1.google-analytics.com/g/ 0
255 B 83ms
28ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-6C1GFWKMT9&gtm=45je33k0&_p=1573788281&cid=1121274566.1679588525&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1679588524&sct=1&seg=0&dl=https%3A%2F%2Fbooking.negx.net%2F&dt=Motore%20di%20ricerca%20prezzi%20di%20Hotel%2C%20case%20vacanza%2C%20B%26B%20e%20Voli&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6C1GFWKMT9&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 23 Mar 2023 16:22:04 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://booking.negx.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 whereami Show response
booking.negx.net/ 130 B
268 B 30ms
30ms Script
application/x-javascript 23.111.238.40
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.negx.net/whereami?locale=it&callback=mewtwoForms.geoIPSetter.lang_it
Requested by: Host: www.travelpayouts.com
URL: https://www.travelpayouts.com/widgets_static/whitelabel_it.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.111.238.40 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2887be08f7d2f10a0510071f8454deca14caf66127ed15462b0265a12fd8fa25

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 23 Mar 2023 16:22:04 GMT
content-encoding: br
content-length: 118
x-request-id: ac10a9e965fcc3db3a007ac7509e54d0
content-type: application/x-javascript; charset=utf-8

GET
H2 200 tp_white.png
www.travelpayouts.com/powered_by/img/ 3 KB
3 KB 50ms
50ms Image
image/png 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelpayouts.com/powered_by/img/tp_white.png
Requested by: Host: booking.negx.net
URL: https://booking.negx.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2b987833855741a74ca43f6003d83d784ed04ff8a496ea912ea48a1433f87f84

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Thu, 23 Mar 2023 16:22:04 GMT
last-modified: Tue, 13 Sep 2022 13:39:39 GMT
server: nginx
accept-ranges: bytes
etag: "6320881b-a70"
content-length: 2672
content-type: image/png

GET
DATA 200
OK truncated
/ 611 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d15575251d6c55006df827f685f5ea1f95840c0f63e811793bff8637bce3136e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 381 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4b5780cd432aada909b865e2a31b2d68601c1f1255a41a4c175f7f78ddc7196

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 129 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f3542700f3a46544b893c31ee1a1b7c132d479115d1d312375ffb8d82685690

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 900 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 308313e7690f9533c03f7542b7e72a33c706180fecaf3ce57d42c12c4e5b0ee3

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 196 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b07169adb5265b1f2475ebfd8d8d9b28b2eee9a283a263be746a484384d1ad7

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 set
mamka.aviasales.ru/third_party_cookies/ 0
295 B 25ms
24ms Image
text/plain 23.108.212.76
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mamka.aviasales.ru/third_party_cookies/set?mamka_version=0.0.13&mamka_utc_datetime=2023-03-23T16%3A22%3A05.115Z&mamka_attempts=2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.212.76 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 0
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain charset=UTF-8

GET
H2 200 set
mamka.aviasales.ru/third_party_cookies/ 0
295 B 25ms
24ms Image
text/plain 23.108.212.76
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mamka.aviasales.ru/third_party_cookies/set?mamka_version=0.0.13&mamka_utc_datetime=2023-03-23T16%3A22%3A07.642Z&mamka_attempts=3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.108.212.76 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://booking.negx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 0
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain charset=UTF-8

Verdicts & Comments Add Verdict or Comment

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
booking.negx.net/	1970-01-20 20:09:08	Name: auid_tp Value: CtYRWmQcfKy/u3zQA7S4Ag==
booking.negx.net/	1970-01-20 20:09:08	Name: auid_ab Value: CtY4rGQcfKw33p0ABEGBAg==
.negx.net/	1970-01-20 10:33:08	Name: mtdc_6lO4Z Value: true
booking.negx.net/	1970-01-20 20:09:08	Name: locale Value: it
.negx.net/	1970-01-20 11:16:20	Name: marker Value: 265103.%241489
booking.negx.net/	1970-01-20 20:09:08	Name: cookie_policy_accepted Value: true
booking.negx.net/	1970-01-20 20:09:08	Name: currency Value: EUR
.negx.net/	1970-01-20 10:33:10	Name: _sp_ses.a05a Value: *
.negx.net/	1970-01-20 20:09:08	Name: _ga Value: GA1.1.1121274566.1679588525
.negx.net/	1970-01-20 20:09:08	Name: _ga_6C1GFWKMT9 Value: GS1.1.1679588524.1.0.1679588524.0.0.0
.avsplow.com/	1970-01-20 19:18:44	Name: nuid Value: 3d6d4bb7-7097-4460-bb98-0fdf24df5f09
.negx.net/	1970-01-20 20:09:08	Name: _sp_id.a05a Value: 6afcd00e-df37-4384-b89b-38829208131c.1679588524.1.1679588525.1679588524.e16c6f71-6066-4af3-baa4-37bf8dd860b0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

avsplow.com
booking.negx.net
cdnjs.cloudflare.com
mamka.aviasales.ru
region1.google-analytics.com
st.avsplow.com
www.google-analytics.com
www.googletagmanager.com
www.negx.net
www.travelpayouts.com
172.255.224.36
185.106.81.236
2001:4860:4802:32::36
23.108.212.76
23.111.238.40
2606:4700:20::ac43:44ed
2606:4700::6811:180e
2a00:1450:4001:827::2008
2a00:1450:4001:82a::200e
89.46.109.44
0ee21873f0f644e948c8ccc8cbb2647d2691a94b1a36b3ed9980672b103d71d4
2485b6352182e9b84c6010dedea330b64058983d22008327a64fd7d9b10df905
2887be08f7d2f10a0510071f8454deca14caf66127ed15462b0265a12fd8fa25
2960fde49e081d701c3609fad0cd9931c5e125f0a7a564925973e2af9cfc3b42
2b987833855741a74ca43f6003d83d784ed04ff8a496ea912ea48a1433f87f84
2c8675bf508a3496a8c1a590f47dbd4a9fadb8cb25ba8726d0f4e0bcb87c2110
308313e7690f9533c03f7542b7e72a33c706180fecaf3ce57d42c12c4e5b0ee3
34b78c3408288a9518fdfeb20235670ec71822d4352c588fa2463966f46f9f26
3e6ea4b968225c33178bee0cd392970f3140cd520e511d1321ef0efd6f7a21dc
4ba3cac275ae4d06824607aa55da87e077a60cc9608aa0d6d8b6004922573d2e
5627529e11b9dc9abd9754a8011415cb5244d37c15cecfafc2c05ba533c1340e
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
6af92538cc217bad5cc5497f488bf8a7786da628afde2f5b3c62279dd72e659e
6f3542700f3a46544b893c31ee1a1b7c132d479115d1d312375ffb8d82685690
8b07169adb5265b1f2475ebfd8d8d9b28b2eee9a283a263be746a484384d1ad7
8e06f132ba0bd7ee1aa2b5e4294f5f37fc47702f811ebfe823d11c316639194a
c266b32e3008dfd1061e143c92be4bb7e6e293a80005e23c7289f932001b2bff
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
d15575251d6c55006df827f685f5ea1f95840c0f63e811793bff8637bce3136e
d2684462adf7df8d14bffae2318e563723042014e51a71dc204266464ac3c059
e2660d048012d8266ca1227ecce99d1339fbb822ff4aa3cfa788679a253bbb06
e2fd08d043bd06edc2a38a2f528b2e14df31bb65098ac256b72b79967767f416
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4b5780cd432aada909b865e2a31b2d68601c1f1255a41a4c175f7f78ddc7196
e720a666893112488caf7f1407f237631e7cf52b67bbc069b5c2996b7002a784

booking.negx.net Open in urlscan Pro 23.111.238.40 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

25 Requests

92 %HTTPS

50 %IPv6

7 Domains

10 Subdomains

11 IPs

4 Countries

765 kBTransfer

4169 kBSize

12 Cookies

3 Outgoing links

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

booking.negx.net Open in urlscan Pro
23.111.238.40 Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

92 %
HTTPS

50 %
IPv6

7
Domains

10
Subdomains

11
IPs

4
Countries

765 kB
Transfer

4169 kB
Size

12
Cookies

25 HTTP transactions
7 data transactions